Regulations, 2015

L.N. 19 of 2015

DATA PROTECTION ACT

(CAP. 440)

Processing of Personal Data (Education Sector)

Regulations, 2015

IN EXERCISE of the powers conferred by article 28(1) of the

Data Protection Act, the Minister for Social Dialogue, Consumer

Affairs and Civil Liberties, after consultation with the Information

and Data Protection Commissioner and the Minister for Education

and Employment, has made the following regulations:-

The title of these regulations is the Processing of Personal Citation.

Data (Education Sector) Regulations, 2015.

(1)

In these regulations unless the context determines Interpretation.

otherwise requires

"Act" means the Data Protection Act;

"Corporation" means the Employment and Training Corporation

established under the Employment and Training Services Act;

"data controller" means education authorities, educational

institutions, examination bodies and the Corporation;

"education authorities" means the Directorates constituted in

terms of Part II of the Education Act, as well as the National Cap. 327.

Commission for Further and Higher Education established in terms of

Part VI of the Education Act;

"educational institutions" means any licensed school or other

institution or entity offering educational services, whether at a pre-

primary (kindergarten), primary, secondary, post-secondary or tertiary

level and also includes further and higher educational institutions,

institutions offering formal and non-formal learning, and vocational

education;

"examination bodies" means any entity other than educational

institutions authorised to conduct national assessments;

"pseudonymous data" means personal data that can no longer be

attributed in any manner to a specific data subject without the use of

any other additional information to be kept separately to ensure non-

attribution;

"student" means any data subject registered and, or attending an

education institution and, or registered with an examination body;

"student welfare data" means records related to the welfare and

social behaviour of the student including court orders regarding

custody of minors, information compiled by child protection services

including guidance and counselling, as well as any other information

obtained from the student, parent, legal guardian, law enforcement

officers or other support agencies.

(2) The definitions contained in article 2 of the Act shall,

subject to the provisions of sub-regulation (1), apply to these

regulations.

For the purposes of these regulations, a notification for

prior checking shall be made to the Commissioner, where applicable

in terms of article 34 of the Act, including in the following cases

(a)

processing operations carried out on the basis of

the best interest of the student;

(b)

processing operations carried out in the public

interest;

(c)

processing operations carried out for reconciliation

purposes in terms of regulation 4(4)(a);

(d)

processing operations carried out in terms of

regulation 4(8).

(1)

Education authorities may process personal data in

relation to students and, where specifically required in the best

interest of the students, personal data of parents and legal guardians

may also be processed to carry out their functions as provided under

the Education Act.

(2) (a)

In the course of executing their functions subject to

sub-regulation (1), education authorities may, from time to time, and

by means of a written request, require educational institutions to

furnish, in such manner as may be requested and within a reasonable

time, personal data in relation to students attending such educational

institutions, and their parents or legal guardians.

(b)

Sensitive personal data shall be requested only with

the explicit consent of the parent or legal guardian.

(3) Where data regarding educational attainment and ability in

relation to the student held by educational institutions is required by

the educational authorities in order to fulfil their functions as laid

down in the Education Act, educational institutions shall substitute Cap. 327.

identifiable data with pseudonymous data, provided that any follow-

up action is to be carried out by the educational institutions which

transmitted the data as instructed by the education authorities.

(4) In monitoring the participation of students in national

assessments, where there are discrepancies between the education

authorities and examination bodies in relation to students sitting for

national assessments, education authorities may request examination

bodies to provide the data, provided that

(a)

such personal data are only used for reconciliation

purposes;

(b)

no results associated to identifiable students are

requested, and

(c)

all personal identifiable data are rendered

anonymous, deleted or destroyed, immediately after the

reconciliation exercise is conducted.

(5) Subject to the provisions of regulation 8, education

authorities may process personal data for research and statistics

purposes to perform tasks in the public interest and to exercise their

functions in accordance with the Education Act.

