open, digital, online, education, distance education

GDPR and education: an approach for e-learning in Greek schools

Open Education - The Journal for Open and Distance Education and Educational Technology
PDF
Published: Jul 7, 2023
DOI: https://doi.org/10.12681/jode.31195
Aikaterini Daoultzoglou
a:1:{s:5:"el_GR";s:10:"ΔΙΠΑΕ";}
https://orcid.org/0000-0002-7134-3225
Abstract

The GDPR was put into action in May 2018. It outlines key principles that must be followed for any entity that is collecting personal data related to peopleresidingin the EU (Duncan & Joyner, 2021). Amongst the entities thathave to comply with the new Regulation are schools. This paper focuses on primary and secondary education‧ it covers a range of controversial issues and aims to provide an overview of a schools’ obligations and responsibilities vis a vis GDPR. It determines major definitions in terms of school reality, enlightens basic blur points, and stipulates what schools as Data Controllers must do. Moreover, the special case of distance learning amidst the Covid-19 pandemic is thoroughly analyzed. Due to rush transition to e-learning platforms plenty GDPR issues occurred and they are presented in this paper. Finally, a couple of possible, mainly technical, solutions are proposed to the difficulties that might emerge in the effort to build a strong GDPR school environment. The importance of GDPR compliance isapparent and indicated in every chapter.

Article Details
  • Section
  • Articles
Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Copyright Notice

Authors who publish with this journal agree to the following terms:

Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution Non-Commercial License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.

Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g. post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.

Authors are permitted and encouraged to post their work online (preferably in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work.

