L.S. 586.07 Regolamenti dwar l-Ipproċessar ta’ Data Personali fis-Settur tal-Edukazzjoni

(1)In these regulations unless the context determines otherwise requires: Citation. "Act" means the Data Protection Act; "Corporation" means Jobsplus established under the Employment and Training Services Act; Cap.

1. "data controller" means education authorities, educational institutions, examination bodies and the Corporation; "education authorities" means the Directorates constituted in terms of Part II of the Education Act, as well as the Malta Further and Higher Education Authority established in terms the Further and Higher Education Act; Interpretation. Amended by: XXVII. 2016.6; II.2020.28; L.N. 407 of
2. Cap.
3. Cap.
4. Cap. 607 "educational institutions" means any licensed school or other institution or entity offering educational services, whether at a preprimary (kindergarten), primary, secondary, post-secondary or tertiary level and also includes further and higher educational institutions, institutions offering formal and non-formal learning, and vocational education; "examination bodies" means any entity other than educational institutions authorised to conduct national assessments; "student" means any data subject registered and, or attending an education institution and, or attending, or having attended, an education institution and, or registered with an examination body; "student welfare data" means records related to the welfare and social behaviour of the student including court orders regarding custody of minors, information compiled by child protection services including guidance and counselling, as well as any other information obtained from the student, parent, legal guardian, law enforcement officers or other support agencies.

(2)The definitions contained in article 3 of the Act shall, subject to the provisions of sub-regulation

(1), apply to these regulations.

1. For the purposes of these regulations, a notification for prior checking shall be made to the Commissioner, where the processing of personal data involves particular risks of improper interference with the rights and freedoms of data subjects, including in the following cases: Prior checking. Amended by: L.N. 407 of
2. 2 [ S.L.586.07 PROCESSING OF PERSONAL DATA (EDUCATION SECTOR) (a) processing operations carried out on the basis of the best interest of the student; (b) processing operations carried out in the public interest; (c) processing operations carried out for reconciliation purposes in terms of regulation 4

(4)(a); (d) processing operations regulation 4

(8). Processing by education authorities. Amended by: II.2020.28; L.N. 407 of

1. Cap.
2. Cap.
3. carried out in terms of 4.

(1)Education authorities may process personal data in relation to students and, where specifically required in the best interest of the students, personal data of parents and legal guardians may also be processed to carry out their functions as provided under the Education Act.

(2)(a) In the course of executing their functions subject to sub-regulation

(1), education authorities may, from time to time, and by means of a written request, require educational institutions to furnish, in such manner as m a y b e re qu e s te d an d w i th i n a r e a s o na bl e t im e , personal data in relation to students attending such educational institutions, and their parents or legal guardians. (b) Special categories of data listed in Article 9 of the Regulation shall be requested only with the explicit consent of the parent or legal guardian.

(3)Where data regarding educational attainment and ability in relation to the student held by educational institutions is required by the educational authorities in order to fulfil their functions as laid down in the Education Act, educational institutions shall substitute identifiable data with pseudonymous data, provided that any follow-up action is to be carried out by the educational institutions which transmitted the data as instructed by the education authorities.

(4)In monitoring the participation of students in national assessments, where there are discrepancies between the education authorities and examination bodies in relation to students sitting for national assessments, education authorities may request examination bodies to provide the data, provided that: (

1. a)such personal data are only used for reconciliation purposes; (
2. b)no results associated to identifiable students are requested, and Cap. 605. (
3. c)all personal identifiable data are rendered anonymous, deleted or destroyed, immediately after the reconciliation exercise is conducted.

(5)Subject to the provisions of regulation 8, education authorities may process personal data for research and statistics purposes to perform tasks in the public interest and to exercise their functions in accordance with the Education Act.

