Education

No. Organic Law 2/2006 of 3 May on education (the LOE for its Spanish initials) establishes that consent is not required to process the data needed to provide teaching and guidance.

No. The LOE enables the use of data pertaining to students and their families for the purpose of attending to them, as long as such data is used solely and exclusively for teaching and guidance purposes.

No. Exceptionally, special categories of data may be processed without consent, when necessary to protect the physical health of the data subject or another person, if they are physically or legally incapable of giving their consent.

No. Schools may use other less invasive mechanisms, such as having teachers monitor attendance.

Yes. The communication to parents of academic, psychological and educational data related to the education of non-emancipated minors is covered by data protection regulations, in accordance with Article 222-37 of Law 25/2010 of 29 July, of the second book of the Civil Code of Catalonia, relating to individuals and families.

No. Schools can only collect and process data that are appropriate, relevant and necessary for the educational or guidance purpose for which they are collected.

Yes, if the email account can also be used for non-academic purposes. In this case, the consent of the data subject, or of their parents or guardians if they are under 14 years old, is required to process students' data associated with the creation of an email account, notwithstanding the conditions of use established by the service provider.

However, if the email account is a school email account with use limited to the school's teaching activity, consent is not required.

No. This purpose is incompatible with that for which the data were collected, and therefore the consent of the parents or guardians must be obtained.

Yes. Failure to provide up-to-date information may affect the proper management of the school and of the student's personal data.

Processing of data pertaining to children under the age of 14 may be authorised by either parent, provided that he or she has parental responsibility. If the child is over 14 years of age, the child's consent is sufficient for processing their data, unless there is a legal requirement' for the presence of the parents or guardians.

In the case of competitive selection processes, such publication is regulated by Article 45 of Law 39/2015, which states that the means of communication used to publish the information must be established in the pre-enrolment procedure conditions.

Depending on these conditions, the published information may include the names and surnames of the student applicants and those granted a place, as well as their graded score.

People who have participated in a competitive selection procedure, in this case the pre-enrolment of their child in a school, are considered to be a party affected by that administrative procedure and, as such, may access the data of the people who have been awarded places.

If the purpose of accessing the information is to see the address listed by other candidates, to check for fraud in the score obtained on the basis of registered address, this access is necessary in order for the person to be able to exercise their right of defence.

The data contained in the school pre-enrolment files relating to the name, surnames and address of students who have gained a place at a school cannot be considered private data, although the same file may contain information considered to be private data, such as personal or family circumstances. In this case, the body responsible for this data may grant access to data relating to addresses, without having to disclose other data within the file that may be considered personal data.

No. Parental or guardian consent is required.

No. There must be a legal basis for this.

No, unless the school has the consent of the people concerned (the owners of each of the mobile phone numbers).

No. There is no legal rule that allows such communication and therefore the consent of the parents is required before the school can disclose the data.

The open publication of images of students on school websites is not considered part of schools' teaching and guidance activities. Therefore, if schools wish to publish images of students, they must have the prior consent of parents or guardians, or of the students themselves if they are over 14 years old.

However, exceptionally, images may be disseminated without the consent of the persons affected, as in the case of images captured at a public ceremony or event, if the purpose of the dissemination is informative or to provide news coverage of the event, and the image of the students is of secondary relevance and does not affect their privacy. However, the people concerned must be informed beforehand of such publication so that they may exercise their right to object.

Despite this, in the case of minors, it is advisable to always ask for consent.

Once consent has been obtained, it is not necessary to revalidate it each time before publishing an image of students. The current regulations do not establish any specific period of validity for consent. However, it is good practice for schools to establish a period of validity for this consent and, of course, to provide information on consent forms regarding the right to revoke consent at any time.

No. If the person concerned is not identifiable without disproportionate effort, the image is not considered personal data. Therefore, data protection regulations do not apply.

Minors over the age of 14 may exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability or the right not to be subject to automated individual decision-making without the authorisation of their parents or guardians, unless specifically required by applicable law.

That said, there is nothing to prevent the parents or legal representatives of minors over the age of 14 from also exercising these rights without the permission of said minors. This is without prejudice to the fact that, in certain cases, the rights of informational self-determination may be limited to those persons who hold parental responsibility over the minor, in the best interests of the latter.

Children under the age of 14 must exercise their right to informational self-determination through their parents or guardians.

Yes, if they have the status of legal representative of the minor.

Yes. This is part of the information relating to the minor. However, notwithstanding the fact that educational centres are 'obliged in all cases to respond to such requests, the obligation to provide the information is dependent in whether the centre has collected this data and whether it still possesses it.

Yes. Students over the age of 14, or their parents or guardians if they are under this age, can make such requests. They must indicate the erroneous or inaccurate data that needs to be corrected and provide the relevant documents as proof of the correct data.

Either parent may exercise the right of erasure without the consent of the other parent, provided that they have parental authority.

A student may object to this processing in accordance with Article 21 of the GDPR due to reasons related to their specific personal situation, such as for reasons of personal safety if they are a victim of gender-based violence, if they have suffered any threats, etc. In this case, the school must exclude the person from the published list of accepted students, unless it provides a compelling legitimate reason. If the student is under the age of 14, the right must be exercised by their parents or guardians.