Downloads
Download data is not yet available.
References
Lupton, D., & Williamson, B. (2017). The datafied child: The dataveillance of children and implications for their rights. new media & society, 19(5), pp. 780-794. doi:10.1177/1461444816686328
Aliyu, A., Maglaras, L., He, Y., Yevseyeva, I., Boiten, E., Cook, A., & Janicke, H. (2020, May 25). A Holistic Cybersecurity Maturity Assessment Framework for Higher Education Institutions in the United Kingdom. applied sciences. doi:10.3390/app10103660
Amo, D., Torres, R., Canaleta, X., Herrero-Martín, J., Rodríguez Merino, C., & Fonseca, D. (2020, October 20). Seven principles to foster privacy and security in educational tools: Local Educational Data Analytics. TEEM. Salamanca,Spain: Association for Computing Machinery. doi:10.1145/3434780.3436637
Ashton, C. (2018). www.itgovernance.co.uk. Retrieved October 11, 2021, from Cyber attacks hit a fifth of schools and colleges: https://www.itgovernance.co.uk/blog/cyber-attacks-hit-a-fifth-of-schools-and-colleges
Bergdahl, N., & Nouri, J. (2020, September 2). Covid 19 and Crisis Prompted Distance Education in Sweden. Technology, Knowledge and Learning, pp. 443-459.
Chai, W. (2021, January). Retrieved from https://whatis.techtarget.com/definition/Confidentiality-integrity-and-availability-CIA
Cranor, S., & Spiekermann , L. (2009). Engineering Privacy IEEE transactions on Software Engineering. 1(35), pp.67-82.
Data Protection Authority. (2019, September 10). Decision n.21/2019. Athens.
Data Protection Authority. (2020, September 7). Opinion 4/2020. Athens.
Data Protection Authority. (2021, November 16). Decision 50/2021. Athens.
Dempsey, J., Sim, G., & Cassidy, B. (2018). Designing for GDPR - Investigating Children's Understanding of Privacy: A Survey Approach. British HCI. Belfast,UK: BCS Learning and Development Ltd.
Department for Education, U. G. (n.d.). Data Protection: a toolkit for schools. Open Beta: Version 1.0. Retrieved from https://www.gov.uk/government/publications/data-protection-toolkit-for-schools
DPA. (2022, January 16). Retrieved July 1, 2022, from https://www.dpa.gr/el/enimerwtiko/deltia/enimerosi-shetika-me-tin-efarmogi-tis-apofasis-tis-arhis-gia-ti-diadikasia
DPA. (2022, January 16). Data Protection Authority. Retrieved July 14, 2022, from https://www.dpa.gr/el/enimerwtiko/deltia/enimerosi-shetika-me-tin-efarmogi-tis-apofasis-tis-arhis-gia-ti-diadikasia
Duncan, A., & Joyner, D. (2021, June 22-25). With or Without EU: Navigating GDPR Constraints in Human Subjects Research in an Education Environment. L@S'21, Virtual Event. doi:10.1145/3430895.3460984
Duncan, B. (2018). Can EU General Data Protection Regulation Compliance be Achieved When Using Cloud Computing? CLOUD COMPUTING 2018 : The Ninth International Conference on Cloud Computing, GRIDs, and Virtualization.
Europe, E. A. (2018). Handbook on European data protection law. Retrieved from https://fra.europa.eu/en/publication/2018/handbook-european-data-protection-law-2018-edition
European, C. (n.d.). Who does the data protection law apply to? Retrieved from https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en
Evers, W.-M. ,. (2021, April 29 ). Massive school data breach shows we need better privacy policies. Retrieved from https://thehill.com/opinion/technology/550959-massive-school-data-breach-shows-we-need-better-privacy-policies
Government Gazette. (2020, May 15). Opinion 57233/Y1. Retrieved from https://www.minedu.gov.gr/publications/docs2020/20200515_%CE%A6%CE%95%CE%9A1859_%CF%84%CE%92_15-05-2020_%CE%A3%CF%8D%CE%B3%CF%87%CF%81%CE%BF%CE%BD%CE%B7-%CE%B5%CE%BE-%CE%B1%CF%80%CE%BF%CF%83%CF%84%CE%AC%CF%83%CE%B5%CF%89%CF%82-%CE%B5%CE%BA%CF%80%CE%B1%CE%
Gray, S. (2020, July 21). Artificial intelligence in schools: Towards a democratic future. London Review of Education, 18(2), pp. 163-177. doi:10.14324/LRE.18.2.02
Hellenic Center for Safer Internet. (2018, May 19). saferinternet4kids.gr. Retrieved from GDPR in Schools: https://saferinternet4kids.gr/wp-content/uploads/2018/11/gdpr-in-schools.pdf
Hunt, T. (2020, August). “Pwned Passwords”, Have I Been Pwned. Retrieved from https://haveibeenpwned.com/Passwords
Kasim, N., & Khalid, F. (2016). Choosing the right learning management system (LMS) for the higher education institution context: A systematic review. International Journal of Emerging Technologies in Learning, pp. 55-61. doi:10.3991/ijet.v11i06.5644
Kaspersky, G. (2013). Global Corporate IT Security Risks. Retrieved 2021, from Kaspersky Lab.
Katulić, A. (2019, January 23). The obligations of libraries under the general data protection regulation: challenges, approaches, and possible solutions. Vjesnik bibliotekara Hrvatske 61.
