The Transparency and Data Protection Council of Andalusia has required the Andalusian Government to strengthen the safeguards relating to the processing of the personal data of 738,502 students, 43,202 teachers and 2,676 educational centres managed through Google Workspace for Education.
According to the authority, the General Data Protection Regulation (GDPR) was breached for years, and six sanctions were imposed for different deficiencies, including transfers to countries without an adequate level of protection. Although the Regional Government maintains that the data is protected and that it has adopted measures, risks remain, as does the need to improve impact assessments and safeguards for sensitive data.
Relevance for the education sector
Education is an area involving particularly sensitive information, such as data relating to minors, academic records, health data and similar information. Therefore, any processing of personal data must strictly comply with the GDPR in order to protect fundamental rights.
The management of personal data in the education sector requires special attention and a proactive approach to comply with the regulations and protect data subjects. With the appropriate support, organisations in the sector can ensure responsible processing, mitigate legal risks and strengthen the trust of students, families and professionals.
At DATAX, we offer compliance audit services, Data Protection Impact Assessments (DPIAs), advice on data processing contracts and clauses, and specialised training, helping educational and technology organisations comply with data protection regulations and minimise legal and reputational risks.