(6) In implementing targeted policies and, or initiatives to

assist students who do not achieve the required levels in national

assessments for accession into further and higher education, or for an

active participation in employment opportunities, education

authorities may instruct examination bodies and, or educational

institutions to forward any communication issued by the education

authorities to inform students who are eligible to benefit from such

targeted policies and, or initiatives. Where such instructions cannot

be met by the examination bodies and, or educational institutions,

personal data of students eligible to be addressed by the targeted

policies and, or initiatives concerned shall be forwarded to the

education authorities in order to enable them to communicate directly

with the students concerned, provided that only the identifiable

details of students opting to make use of such specialised services

will be processed by the education authorities in the context of the

targeted policy and, or initiative.

(7) Pursuant to sub-regulation (6), all personal identifiable

data are to be rendered anonymous, deleted or destroyed, after the

specialised services in line with the targeted policies and, or

initiatives concerned are delivered, unless specific consent is obtained

from the students themselves where applicable, or from their parents

or legal guardians.

(8) Without prejudice to the provisions of sub-regulations (3)

and (6), and regulation 8, whenever education authorities are

involved in national initiatives with regards to employment

opportunities, and, or the alignment of jobs with the studies or

qualifications achieved, the education authorities may require

examination bodies and, or educational institutions to furnish them

with such data deemed necessary for the national initiative, provided

that

(a)

identifiable data are only requested if strictly

required to take the necessary measures in the interest of the

students in the implementation of such national initiatives;

(b)

only data of students over compulsory school age

may be requested;

(c)

identifiable data of students who eventually do not

participate in such national initiatives are deleted, destroyed, or

rendered anonymous.

(1)

Educational institutions may process personal data

in relation to students, parents and legal guardians for administration

purposes and for the daily operations and efficient running of such

institutions for the purpose of providing their students with the

necessary educational services as required under the Education Act.

(2) Personal data in relation to students may also be processed

for the following purposes

(a)

academic progress monitoring which includes

performance data, examination and, or assessment results

associated with the students;

(b)

organisation of functions and, or activities which

may form part of curricular and extra-curricular requirements,

provided that where the processing is related to informal

activities the consent is obtained from the students themselves if

applicable, or from their parents or legal guardians.

(3) Medical data in relation to the students attending the

institutions, as provided by medical professionals and, or by the

parents or legal guardians, or by the students themselves where

applicable, may also be processed by the educational institutions in

the best interest of their students, and provided that

(a)

such data are held in separate distinctive files in a

secure manner; and

(b)

if the students are following compulsory schooling,

such data may be forwarded in the best interest of the students,

to another educational institution to which students are

transferred; and

(c)

such data are destroyed once the students stop

attending the institution concerned.

(4) Student welfare data may also be processed by the

educational institutions in the best interest of their students, and

provided that

(a)

such data are held in separate distinctive files in a

secure manner; and

(b)

if the students are within compulsory schooling,

such data may be forwarded in the best interest of the students,

to another educational institution where students are transferred

to; and

(c)

such data are destroyed once the students stop

attending the institution concerned.

(5) Educational institutions may process visual images

provided that consent is obtained from the students themselves if

applicable, or from the parents or legal guardians.

(6) Educational institutions may keep records of their students

for historic purposes provided that no sensitive data and student

welfare data are retained for such purposes.

(7) Subject to the provisions of regulation 8, educational

institutions may process personal data for research and statistics

purposes to perform tasks which are required by the education

authorities in terms of regulation 4, or in the legitimate interest of the

educational institution to provide the necessary education to their

students.

(8) Consent required under this regulation shall be obtained

from the students themselves if applicable, or from their parents or

legal guardians, prior to disclosure of personal data to third parties

unless such third parties are any of the following

(a)

education authorities processing personal data in

terms of regulation 4;

(b)

another educational institution where a student is

transferred to;

(c)

examination bodies as part of the examinations

process and, or national assessments;

(d)

health authorities in the fulfilment of their

functions under the Public Health Act;

(e)

hospitals, clinics and other medical professionals

where students need medical attention;

(f)

the Police in cases of criminal investigations;

(g)

social workers or support agencies or authorities

where there is suspicion or where it is alleged that the welfare of

the student is not being protected;

(h)

the Corporation in accordance with the

Employment and Training Services Act in terms of regulation 4

of these regulations;

(i)

any court, as required in judicial proceedings.

