Warning for schools on pre-enrolment questions
The data-protection watchdog has issued guidance aimed at helping schools to comply with their obligations on the processing of personal data at the pre-enrolment stage.
The Data Protection Commission (DPC) says that its guidance comes after engagement with the education sector.
It says that some schools ask for too much personal data at the pre-enrolment stage – when parents or legal guardians express interest in enrolling their child in a school, usually by completing an application form.
‘Special-category' data
The data watchdog points out that children merit extra protection under the GDPR, adding that schools, as data controllers, must comply with their GDPR obligations on how they collect and use personal data.
In some cases, schools may process ‘special-category’ data, such as information about a child’s health, religious beliefs, or ethnic background.
“This type of information is particularly sensitive and should only be collected in very limited circumstances,” the DPC says.
It adds that, if a school has a pre-enrolment process, it should collect only the minimum amount of personal data needed to determine its specific purpose at that stage.
Basic information
The school must also be clear and transparent with parents or legal guardians about why the information is being requested and how it will be used, the commission states.
says that, at the pre-enrolment stage, schools would be expected to request basic information like a child’s name and date of birth, the parent or legal guardian’s contact details, their address, and whether the child has any siblings already attending the school.
It warns, however, that asking for more sensitive details – such as health information, special educational needs, religious beliefs, ethnic background, or religious beliefs – is generally considered “excessive” at this stage and should not be requested unless there is a lawful basis for doing so.
The DPC says that schools should make it clear why personal data is being collected, adding that they should not collect information on a ‘just-in-case' basis.