This May, the 's-Hertogenbosch Court of Appeal handed down a ruling in a case between two parents and a primary school board. Among other issues, the case revolved around the school board's statement of the GDPR ground for processing personal data regarding the socio-emotional development of pupils in a tracking system. The Court of Appeal addressed the question whether Article 8 of the Dutch Primary Education Act [Wet op het primair onderwijs, or “Wpo” for short] can be considered a legal obligation within the meaning of Article 6(1)(c) GDPR. It is my opinion that the Court's reasoning and ruling on this issue is not beyond reproach.
First instance
In the first instance, the Oost-Brabant District Court held that Article 8 Wpo provides a sound enough lawful ground within the meaning of Article 6(1)(c) GDPR, that ground being a legal obligation, for processing personal data of pupils in the school's pupil tracking system, which includes the pupils’ socio-emotional development.
Appeal
On appeal, the parents took the position that the District Court was wrong to judge that the school board has a sufficiently lawful ground for processing specific personal data of its pupils in the pupil tracking system, including what is known as ZIEN reporting, which contains personal data regarding the pupils’ socio-emotional development.
The Court of Appeal did not follow the parents’ reasoning. It considered that processing the pupils’ personal data was lawful in that it was necessary for compliance with a legal obligation to which the school is subject under Article 6(1)(c) GDPR in conjunction with Article 8 Wpo.
Article 8(1), (2) and (6) Wpo read as follows:
“1 The curriculum will be designed so as to enable the pupils to go through an uninterrupted development process. The curriculum will be attuned to the progress in the development of the pupils.
2 The curriculum will in any event aim at the emotional and intellectual development, and at the development of creativity, at the acquisition of necessary knowledge and of social, cultural and physical skills.
(…)
6 The schools shall use a pupil and curriculum tracking system that will attest to the progress in the development of knowledge and skills at pupil level, at class level and at school level. The pupil and curriculum tracking system shall provide for tests to measure the knowledge and skills acquired by the pupils on, in any event, the Dutch language, arithmetic and mathematics (...).”
The Court of Appeal made the following considerations. Pursuant to Article 8(6) Wpo, a primary school is required to have in place a pupil and curriculum tracking system that shows the progress of pupils as regards their knowledge and skills. The pupil tracking system provides for tests to measure the knowledge and skills acquired by the pupils on, in any event, the Dutch language, arithmetic and mathematics, although the data entered into the system need not necessarily be limited to tests on these subjects.
Thus, the Court of Appeal considers that Article 8 Wpo offers a sufficiently lawful ground within the meaning of Article 6(1)(c) GDPR for processing the personal data of pupils in a tracking system as applied by the primary school, which data also pertain to the socio-emotional development of pupils. The Court of Appeal went on to hold that the primary school is essentially also allowed to process personal data of the pupil concerned as regards her socio-emotional development by observing her and processing the resulting data, which are considered personal data. Reference was made to a decision of the Dutch Supreme Court of 3 December 2021.
Supreme Court decision of 3 December 2021
The predominant theme of the Supreme Court decision of 3 December 2021 as mentioned was the GDPR ground for processing personal data in the systems of the National Credit Register (BKR). The legal framework concerned Article 4.32(1) and Article 4:34(1) of the Dutch Financial Supervision Act [Wet op het financieel toezicht, or “Wft” for short] (as elaborated in Article 114 of the Decree on Conduct of Business Supervision of Financial Undertakings under the Wft) and the question whether these statutory provisions can be considered a legal obligation within the meaning of Article 6(1)(c) GDPR. The Supreme Court held that while said legal provisions require credit offerors to take part in and consult a credit registration system, they are insufficiently clear and accurate and their application is insufficiently predictable for the persons to which they apply. The Supreme Court judged that it does not emerge from the provisions concerned:
- which personal data must or may be registered;
- what the conditions for such registration are, and
- subject to which conditions and within which periods personal data must be deleted.
The Supreme Court observed that these questions are regulated in the CKI (Central Credit Information System) regulations but that these regulations have no basis in any law. In making this observation, the Supreme Court went for a (more) restrictive interpretation of Article 6(1)(c) GDPR.
If this (more) restrictive interpretation of Article 6(1)(c) GDPR is applied to Article 6 Wpo, I am not certain whether the latter article would stand the test as formulated by the Supreme Court. After all, Article 8 Wpo does not define (i) which personal data must or may be registered in the pupil tracking system, (ii) what the conditions for registration of such data in the pupil tracking system are, or (iii) subject to which conditions and within which periods a school must delete the personal data recorded.
The Court of Appeal made reference to Article 8(2) Wpo, which provides that the curriculum must in any event address the emotional and intellectual development and the development of creativity, the acquisition of necessary knowledge and of social, cultural and physical skills. That the curriculum in any event addresses these areas does not in my opinion entail that this by default applies as well to the data that may or must be registered in a pupil tracking system. After all, Article 8(b) Wpo only stipulates that a pupil tracking system provides for tests that measure the knowledge and skills acquired by the pupil of at least the Dutch language, arithmetic and mathematics. This forms the basis for the Court of Appeal's conclusion that a pupil tracking system may also provide insights into the progress of a pupil as regards their emotional and intellectual development in said areas.
