Abstract:

The General Data Protection Regulation, from now on GDPR, was put into action in May 2018. It outlines key principles that must be followed for any entity that is collecting personal data related to people residing in the European Union. Amongst the entities that have to comply with the new Regulation are schools. This paper focuses on primary and secondary education‧ it covers a wide range of controversial issues and aims to provide an overview of a schools’ obligations and responsibilities vis a vis GDPR. It determines major definitions under school reality, enlightens basic blur points, and stipulates what schools as Data Controllers must do. Terms like 'processing', 'sensitive personal data', 'privacy policy', 'consent', 'DPO' are explained. Moreover, the special case of distance learning in Greece amidst the Covid-19 pandemic is thoroughly analyzed. This research touches upon the aspect of distance education and how schools can be exposed due to the non-compliance with the new Regulation. Due to rush transition to e-learning platforms plenty GDPR disputes occurred and are presented in this paper. Transparent issues came along to both synchronous and asynchronous learning methods and are listed in comparison. Additionally, all the violations concerning the provisions of the Regulation are categorized per article and numbered in a table, as the Greek Data Protection Authority decided. Finally, a couple of possible, mainly technical, solutions are proposed to the difficulties that might emerge in the effort to build a strong GDPR school environment. The importance of GDPR compliance is apparent and indicated in every chapter.

Keywords:

GDPR, schools, personal data, e-learning, distance education, Sars-CoV2.