Does the use of digital cloud solutions pose risks and penalties for educational institutions?

[shukla7789]

In Colombia, both primary and secondary schools often use educational technology systems that collect data, and they often do so without complying with the requirements of legislation regarding the protection of personal information. In this blog, we will analyze what generally happens, and what each educational institution must consider in order not to go against the Law.

In general, educators or officials in charge of implementing technological aids in an educational institution are quite proactive; therefore, they very frequently make learning or monitoring tools available on the Web available to students, which undoubtedly contribute to achieving academic training objectives; however, many times when implementing the solution they do not consider that such platforms not only collect student data, but also do not guarantee either the adequate protection of the information collected, or compliance with the policies that the institution has established, so that generally educational centers, in an unconscious way, end up failing to comply with their organizational objectives, and with compliance with the Colombian Law on Personal Data Protection, which inevitably leads to access to fines and administrative sanctions.

An international case that is now making headlines in job seekers database is the one involving a public educational institution in Ireland that was sanctioned for using the “Google Workspace for Education” platform, without taking adequate measures to protect student data. Of course, we know that the aforementioned platform makes use of innovative learning tools based on collaboration and communication with students, thus facilitating classroom processes; however, this platform collects student data, transfers it internationally to the United States, and additionally does not have indemnification clauses that protect students against leaks or disclosure of their data, so its use by educational institutions requires extreme care.

So, what aspects should you keep in mind when you want to make use of a particular educational support platform?

Informed consent is essential. Parents or guardians must be aware of the functionality of the application within the educational context of the institution, and must authorize their sponsored children to provide their data, just before the institution asks the students to register on the platform.
The purpose of the processing must be very precise, defining the scope of use of the platform. Here it must be understood that the educational institution is the one that develops, in a pedagogical way, the transfer of knowledge to the students; therefore, the purpose of its use would not be understood unless the elements available in it are absolutely indispensable for the training of the student. In these cases, it would be recommended to anonymize the student data, allowing, for example, the registration of an internal code as the student ID, or an “alias” as an identifier of the student.
It is important to limit the storage time of students' personal data on the platform; because it is not possible to understand why, just after the resources of the platform have been used and its functionalities have been taken advantage of, the student information is still kept on its storage media. Generally, if any information about the performance of a specific student is required, the stored data could be downloaded from the platform in an encrypted manner, being taken in this way to own servers or in the cloud, without having to be kept exposed in the storage centers of the solution provider.
With regard to access and rectification, both students and parents or guardians must be provided with the right to access personal data, to correct any inaccuracies and to object to the processing of their data in certain circumstances.
In terms of legal liability, it is essential to be able to demonstrate compliance with all obligations. This implies having control mechanisms such as regular audits of both the information stored on the educational platform and the use of data by the proprietary brand. Likewise, there must be training programs for teachers, students and officials who participate in the review and supervision of activities, in this way they will be clear about what they should do and what they should consider when using the platform.