It is my view that this allows a primary school some discretion as to the question which data to record in the pupil tracking system and, therefore, in what way a primary school meets is legal obligation.
I think, for this reason, that it is arguable - and in line with the opinion of the Advocate General preceding the Supreme Court's decision - that the discretion the primary school has in applying Article 8 Wpo entails that Article 6(1)(c) GDPR does not constitute an appropriate ground. Referencing several examples from the legislative history of the Wpo, the Court of Appeal confirmed the discretion a primary school has (from ground 2.5.5.2 onwards). Although the Court of Appeal uses these examples to substantiate its interpretation of Article 8 Wpo, the examples of a certain discretion available to primary schools do, in my opinion, very much go to endorse the position that Article 8(6) Wpo cannot be considered a legal obligation within the meaning of Article 6(1)(c) GDPR. .
I gladly refer to the annotation of C.E.F. Van Waesberge to the aforementioned Supreme Court decision, in which she states that the ground provided by Article 6(1)(c) GDPr is appropriate only if the legislator made a clear consideration subject to which conditions compliance with a legal obligation outweighs the interests of privacy of data subjects. In my view, this does not by definition apply to Article 8(6) Wpo.
So what to look out for when using a pupil tracking system?
The Dutch Data Protection Authority provides, on its website, a summary of the rules that apply to the use by schools of pupil tracking systems:
- Processing must be necessary for the purpose stated
- The data processed must be accurate
- Security of and access to the system must be properly organised. This means, for example, that no more people should be allowed access to the pupils’ personal data than would be strictly necessary for the purpose stated. In addition, user activity must be logged
- Accountability requires the school to demonstrate that its use of the pupil tracking system complies with the GDPR rules
- The data processing of the pupil tracking system must be recorded in the register of processing operations
- In some cases, a Data Protection Impact Assessment (DPIA) must be performed. This requirement also applies to schools that used pupil tracking systems before the GDPR entered into force
- Pupils - or their parents - must be able to exercise the rights the GDPR affords them.
Do you have questions about GDPR-proofing your pupil tracking system, or do you require advice on complying with other requirements under the GDPR? If so, feel free to contact Jurriaan Dane.
This May, the 's-Hertogenbosch Court of Appeal handed down a ruling in a case between two parents and a primary school board. Among other issues, the case revolved around the school board's statement of the GDPR ground for processing personal data regarding the socio-emotional development of pupils in a tracking system. The Court of Appeal addressed the question whether Article 8 of the Dutch Primary Education Act [Wet op het primair onderwijs, or “Wpo” for short] can be considered a legal obligation within the meaning of Article 6(1)(c) GDPR. It is my opinion that the Court's reasoning and ruling on this issue is not beyond reproach.
First instance
In the first instance, the Oost-Brabant District Court held that Article 8 Wpo provides a sound enough lawful ground within the meaning of Article 6(1)(c) GDPR, that ground being a legal obligation, for processing personal data of pupils in the school's pupil tracking system, which includes the pupils’ socio-emotional development.
Appeal
On appeal, the parents took the position that the District Court was wrong to judge that the school board has a sufficiently lawful ground for processing specific personal data of its pupils in the pupil tracking system, including what is known as ZIEN reporting, which contains personal data regarding the pupils’ socio-emotional development.
The Court of Appeal did not follow the parents’ reasoning. It considered that processing the pupils’ personal data was lawful in that it was necessary for compliance with a legal obligation to which the school is subject under Article 6(1)(c) GDPR in conjunction with Article 8 Wpo.
Article 8(1), (2) and (6) Wpo read as follows:
“1 The curriculum will be designed so as to enable the pupils to go through an uninterrupted development process. The curriculum will be attuned to the progress in the development of the pupils.
2 The curriculum will in any event aim at the emotional and intellectual development, and at the development of creativity, at the acquisition of necessary knowledge and of social, cultural and physical skills.
(…)
6 The schools shall use a pupil and curriculum tracking system that will attest to the progress in the development of knowledge and skills at pupil level, at class level and at school level. The pupil and curriculum tracking system shall provide for tests to measure the knowledge and skills acquired by the pupils on, in any event, the Dutch language, arithmetic and mathematics (...).”
The Court of Appeal made the following considerations. Pursuant to Article 8(6) Wpo, a primary school is required to have in place a pupil and curriculum tracking system that shows the progress of pupils as regards their knowledge and skills. The pupil tracking system provides for tests to measure the knowledge and skills acquired by the pupils on, in any event, the Dutch language, arithmetic and mathematics, although the data entered into the system need not necessarily be limited to tests on these subjects.
