Education

Legal Framework

Processing personal data in educational institutions requires a lawful basis under the GDPR. While consent under Article 7 is theoretically available, the EDPB has flagged that dependency relationships inherent to institutional settings undermine voluntariness. The EDPB's reasoning on employer-employee dynamics applies by analogy to publicly funded schools and other educational settings where students occupy a subordinate position:

"Gezien de afhankelijkheid die voortvloeit uit de relatie tussen werkgever en werknemer, is het onwaarschijnlijk dat de betrokkene zijn werkgever toestemming voor gegevensverwerking zou kunnen weigeren"
— EDPB Guidelines 05/2020, §21

Educational institutions must therefore look to Article 6(1)(c) (legal obligation), Article 6(1)(e) (public task), or Article 6(1)(f) (legitimate interests) for most routine processing. Where special category data is involved — health records, psychological assessments — Article 9 restrictions apply, requiring additional conditions under Article 9(2).

Key Developments

The Raad van State's Zadkine ruling demonstrates how courts handle the tension between student access rights and staff privacy in educational settings. The institution expelled a student whose conduct constituted a serious threat to order and safety. When the student sought access to unredacted internal documents — including teacher notes from the Eduarte information system and incident reports — the institution requested that only the court review the unredacted versions.

The institution's rationale was that disclosing staff personal data would create a real risk:

"Er bestaat volgens het college een reëel risico dat het verstrekken van deze gegevens leidt tot onwenselijke situaties."
— Raad van State, Zadkine

The Afdeling endorsed this approach, confirming that protecting staff privacy and confidential incident reporting serves the institution's proper functioning:

"De Afdeling acht het verzoek tot beperkte kennisneming van deze stukken gerechtvaardigd."
— Raad van State, Zadkine

This ruling reinforces that educational institutions can restrict access to unredacted personal data of staff where safety and confidentiality interests outweigh the individual's access interest.

Status of the Debate

This topic is actively litigated. The Zadkine ruling aligns with the earlier Afdeling decision in ECLI:NL:RVS:2023:2816, building a consistent — but still developing — body of administrative case law on how educational institutions balance staff privacy against student transparency rights. No court split is on record, but the precise threshold for when safety concerns justify withholding unredacted documents remains fact-specific and contested. Enforcement actions by DPAs — including the UODO's fine against the Polish Minister of Justice for insufficient technical and organisational measures — underscore that institutions face regulatory scrutiny alongside private litigation.

Practical Guidance

• Do not rely on consent as the primary legal basis for processing student or staff data in publicly funded educational institutions; the power imbalance makes consent vulnerable to challenge under EDPB guidance.
• Apply a documented balancing test before disclosing staff personal data in proceedings involving students, weighing the institution's safety and functioning interests against the individual's access rights.
• Redact staff personal data in documents shared with students where safety concerns are present, and request restricted judicial review of unredacted versions where necessary.
• Maintain confidential incident reporting channels; the Zadkine ruling supports restricting access where unrestricted disclosure would chill future reporting by staff or third parties.
• Implement technical and organisational measures proportionate to the sensitivity of educational data, as enforcement actions show that DPA fines target institutions that fail on this front.