Data protection and e-learning

The adoption of digital technologies in school and recreational settings requires a risk assessment. Due care must be given to the selection and use of software for schooling in order to ensure the safety of students.

The City of Reykjavík follows a specific procedure and software is evaluated, among other things, on:

• Age restrictions
• Collection of personal data
• Whether data is stored inside or outside Europe
• Whether ads are associated with usage
• How to delete data and accounts at the end of schooling or when the software is no longer in use

Managers at each location are responsible for informing parents about what digital technology is used and how.

Personal data that is processed:

• Basic information about the student, their name and primary school.
• Basic information about parents when they are asked to confirm terms of use on their devices.
• The devices have a camera and a microphone. The camera comes with a shutter that blocks out the camera. The microphone is generally turned off, but can be turned off manually by going to the device settings.
• In general, location data is not collected. The location of the device can be traced if it is lost or stolen, but otherwise that information is not collected. It is also possible to view which user last logged in to a tablet and on which IP address. If a device is lost or stolen, the device is locked and information is deleted from the device within a specified time limit.

Access information from the devices comes from the student account for Gschool created by the primary school based on the basic information on the student at the school. A student may enter personal information on the device, but teachers will implore students not to enter personal information on the device in accordance with the device terms of use and education to parents and students.

Basic parental information is obtained from Mentor/Námfús to ensure parental confirmation of the terms of use on the devices.

Parents/guardians agree to the terms and conditions for lending students Chromebooks and accessories on My Pages.

• Approve terms and conditions for lending to students

Have your electronic ID available.

• See instructions

Students are also considered to have accepted the terms and conditions when they login to the Chromebook for the first time. This approval is a prerequisite for a student to be allowed to take the device home.

The terms and conditions contain these important points:

• The Chromebook is a learning device and should primarily be used for learning.
• The student should always follow the instructions of the school staff regarding its use.
• The device should be be brought back fully loaded and ready to work if it is taken home.
• The Chromebook should be handled carefully and transported in a case between places.
• Never consume food or drinks near the device.
• The learning device may not under any circumstances be used illegally. It is forbidden to install pirated software or software that modifies its operating system and to delete data or settings from the learning device.
• Students return the Chromebook at the end of the school year, along with other equipment, and receive it back at the beginning of the next school year.

When using Chromebooks (referred to as devices), student personal data will be processed. This information is necessary to create user accounts for students to access the device and its software. The device itself is marked with the student's first name. The primary school of the child is the responsible party for this data processing according to the Data Protection Act No. 90/2018.

The Department of Education & Youth in Reykjavík has assisted City primary schools in setting up Chromebooks and advised them on making security arrangements to ensure personal data safety. Risk assessments and privacy impact assessments have been conducted for this data processing.

Personal data that is processed:

• Basic information about the parents and the student, their name and primary school.
• The devices have a camera and a microphone. The camera comes with a shutter that blocks out the camera. The microphone is generally turned off, but can be turned off manually by going to the device settings.
• In general, location data is not collected. The location of the device can be traced if it is lost or stolen.
  

  It is also possible to view which user last logged in to a tablet and on which IP address. If a device is lost or stolen, the device is locked and information is deleted from the device within a specified time limit.

• Sensitive personal data is not processed on the devices.

The project aims to ensure that students have equal learning opportunities and can choose their subjects and approach in their education. Students should have solutions that meet their needs and access to a device that facilitates communication with teachers and peers if access to school is limited or the school is closed. Additionally, students should be able to participate in school activities despite illness. Reykjavík City should also be able to fulfill its legal obligations concerning the right to education for the enrolled student.

The device use aims to follow the emphasis of the Compulsory School Act and the National Curriculum, providing various ways to acquire knowledge via technology media, information technology, and museum and research work. The Compulsory School Act and the National Curriculum emphasize the content and organization of learning in specific subjects, particularly mentioning information and technology education. Students must receive equal learning opportunities and be able to choose their subjects and approach in their education. Students should have solutions that meet their needs and access to a solution that facilitates communication with teachers and peers if access to school is limited or the school is closed. Additionally, students should be able to participate in school activities despite illness. Reykjavík City should also be able to fulfill its legal obligations concerning the right to education for the enrolled student.

The legitimacy of data processing is based on the legal obligations of the primary school as per the Compulsory School Act No. 91/2008 and the National Curriculum established under the Act on Compulsory Education. Furthermore, processing this personal data is deemed necessary for the exercise of public authority by Reykjavík City in providing education to primary school students.

Alternative homework methods related to Chromebooks will be offered if parents do not want students to bring the devices home.

Other recipients of the information include service providers that set up and operate the necessary systems for the devices to function. This involves Google and Lightspeed respectively, and a processing agreement has been concluded with both of these parties. There may be other recipients of personal data when special software solutions/apps are used by Chromebooks, but parents will be informed about all such software use when applicable.

Child personal data will not be transmitted outside of Europe when using Chromebooks.

You generally have the right to object to this personal data processing.

If you object, the primary school must not process the personal data further unless it can demonstrate compelling legal grounds for the processing that override your interests, rights, and freedoms.

After a specified period, Reykjavík City may need to transfer some data to the Reykjavík Municipal Archives.

Other recipients of the information include service providers that set up and operate the necessary systems for the devices to function. This involves Google and Lightspeed respectively, and a processing agreement has been concluded with both of these parties. There may be other recipients of personal data when special software solutions/apps are used by Chromebooks, but parents will be informed about all such software use when applicable.

Students and parents may have the right to access the personal data processed by Reykjavík City and the primary school on the devices. Students and parents may also have the right to object to the processing, have the information corrected, request that it be deleted, have the processing limited, and/or have the information delivered to you or a third party in machine-readable format.

You can find more information about these rights in the Reykjavík City Privacy Policy, which is available on the City's website.

• Learn more about the Reykjavík Privacy Policy

If you are dissatisfied with the processing of your personal information by Reykjavík City, you can always contact Reykjavík City’s Data Protection Officer personuverndarfulltrui@reykjavik.is or write to the Icelandic Data Protection Authority (DPA).

• Learn more about the Reykjavík Privacy Policy