The General Data Protection Regulation establishes that a data protection delegate must be appointed in certain cases, Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, specified in its art. 34.1. b) that they must designate this figure “educational centers that offer teaching at any of the levels established in the legislation regulating the right to education, as well as public and private universities”.
Data Protection Law in educational centers
To know exactly what is meant by “any of the established levels” we must go to the Organic Law 2/2006, of May 3, on Education.
There we will find the educational stages in which it is necessary to designate a Data Protection Officer, They range from Early Childhood Education to university education, including language, artistic and sports teaching. Therefore, we should not make the mistake of thinking that an educational center only needs a data protection officer when the data processing comes from minors, since educational centers that process data from adults also have this obligation.
The figure of the data protection officer in the education sector
The figure of the data protection officer in the educational sector is essential, since from the beginning of the school year, educational centers collect numerous personal data from students, parents and teachers. For example, the processing of data related to the physical or mental health of students is common, to provide the dining service or the contents of the students' psycho-pedagogical reports. However, the fact that a student takes the subject of religion is not considered a special category of data, since the mere fact of taking it does not imply a revelation of his or her religious confession.
Who appoints this data protection officer in educational centers?
Those responsible for the treatment, which, in the case of public educational centers, will be the corresponding public Administration, that is, the Department of the Autonomous Community competent in educational matters and in subsidized and private centers, those responsible for the processing of the data will be the same. centers.
