PROCESSING OF PERSONAL DATA (EDUCATION SECTOR) REGULATIONS (educationsector)

SUBSIDIARY LEGISLATION 586.07

PROCESSING OF PERSONAL DATA

(EDUCATION SECTOR) REGULATIONS

9th January, 2015

LEGAL NOTICE 19 of 2015, as amended by Acts XXVII of 2016 and II

of 2020, and Legal Notice 407 of 2021.

The title of these regulations is the Processing of Personal

Data (Education Sector) Regulations.

(1) In these regulations unless the context determines

otherwise requires

"Act" means the Data Protection Act;

"Corporation" means Jobsplus established under the

Employment and Training Services Act;

"data controller" means education authorities, educational

institutions, examination bodies and the Corporation;

"education authorities" means the Directorates constituted in

terms of Part II of the Education Act, as well as the Malta Further

and Higher Education Authority established in terms the Further and

Higher Education Act;

"educational institutions" means any licensed school or other

institution or entity offering educational services, whether at a pre-

primary (kindergarten), primary, secondary, post-secondary or

tertiary level and also includes further and higher educational

institutions, institutions offering formal and non-formal learning,

and vocational education;

"examination bodies" means any entity other than educational

institutions authorised to conduct national assessments;

"student" means any data subject registered and, or attending an

education institution and, or attending, or having attended, an

education institution and, or registered with an examination body;

"student welfare data" means records related to the welfare and

social behaviour of the student including court orders regarding

custody of minors, information compiled by child protection

services including guidance and counselling, as well as any other

information obtained from the student, parent, legal guardian, law

enforcement officers or other support agencies.

(2) The definitions contained in article 3 of the Act shall,

subject to the provisions of sub-regulation (1), apply to these

regulations.

For the purposes of these regulations, a notification for

prior checking shall be made to the Commissioner, where the

processing of personal data involves particular risks of improper

interference with the rights and freedoms of data subjects, including in

the following cases

(a) processing operations carried out on the basis of the

best interest of the student;

(b) processing operations carried out in the public interest;

(c) processing operations carried out for reconciliation

purposes in terms of regulation 4(4)(a);

(d) processing operations

carried

out

in

terms

of

regulation 4(8).

(1) Education authorities may process personal data in

relation to students and, where specifically required in the best

interest of the students, personal data of parents and legal guardians

may also be processed to carry out their functions as provided

under the Education Act.

(2)

(a) In the course of executing their functions subject to

sub-regulation (1), education authorities may, from

time to time, and by means of a written request, require

educational institutions to furnish, in such manner as

m a y b e re qu e s te d an d w i th i n a r e a s o na bl e t im e ,

personal data in relation to students attending such

educational institutions, and their parents or legal

guardians.

(b) Special categories of data listed in Article 9 of the

Regulation shall be requested only with the explicit

consent of the parent or legal guardian.

(3) Where data regarding educational attainment and ability in

relation to the student held by educational institutions is required

by the educational authorities in order to fulfil their functions as

laid down in the Education Act, educational institutions shall

substitute identifiable data with pseudonymous data, provided that

any follow-up action is to be carried out by the educational

institutions which transmitted the data as instructed by the

education authorities.

(4) In monitoring the participation of students in national

assessments, where there are discrepancies between the education

authorities and examination bodies in relation to students sitting for

national assessments, education authorities may request

examination bodies to provide the data, provided that

(a) such personal data are only used for reconciliation

purposes;

(b) no results associated to identifiable students are

requested, and

(c) all personal identifiable data are rendered anonymous,

deleted or destroyed, immediately after the

reconciliation exercise is conducted.

(5) Subject to the provisions of regulation 8, education

authorities may process personal data for research and statistics

purposes to perform tasks in the public interest and to exercise their

functions in accordance with the Education Act.