(6)In implementing targeted policies and, or initiatives to PROCESSING OF PERSONAL DATA (EDUCATION SECTOR) [ S.L.586.07 assist students who do not achieve the required levels in national assessments for accession into further and higher education, or for an active participation in employment opportunities, education authorities may instruct examination bodies and, or educational institutions to forward any communication issued by the education authorities to inform students who are eligible to benefit from such targeted policies and, or initiatives. Where such instructions cannot be met by the examination bodies and, or educational institutions, personal data of students eligible to be addressed by the targeted policies and, or initiatives concerned shall be forwarded to the education authorities in order to enable them to communicate directly with the students concerned, provided that only the ide ntifiable details of student s o pti ng t o ma k e u s e o f such specialised services will be processed by the education authorities in the context of the targeted policy and, or initiative.

(7)Pursuant to sub-regulation

(6), all personal identifiable data are to be rendered anonymous, deleted or destroyed, after the specialised services in line with the targeted policies and, or initiatives concerned are delivered, unless specific consent is obtained from the students themselves where applicable, or from their parents or legal guardians.

(8)Without prejudice to the provisions of sub-regulations

(3)and

(6), and regulation 8, whenever education authorities are involved in national and, or European initiatives and, or studies with regard to employment opportunities, and, or the alignment of jobs with the studies or qualifications achieved, the education authorities may require examination bodies and, or educational institutions to furnish them with such data deemed necessary for the national and, or European initiative and, or study, provided that: (

1. a)identifiable data are only requested if strictly required to take the necessary measures in the interest of the students in the implementation of such national and, or European initiatives and, or studies; (
2. b)only data of students over compulsory school age may be requested; (
3. c)identifiable data of students who eventually do not participate in such national initiatives are deleted, destroyed, or rendered anonymous. 5.

(1)Educational institutions may process personal data in relation to students, parents and legal guardians for administration purposes and for the daily operations and efficient running of such institutions for the purpose of providing their students with the necessary educational services as required under the Education Act.

(2)Personal data in relation to students may also be processed for the following purposes: (

1. a)academic progress monitoring which includes performance data, examination and, or assessment results associated with the students; (
2. b)organisation of functions and, or activities which may Processing by educational institutions. Amended by: II.2020.28; Amended by: L.N. 407 of 2021.Cap. 605. 3 4 [ S.L.586.07 PROCESSING OF PERSONAL DATA (EDUCATION SECTOR) form part of curricular and extra-curricular requirements, provided that where the processing is related to informal activities the consent is obtained from the students themselves if applicable, or from their parents or legal guardians.

(3)Medical data in relation to the students attending the institutions, as provided by medical professionals and, or by the parents or legal guardians, or by the students themselves where applicable, may also be processed by the educational institutions in the best interest of their students, and provided that: (

1. a)such data are held in separate distinctive files in a secure manner; and (
2. b)if the students are following compulsory schooling, such data may be forwarded in the best interest of the students, to another educational institution to which students are transferred; and (
3. c)such data are destroyed once the students stop attending the institution concerned.

(4)Student welfare data may also be processed by the educational institutions in the best interest of their students, and provided that: (

1. a)such data are held in separate distinctive files in a secure manner; and (
2. b)if the students are within compulsory schooling, such data may be forwarded in the best interest of the students, to another educational institution where students are transferred to; and (
3. c)such data are destroyed once the students stop attending the institution concerned.

(5)Educational institutions may process visual images provided that consent is obtained from the students themselves if applicable, or from the parents or legal guardians.

(6)Educational institutions may keep records of their students for historic purposes provided that no special categories of data and student welfare data are retained for such purposes.

(7)Subject to the provisions of regulation 8, educational institutions may process personal data for research and statistics purposes to perform tasks which are required by the education authorities in terms of regulation 4, or in the legitimate interest of the educational institution to provide the necessary education to their students.

(8)Consent required under this regulation shall be obtained from the students themselves if applicable, or from their parents or legal guardians, prior to disclosure of personal data to third parties unless such third parties are any of the following: (

1. a)education authorities processing personal data in terms of regulation 4; (
2. b)another educational institution where a student is PROCESSING OF PERSONAL DATA (EDUCATION SECTOR) [ S.L.586.07 5 transferred to; (
3. c)examination bodies as part of the examinations process and, or national assessments; (
4. d)health authorities in the fulfilment of their functions under the Public Health Act; Cap. 465. (
5. e)hospitals, clinics and other medical professionals where students need medical attention; (
6. f)the Police in cases of criminal investigations; (
7. g)social workers or support agencies or authorities where there is suspicion or where it is alleged that the welfare of the student is not being protected; (
8. h)the Corporation in accordance with the Employment and Training Services Act in terms of regulation 4 of these regulations; (
9. i)any court, as required in judicial proceedings.