(9) Without prejudice to the provisions of regulation 8, the

Corporation, in fulfilment of its statutory functions and in accordance

with the Employment and Training Services Act, may request

educational institutions to be provided with personal data of students

pursuing studies in such institutions. For this purpose, educational

institutions shall provide such data in their possession provided that

students whose data are being forwarded shall have attained the age

of fourteen years at the time of the request.

Without prejudice to the provisions of article 26 of

the Act, access to personal data in relation to students and parents or

legal guardians shall be restricted to those employees who by virtue

of their roles and responsibilities are required to process such data

(a)

are subject to the Professional Secrecy Act; or

(b)

form part of a regulated profession, and, or have

taken an oath of confidentiality for the carrying out of their

(2) For the purposes of this regulation, employees who "form

part of a regulated profession" shall also be deemed to include any

person acting under the personal direction and supervision of such

regulated professional.

(1)

Mingħajr preġudizzju għad-dispożizzjonijiet tal- Aċċess għad-

artikolu 26 tal-Att, l-aċċess għal data personali li tirrigwarda studenti data.

u l-ġenituri jew tuturi legali għandha tkun ristretta għal dawk l-

impjegati li minħabba l-irwoli u r-responsabbiltajiet tagħhom huma

meħtieġa li jipproċessaw data ta’ dan it-tip u

(a)

huma

suġġetti

għall-Att

dwar

Segretezza Kap. 377.

Professjonali; jew

(b)

jiffurmaw parti minn professjoni regolata, u, jew

ikunu ħadu l-ġurament tal-kunfidenzjalità għall-qadi ta’

dmirijiethom.

(2) Għall-finijiet ta’ dan ir-regolament, l-impjegati li

"jiffurmaw parti minn professjoni regolata" għandhom ukoll jinkludu

kull persuna li taħdem taħt id-direzzjoni diretta u s-superviżjoni ta’

professjonist hekk regolat.

(1)

For the purposes of these regulations any student Consent.

who has attained the age of sixteen years shall be eligible to give

consent as required by these regulations, and to exercise all the rights

under the Act.

(2) All consents shall be made in writing or by a clear

indication of opting in where consent is required to be given through

on-line applications. Any consent given by the student where

applicable or by any parent or legal guardian, may be withdrawn in

writing, and the data controller shall remove such consent and stop

such processing operation for which the consent has been withdrawn

and delete or destroy the data concerned.

(1)

When processing of personal data is required for Processing for

research and statistics purposes, all identifiable data shall be rendered research

statistics

anonymous, unless in the case of research, the identification of the purposes.

data subject is required to fulfil the purposes of such research.

(2) Within the limits of these regulations, where, for the

purposes of implementing specific targeted policies, the research

being conducted would require the identification details of students,

data controllers shall process such data by replacing personal

identification data with pseudonymous data, and eventually limiting

the re-identification of students only to those cases which specifically

fall within the parameters of the target policy

Provided that the process replacing the identification

details with pseudonymous data is carried out by the data controller

originally in possession of the identifiable details

Provided further that where identification is required in

terms of the preceding sub-regulations, such data shall not be used for

any decision concerning the data subject.

(3) Where the research is required by other entities, not being

the education authorities in terms of regulation 2, and the

identification details of students are required for the purposes of the

research in question, specific consent shall be obtained from the

students themselves where applicable or from the parents or legal

guardians concerned.

(4) When, for the purposes of the preceding sub-regulations,

pseudonymous data are processed, data controllers shall ensure that

(a)

personal data are not processed for any other

purpose that is incompatible with the specific purpose of the

targeted policy and, or initiative, and in particular that it is not

processed for the purpose of supporting measures or decisions

with respect to the student, either specifically related to the

targeted policy and, or initiative or otherwise;

(b)

data enabling the attribution of information to an

identified or identifiable data subject are kept separately from

the other data;

(c)

adequate organisational and technical safeguards

are in place to protect the personal data against any unlawful

forms of processing;

(d)

personal data shall not be retained for a period

which is longer than necessary and all identifiable details shall

be rendered anonymous, deleted, or destroyed, following the

completion of the policy and, or initiative implementation.

(5) Where the research involves the processing of sensitive

personal data, such processing shall be approved by the Information

and Data Protection Commissioner in terms of article 16(2)(b) of the

Act.

€0.72