Lievens, E., & Milkaite, I. (n.d.). A children’s rights perspective on privacy and data protection in the digital age. Ghent University, Faculty of Law & Technology. Retrieved from https://www.ugent.be/re/mpor/law-technology/en/research/childrensrights.htm
Lievens, E., & Verdoodt, V. (2018). Looking for needles in a haystack: Key issues affecting children’s rights in the General Data Protection Regulation. Computer Law and Security Review, 34, pp. 269-278. doi:10.1016/j.clsr.2017.09.007
Marković , M., Debeljak, S., & Kadoić , N. (2019, February 27). Preparing Students for the Era of the General Data Protection Regulation (GDPR). TEM Journal, 8(1), pp. 150-156. doi:10.18421/TEM81-21
Mougiakou, E., & Virvou, M. (2017). Based on GDPR privacy in UML: Case of e-learning program. 8th International Conference on Information, Intelligence, Systems & Applications (IISA). Larnaca,Cyprus: IEEE. doi:10.1109/IISA.2017.8316456
Mougiakou, E., Papadimitriou, S., & Virvou, M. (2018). Intelligent Tutoring Systems and Transparency: The Case of Children and Adolescent. 9th International Conference on Information, Intelligence, Systems and Applications (IISA), pp. 1-8. doi:10.1109/IISA.2018.8633652
Mougiakou, E., Papadimitriou, S., & Virvou, M. (2020). Synchronous and Asynchronous Learning Methods under the light of General Data Protection Regulation. 11th International Conference on Information, Intelligence, Systems and Applications, pp. 1-7. doi:10.1109/IISA50023.2020.9284341
Murmann, P., & Fischer-Hubner, S. (2017). Tools for achieving usable ex post transparency: a survey,. Retrieved from IEEE Access
Nevaranta, M., Lempinen, K., & Kaila, E. (2020, October 21). Students' perceptions about data safety and Ethics in learning analytics. 2020 Conference on Technology Ethics, Tethics 2020, 2737, pp. 23-37.
Office, I. C. (n.d.). Lawful basis for processing. (ico.org.uk) Retrieved December 12, 2021, from https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/
Osano, N. (2021, May 21). The Eight User Rights Under the GDPR. Retrieved from privacypolicies.com: https://www.privacypolicies.com/blog/gdpr-eight-user-rights/
Phillips, B. (2021, September). UK further education sector journey to compliance with the general data protection regulation and the data protection act 2018. Computer Law & Security Review, 42. doi:https://doi.org/10.1016/j.clsr.2021.105586
Politou, E., Alepis, E., & Patsakis, C. (2018, February 16). Forgetting personal data and revoking consent under the GDPR: Challenges and proposed solutions. Journal of Cybersecurity, pp. 1-20.
Raily, R. (2013). ‘Raw Data’ is an Oxymoron, Dataveillance and countervailance. Gitelman L (ed.), pp. 121-45.
Smith, T., Gibbons, N., & Kuncewicz, S. (2021). blmlaw.com. Retrieved from GDPR:12 STEPS: https://www.blmlaw.com/expertise/gdpr-are-you-prepared-/gdpr-12-steps
Stamoulou, P. (2018). The DPO’s role and responsibilities under the GDPR framework. Thessaloniki.
Stanojević, D., Cenić, D., & Cenić, S. (2018, July 6). Application of computers in modernization of teaching science. (IJCRSEE) International Journal of Cognitive Research in Science, Engineering and Education, 6(2), pp. 89-104. doi:10.5937/ijcrsee1802089S
Unknown. (2018, June 15 ). Data Protection Toolkit - Personal Data Breaches: are you prepared? Retrieved from https://www.nicva.org/data-protection-toolkit/templates/personal-data-breaches-are-you-prepared
Unknown. (2018, March 19). perkinscoie.com. Retrieved from Article 28 Checklist - Privacy & Security: https://www.perkinscoie.com/en/gdpr/gdpr-article-28-checklist.html
Unknown. (2021, January). itgovernance.co.uk. Retrieved from Cyber Security 101 – A guide for schools: https://www.itgovernance.co.uk/reports/cyber-security-a-guide-for-schools
Vanezi, E., Kapitsaki, G., Kouzapas, D., Philippou, A., & Papadopoulos, G. (2020). DiálogoP - A Language and a Graphical Tool for Formally Defining GDPR Purposes. 14th International Conference on Research Challenges in Information Sciences, RCIS 2020.385, pp. 569-575. Limassol: LNBIP. doi:10.1007/978-3-030-50316-1_40
Vejmelka, L., Katulic, T., Jurić, M., & Lakatoš, M. (2020). Application of the General Data Protection Regulation in Schools: A Qualitative Study with Teachers, Professional Associates and Principals. 43rd International Convention on Information, Communication and Electronic Technology (MIPRO), pp. 1463-1469. doi:10.23919/MIPRO48935.2020.9245209
Zhang-Kennedy, L. (2017, May). Multimedia approaches for improving children’s privacy and security knowledge and persuading behavior change. 84. Ottawa.