(9)Without prejudice to the provisions of regulation 8, the Corporation, in fu lfilment of its st atut ory functio ns and in accordance with the Employment and Training Services Act, may request educational institutions to be provided with personal data of students pursuing studies in such institutions. For this purpose, educational institutions shall provide such data in their possession provided that students whose data are being forwarded shall have attained the age of fourteen years at the time of the request. 6.

(1)Without prejudice to the provisions of Article 32 of the Regulation, access to personal data in relation to students and parents or legal guardians shall be restricted to those employees who by virtue of their roles and responsibilities are required to process such data and: (

1. a)are subject to the Professional Secrecy Act; or Cap. 343. Cap. 343. Recipients of data. Amended by: L.N. 407 of 2021. Cap. 377. (
2. b)form part of a regulated profession, and, or have taken an oath of confidentiality for the carrying out of their duties.

(2)For the purposes of this regulation, employees who "form part of a regulated profession" shall also be deemed to include any person acting under the personal direction and supervision of such regulated professional. 7.

(1)For the purposes of these regulations any student who has attained the age of sixteen years shall be eligible to give consent as required by these regulations, and to exercise all the rights under Chapter III of the Regulation.

(2)All consents shall be made in writing or by a clear indication of opting in where consent is required to be given through on-line applications. Any consent given by the student where applicable or by any parent or legal guardian, may, pursuant to Article 7 of the Regulation, be withdrawn in writing, and the data controller shall remove such consent and stop such processing operation for which the consent has been withdrawn and delete or destroy the data concerned. Consent. Amended by: L.N. 407 of 2021. 6 [ S.L.586.07 Processing for research and statistics purposes. Amended by: L.N. 407 of 2021. PROCESSING OF PERSONAL DATA (EDUCATION SECTOR) 8.

(1)When processing of personal data is required for research and statistics purposes, all identifiable data shall be rendered anonymous, unless in the case of research, the identification of the data subject is required to fulfil the purposes of such research.

(2)Within the limits of these regulations, where, for the purposes of implementing specific targeted policies, the research being conducted would require the identification details of students, data controllers shall process such data by replacing personal identification data with pseudonymous data, and eventually limiting the re-identification of students only to those cases which specifically fall within the parameters of the target policy: Provided that the process replacing the identification details with pseudonymous data is carried out by the data controller originally in possession of the identifiable details: Provided further that where identification is required in terms of the preceding sub-regulations, such data shall not be used for any decision concerning the data subject.

(3)Where the research is required by other entities, not being t h e e d u c a ti o n a u t h o r i ti e s i n te r m s o f r e gu l a ti o n 2 , an d t he identification details of students are required for the purposes of the research in question, specific consent shall be obtained from the students themselves where applicable or from the parents or legal guardians concerned.

(4)When, for the purposes of the preceding sub-regulations, pseudonymous data are processed, data controllers shall ensure that: (

1. a)personal data are not processed for any other purpose that is incompatible with the specific purpose of the targeted policy and, or initiative, and in particular that it is not processed for the purpose of supporting measures or decisions with respect to the student, either specifically related to the targeted policy and, or initiative or otherwise; (
2. b)data enabling the attribution of information to an identified or identifiable data subject are kept separately from the other data; (
3. c)adequate organisational and technical safeguards are in place to protect the personal data against any unlawful forms of processing; (
4. d)personal data shall not be retained for a period which is longer than necessary and all identifiable details shall be rendered anonymous, deleted, or destroyed, following the completion of the policy and, or initiative implementation.

(5)Where the research involves the processing of special categories of data, such processing shall be approved by the Information and Data Protection Commissioner in terms of article 7 of the Act.