(6)

In implementing targeted policies and, or initiatives to

assist students who do not achieve the required levels in national

assessments for accession into further and higher education, or for

an active participation in employment opportunities, education

authorities may instruct examination bodies and, or educational

institutions to forward any communication issued by the education

authorities to inform students who are eligible to benefit from such

targeted policies and, or initiatives. Where such instructions cannot

be met by the examination bodies and, or educational institutions,

personal data of students eligible to be addressed by the targeted

policies and, or initiatives concerned shall be forwarded to the

education authorities in order to enable them to communicate

directly with the students concerned, provided that only the

ide ntifiable details of student s o pti ng t o ma k e u s e o f such

specialised services will be processed by the education authorities

in the context of the targeted policy and, or initiative.

(7) Pursuant to sub-regulation (6), all personal identifiable data

are to be rendered anonymous, deleted or destroyed, after the

specialised services in line with the targeted policies and, or

initiatives concerned are delivered, unless specific consent is

obtained from the students themselves where applicable, or from

their parents or legal guardians.

(8) Without prejudice to the provisions of sub-regulations (3)

and (6), and regulation 8, whenever education authorities are

involved in national and, or European initiatives and, or studies with

regard to employment opportunities, and, or the alignment of jobs with

the studies or qualifications achieved, the education authorities may

require examination bodies and, or educational institutions to furnish

them with such data deemed necessary for the national and, or

European initiative and, or study, provided that

(a) identifiable data are only requested if strictly required

to take the necessary measures in the interest of the

students in the implementation of such national and, or

European initiatives and, or studies;

(b) only data of students over compulsory school age may

be requested;

(c) identifiable data of students who eventually do not

participate in such national initiatives are deleted,

destroyed, or rendered anonymous.

(1) Educational institutions may process personal data in

relation to students, parents and legal guardians for administration

purposes and for the daily operations and efficient running of such

institutions for the purpose of providing their students with the

necessary educational services as required under the Education

Act.

(2) Personal data in relation to students may also be processed

for the following purposes

(a) academic progress monitoring which includes

performance data, examination and, or assessment

results associated with the students;

(b) organisation of functions and, or activities which may

form part of curricular and extra-curricular

requirements, provided that where the processing is

related to informal activities the consent is obtained

from the students themselves if applicable, or from

their parents or legal guardians.

(3) Medical data in relation to the students attending the

institutions, as provided by medical professionals and, or by the

parents or legal guardians, or by the students themselves where

applicable, may also be processed by the educational institutions in

the best interest of their students, and provided that

(a) such data are held in separate distinctive files in a

secure manner; and

(b) if the students are following compulsory schooling,

such data may be forwarded in the best interest of the

students, to another educational institution to which

students are transferred; and

(c) such data are destroyed once the students stop

attending the institution concerned.

(4) Student welfare data may also be processed by the

educational institutions in the best interest of their students, and

provided that

(a) such data are held in separate distinctive files in a

secure manner; and

(b) if the students are within compulsory schooling, such

data may be forwarded in the best interest of the

students, to another educational institution where

students are transferred to; and

(c) such data are destroyed once the students stop

attending the institution concerned.

(5) Educational institutions may process visual images

provided that consent is obtained from the students themselves if

applicable, or from the parents or legal guardians.

(6) Educational institutions may keep records of their students

for historic purposes provided that no special categories of data and

student welfare data are retained for such purposes.

(7) Subject to the provisions of regulation 8, educational

institutions may process personal data for research and statistics

purposes to perform tasks which are required by the education

authorities in terms of regulation 4, or in the legitimate interest of

the educational institution to provide the necessary education to

their students.