Thus, the Court of Appeal considers that Article 8 Wpo offers a sufficiently lawful ground within the meaning of Article 6(1)(c) GDPR for processing the personal data of pupils in a tracking system as applied by the primary school, which data also pertain to the socio-emotional development of pupils. The Court of Appeal went on to hold that the primary school is essentially also allowed to process personal data of the pupil concerned as regards her socio-emotional development by observing her and processing the resulting data, which are considered personal data. Reference was made to a decision of the Dutch Supreme Court of 3 December 2021.
Supreme Court decision of 3 December 2021
The predominant theme of the Supreme Court decision of 3 December 2021 as mentioned was the GDPR ground for processing personal data in the systems of the National Credit Register (BKR). The legal framework concerned Article 4.32(1) and Article 4:34(1) of the Dutch Financial Supervision Act [Wet op het financieel toezicht, or “Wft” for short] (as elaborated in Article 114 of the Decree on Conduct of Business Supervision of Financial Undertakings under the Wft) and the question whether these statutory provisions can be considered a legal obligation within the meaning of Article 6(1)(c) GDPR. The Supreme Court held that while said legal provisions require credit offerors to take part in and consult a credit registration system, they are insufficiently clear and accurate and their application is insufficiently predictable for the persons to which they apply. The Supreme Court judged that it does not emerge from the provisions concerned:
- which personal data must or may be registered;
- what the conditions for such registration are, and
- subject to which conditions and within which periods personal data must be deleted.
The Supreme Court observed that these questions are regulated in the CKI (Central Credit Information System) regulations but that these regulations have no basis in any law. In making this observation, the Supreme Court went for a (more) restrictive interpretation of Article 6(1)(c) GDPR.
If this (more) restrictive interpretation of Article 6(1)(c) GDPR is applied to Article 6 Wpo, I am not certain whether the latter article would stand the test as formulated by the Supreme Court. After all, Article 8 Wpo does not define (i) which personal data must or may be registered in the pupil tracking system, (ii) what the conditions for registration of such data in the pupil tracking system are, or (iii) subject to which conditions and within which periods a school must delete the personal data recorded.
The Court of Appeal made reference to Article 8(2) Wpo, which provides that the curriculum must in any event address the emotional and intellectual development and the development of creativity, the acquisition of necessary knowledge and of social, cultural and physical skills. That the curriculum in any event addresses these areas does not in my opinion entail that this by default applies as well to the data that may or must be registered in a pupil tracking system. After all, Article 8(b) Wpo only stipulates that a pupil tracking system provides for tests that measure the knowledge and skills acquired by the pupil of at least the Dutch language, arithmetic and mathematics. This forms the basis for the Court of Appeal's conclusion that a pupil tracking system may also provide insights into the progress of a pupil as regards their emotional and intellectual development in said areas.
It is my view that this allows a primary school some discretion as to the question which data to record in the pupil tracking system and, therefore, in what way a primary school meets is legal obligation.
I think, for this reason, that it is arguable - and in line with the opinion of the Advocate General preceding the Supreme Court's decision - that the discretion the primary school has in applying Article 8 Wpo entails that Article 6(1)(c) GDPR does not constitute an appropriate ground. Referencing several examples from the legislative history of the Wpo, the Court of Appeal confirmed the discretion a primary school has (from ground 2.5.5.2 onwards). Although the Court of Appeal uses these examples to substantiate its interpretation of Article 8 Wpo, the examples of a certain discretion available to primary schools do, in my opinion, very much go to endorse the position that Article 8(6) Wpo cannot be considered a legal obligation within the meaning of Article 6(1)(c) GDPR. .
I gladly refer to the annotation of C.E.F. Van Waesberge to the aforementioned Supreme Court decision, in which she states that the ground provided by Article 6(1)(c) GDPr is appropriate only if the legislator made a clear consideration subject to which conditions compliance with a legal obligation outweighs the interests of privacy of data subjects. In my view, this does not by definition apply to Article 8(6) Wpo.
So what to look out for when using a pupil tracking system?
The Dutch Data Protection Authority provides, on its website, a summary of the rules that apply to the use by schools of pupil tracking systems:
- Processing must be necessary for the purpose stated
- The data processed must be accurate
- Security of and access to the system must be properly organised. This means, for example, that no more people should be allowed access to the pupils’ personal data than would be strictly necessary for the purpose stated. In addition, user activity must be logged
- Accountability requires the school to demonstrate that its use of the pupil tracking system complies with the GDPR rules
- The data processing of the pupil tracking system must be recorded in the register of processing operations
- In some cases, a Data Protection Impact Assessment (DPIA) must be performed. This requirement also applies to schools that used pupil tracking systems before the GDPR entered into force
- Pupils - or their parents - must be able to exercise the rights the GDPR affords them.
Do you have questions about GDPR-proofing your pupil tracking system, or do you require advice on complying with other requirements under the GDPR? If so, feel free to contact Jurriaan Dane.