Data protection and e-learning

Illustration of a school, students, and teachers

Due care must be given to the choice of e-learning technology n order to ensure the safety of children and youth. The City of Reykjavík has established a Privacy Policy based on privacy legislation.

Before digital technology is implemented in schools and for recreational activities, an extensive analysis process is conducted, which includes risk analysis, processing agreements, and evaluating the impact on data protection. The principal is responsible for the use of e-learning technologies as well as fulfilling the information obligations towards parents.

How long is the personal data kept?

It should be pointed out that according to Act No. 77/2014 on the Public Archives, part of the documentation shall be deposited at the Reykjavík Municipal Archives as the City is an entity subject to an obligation of transfer.

 

Other than that, the information will be stored in Google Workspace for Education during a student's studies, and it will be deleted three months after the student has finished their studies at the school and has returned the device to the school.

Taking & Publishing Photographs

Students shall comply with the rules of the school and the City of Reykjavík as well as the national legislation on taking and publishing photographs. The taking and publishing of photographs in the City’s school and recreational activities are subject to specific guidelines.

 

It is important that students themselves are not the main subject of the photos and image editing is only allowed as part of project work.

Learning Devices & Privacy

Terms of use

Parents/guardians agree to the terms and conditions for lending students Chromebooks and accessories on My Pages.

Have your electronic ID available.

Students are also considered to have accepted the terms and conditions when they login to the Chromebook for the first time. This approval is a prerequisite for a student to be allowed to take the device home.

The terms and conditions contain these important points:

  • The Chromebook is a learning device and should primarily be used for learning.
  • The student should always follow the instructions of the school staff regarding its use.
  • The device should be be brought back fully loaded and ready to work if it is taken home.
  • The Chromebook should be handled carefully and transported in a case between places.
  • Never consume food or drinks near the device.
  • The learning device may not under any circumstances be used illegally. It is forbidden to install pirated software or software that modifies its operating system and to delete data or settings from the learning device.
  • Students return the Chromebook at the end of the school year, along with other equipment, and receive it back at the beginning of the next school year.

Chromebooks

When using Chromebooks (referred to as devices), student personal data will be processed. This information is necessary to create user accounts for students to access the device and its software. The device itself is marked with the student's first name. The primary school of the child is the responsible party for this data processing according to the Data Protection Act No. 90/2018.

The Department of Education & Youth in Reykjavík has assisted City primary schools in setting up Chromebooks and advised them on making security arrangements to ensure personal data safety. Risk assessments and privacy impact assessments have been conducted for this data processing.

Personal data that is processed:

  • Basic information about the parents and the student, their name and primary school
  • The devices have a camera and a microphone. The camera comes with a shutter that blocks out the camera. The microphone is generally turned off, but can be turned off manually by going to the device settings.
  • In general, location data is not collected. The location of the device can be traced if it is lost or stolen.
    It is also possible to view which user last logged in to a tablet and on which IP address. If a device is lost or stolen, the device is locked and information is deleted from the device within a specified time limit.
  • Sensitive personal data is not processed on the devices.

Equal learning opportunities

The project aims to ensure that students have equal learning opportunities and can choose their subjects and approach in their education. Students should have solutions that meet their needs and access to a device that facilitates communication with teachers and peers if access to school is limited or the school is closed. Additionally, students should be able to participate in school activities despite illness. Reykjavík City should also be able to fulfill its legal obligations concerning the right to education for the enrolled student.

Data processing

The device use aims to follow the emphasis of the Compulsory School Act and the National Curriculum, providing various ways to acquire knowledge via technology media, information technology, and museum and research work. The Compulsory School Act and the National Curriculum emphasize the content and organization of learning in specific subjects, particularly mentioning information and technology education. Students must receive equal learning opportunities and be able to choose their subjects and approach in their education. Students should have solutions that meet their needs and access to a solution that facilitates communication with teachers and peers if access to school is limited or the school is closed. Additionally, students should be able to participate in school activities despite illness. Reykjavík City should also be able to fulfill its legal obligations concerning the right to education for the enrolled student.

The legitimacy of data processing is based on the legal obligations of the primary school as per the Compulsory School Act No. 91/2008 and the National Curriculum established under the Act on Compulsory Education. Furthermore, processing this personal data is deemed necessary for the exercise of public authority by Reykjavík City in providing education to primary school students.

Alternative homework methods related to Chromebooks will be offered if parents do not want students to bring the devices home.

Other recipients of the information include service providers that set up and operate the necessary systems for the devices to function. This involves Google and Lightspeed respectively, and a processing agreement has been concluded with both of these parties. There may be other recipients of personal data when special software solutions/apps are used by Chromebooks, but parents will be informed about all such software use when applicable.

Child personal data will not be transmitted outside of Europe when using Chromebooks.

Objection to data processing

You generally have the right to object to this personal data processing.

If you object, the primary school must not process the personal data further unless it can demonstrate compelling legal grounds for the processing that override your interests, rights, and freedoms.

Sharing personal with third parties

After a specified period, Reykjavík City may need to transfer some data to the Reykjavík Municipal Archives.

Other recipients of the information include service providers that set up and operate the necessary systems for the devices to function. This involves Google and Lightspeed respectively, and a processing agreement has been concluded with both of these parties. There may be other recipients of personal data when special software solutions/apps are used by Chromebooks, but parents will be informed about all such software use when applicable.

Your rights

Students and parents may have the right to access the personal data processed by Reykjavík City and the primary school on the devices. Students and parents may also have the right to object to the processing, have the information corrected, request that it be deleted, have the processing limited, and/or have the information delivered to you or a third party in machine-readable format.

You can find more information about these rights in the Reykjavík City Privacy Policy, which is available on the City's website.

Complaints about processing

If you are dissatisfied with the processing of your personal information by Reykjavík City, you can always contact Reykjavík City’s Data Protection Officer persónuverndarfulltrui@reykjavik.is or write to the Icelandic Data Protection Authority (DPA).