(8) Consent required under this regulation shall be obtained

from the students themselves if applicable, or from their parents or

legal guardians, prior to disclosure of personal data to third parties

unless such third parties are any of the following

(a) education authorities processing personal data in terms

of regulation 4;

(b) another educational institution where a student is

transferred to;

(c) examination bodies as part of the examinations process

and, or national assessments;

(d) health authorities in the fulfilment of their functions

under the Public Health Act;

(e) hospitals, clinics and other medical professionals

where students need medical attention;

(f)

the Police in cases of criminal investigations;

(g) social workers or support agencies or authorities

where there is suspicion or where it is alleged that the

welfare of the student is not being protected;

(h) the Corporation in accordance with the Employment

and Training Services Act in terms of regulation 4 of

these regulations;

(i) any court, as required in judicial proceedings.

(9) Without prejudice to the provisions of regulation 8, the

Corporation, in fu lfilment of its st atut ory functio ns and in

accordance with the Employment and Training Services Act, may

request educational institutions to be provided with personal data

of students pursuing studies in such institutions. For this purpose,

educational institutions shall provide such data in their possession

provided that students whose data are being forwarded shall have

attained the age of fourteen years at the time of the request.

(1) Without prejudice to the provisions of Article 32 of the

Regulation, access to personal data in relation to students and

parents or legal guardians shall be restricted to those employees

who by virtue of their roles and responsibilities are required to

process such data and

(a) are subject to the Professional Secrecy Act; or

(b) form part of a regulated profession, and, or have taken

an oath of confidentiality for the carrying out of their

duties.

(2) For the purposes of this regulation, employees who "form

part of a regulated profession" shall also be deemed to include any

person acting under the personal direction and supervision of such

regulated professional.

(1) For the purposes of these regulations any student who

has attained the age of sixteen years shall be eligible to give

consent as required by these regulations, and to exercise all the

rights under Chapter III of the Regulation.

(2) All consents shall be made in writing or by a clear

indication of opting in where consent is required to be given

through on-line applications. Any consent given by the student

where applicable or by any parent or legal guardian, may, pursuant

to Article 7 of the Regulation, be withdrawn in writing, and the data

controller shall remove such consent and stop such processing

operation for which the consent has been withdrawn and delete or

destroy the data concerned.

(1) When processing of personal data is required for

research and statistics purposes, all identifiable data shall be

rendered anonymous, unless in the case of research, the

identification of the data subject is required to fulfil the purposes of

such research.

(2) Within the limits of these regulations, where, for the

purposes of implementing specific targeted policies, the research

being conducted would require the identification details of

students, data controllers shall process such data by replacing

personal identification data with pseudonymous data, and

eventually limiting the re-identification of students only to those

cases which specifically fall within the parameters of the target

policy

Provided that the process replacing the identification

details with pseudonymous data is carried out by the data controller

originally in possession of the identifiable details

Provided further that where identification is required in

terms of the preceding sub-regulations, such data shall not be used

for any decision concerning the data subject.

(3) Where the research is required by other entities, not being

t h e e d u c a ti o n a u t h o r i ti e s i n te r m s o f r e gu l a ti o n 2 , an d t he

identification details of students are required for the purposes of

the research in question, specific consent shall be obtained from the

students themselves where applicable or from the parents or legal

guardians concerned.

(4) When, for the purposes of the preceding sub-regulations,

pseudonymous data are processed, data controllers shall ensure

that

(a) personal data are not processed for any other purpose

that is incompatible with the specific purpose of the

targeted policy and, or initiative, and in particular that

it is not processed for the purpose of supporting

measures or decisions with respect to the student,

either specifically related to the targeted policy and, or

initiative or otherwise;

(b) data enabling the attribution of information to an

identified or identifiable data subject are kept

separately from the other data;

(c) adequate organisational and technical safeguards are in

place to protect the personal data against any unlawful

forms of processing;

(d) personal data shall not be retained for a period which

is longer than necessary and all identifiable details

shall be rendered anonymous, deleted, or destroyed,

following the completion of the policy and, or

initiative implementation.

(5) Where the research involves the processing of special

categories of data, such processing shall be approved by the

Information and Data Protection Commissioner in terms of article 7 of

the Act.