Personal data processing in Reykjavík City preschools

This education is provided with reference to Act No 90/2018 on Data Protection and the Processing of Personal Data (here referred to as the Data Protection Act) and the European Parliament and Council Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data pertaining to the rights of individuals versus primary school.

The information concerns all Reykjavík City preschools. More information about arrangements in each preschool may be found on its website or in materials the preschool sends regarding specific processing of personal data.

'Parent' refers to those with child custody as defined in the Children's Act No. 76/2003.

For questions about personal data processing in the preschool

According to preschool laws, parents must protect their children's interests. They must work closely with preschool staff, monitor their children's education, and provide information relevant to school activities and child welfare. Parents also have the right to information about school activities and their children's status.

The right of a parent without custody to information about their child is governed by Article 52 of the Children's Act, No. 76/2003. It states that a parent without custody has the right to information about the child from its preschool. This right does not include information about the custodial parent. Information may be denied if deemed harmful to the child. Limitations on the right to information are governed by Article 17 of the Administrative Procedure Act No. 37/1993 and Article 14 of the Information Act No. 140/2012.

For questions about your child's personal data processing, contact the child's preschool or the City's Data Protection Officer.

It should be noted that before parents are given personal data to which they are entitled, they must confirm their identity.

Preschool Data Protection Officer

The Data Protection Officer's task is to monitor compliance and assist the controller and processors in complying with privacy legislation.

• More information about the City's Data Protection Officer

Purpose and legal basis for processing personal data

Reykjavík City preschools are the first level of the school system for children below compulsory school age, as stated in the Preschool Act No. 90/2008. Preschools provide care, upbringing, and education for preschool-aged children at parents' request, in line with the Preschool Act. Parents of preschool children protect their children's interests. The law defines parents as those with child custody under the Children's Act.

The main purpose of processing personal data in Reykjavík City preschools is to fulfill legal obligations.

Article 2 of the Preschool Act states that children's welfare and interests should guide all preschool activities. Preschools must provide care and education, create a healthy and stimulating environment, and ensure safe learning and play conditions. Learning should occur through play and creative activities, offering children diverse educational opportunities. Preschool practices should be shaped by tolerance, love, equality, democratic cooperation, responsibility, care, reconciliation, respect for human dignity, and Christian heritage of Icelandic culture.

The main goals of preschool upbringing and teaching are:

• To monitor and enhance children's overall development in close cooperation with parents
• To provide structured language stimulation and promote natural Icelandic language skills
• To nurture children mentally, intellectually, and physically according to individual needs so the children can enjoy their childhood
• To promote children's open-mindedness and strengthen their moral awareness
• To lay the foundation for children to become independent, active, and responsible participants in a rapidly changing democratic society
• To cultivate children's expressive and creative abilities to strengthen their self-image, health awareness, safety, and interpersonal skills

According to the first paragraph of Article 9 of the Act on Preschools, parents must closely consult with preschool staff, monitor their children's education, and provide information relevant to school activities and child welfare. Parents also have the right to information about school activities and their children's status. The right of a non-custodial parent to information about their child is governed by Article 52 of the Children's Act, No. 76/2003.

According to the second paragraph of Article 16 of the Act on Preschools, necessary personal data about each preschool child, essential for their welfare and adaptation to primary school, will follow the child, subject to full confidentiality and procedures in accordance with current data protection laws. Parents must be informed about this transfer of information. Data processing must be overseen by the preschool principal or other specialists, acting on behalf of the municipality, pursuant to its directives.

The first through third paragraphs of Articles 30a, of the Preschool Act address personal data processing. They state:

Preschools, school services, and entities with statutory roles can process personal data as necessary to provide preschool children with legally mandated services. Processing sensitive health data about children is permitted for screenings, assessments, diagnoses, and certificates.

Preschools, school services, and entities with statutory roles can collect and share personal data with institutions and professionals providing legally mandated services to children, including the National Diagnostic and Counselling Centre, municipal social services, primary schools, after-school programs, and other entities specified in ministerial regulations, as this sharing is necessary for these entities to fulfill their roles.

Preschools, school services, and entities with statutory roles must inform parents and guardians as defined by the Children’s Act about data processing in accordance with the Data Protection Act (Unofficial translation).

Regulation No. 896/2009 governs information sharing between preschools and primary schools on the basis of the Preschool Act. Regulation No. 444/2019 on school services addresses requests for child assessments and diagnoses.

Preschools take photos and videos of children for legal activities such as project work. Photos are used in the Vala preschool electronic information system or shared with parents through the Vala preschool app. Image capture and use may also be necessary to ensure appropriate measures and correct responses for life-threatening conditions, such as severe allergies or epilepsy.

This use is part of preschool operations and doesn't require parental consent.

It's generally permitted to record group or overview images at public preschool events. If parents object to such photography, the manager will consider these comments and evaluate them on a case-by-case basis.

Occasionally, images of children are taken and published with parental consent. They are used to give parents and children insight into the preschool activities and may be shared in the Vala preschool app, on the school website, or other public platforms. Parents can revoke their consent at any time. The revocation of consent does not impact the legality of any photography and picture publication that occurred prior to the revocation. If not revoked, consent remains valid while the child is enrolled in the preschool.

• Guidelines and education on photography and image publishing in Department of Education & Youth activities are available. 

Images shared by the preschool in the Vala app are generally not intended for public distribution or publication.

Reykjavík City preschools and Reykjavík City are data controllers and have legal authority to process children's personal data under the first paragraph of Article 9 and first paragraph of Article 11 of the Data Protection Act.

Who works with the personal data?

Sending personal data to third parties (processors)

Reykjavík City uses processors to host personal data processed in City preschools. Processors include Vala preschool. The same may apply to other types of information technology services. These entities may access personal data related to preschool operations, but their involvement is based on written agreements with Reykjavík City ensuring data security and confidentiality. Reykjavík City may be legally required to disclose personal data processed by the municipality to third parties.

The City will not transfer personal data outside the European Economic Area unless permitted by law. Third-party storage and retention of personal data must be specified in processing agreements to which Reykjavík City is a party. The City will not use personal data for any other purpose, nor disclose it to third parties, except on the basis of a legal authorisation, administrative order, court order, written data processing agreement or consent of the data subject. However, the City reserves the right to disclose anonymized information to third parties for scientific and research purposes as permitted by law.

Information on the use of Vala preschool's electronic registration and information system

Reykjavík City preschools use Vala preschool, an electronic registration and information system, based on a processing agreement with Advania ehf. Vala preschool is used for recording and sharing information about children and communicating with parents. Preschool applications, discount requests for preschool fees, and other items are stored in Vala preschool.

• More information on personal data processing in Vala

Parents can access information and communicate with the preschool through the Vala preschool app, available for download on your phone. Parents and preschools can exchange brief messages, which are recorded in Vala preschool.

According to Regulation No. 896/2009 on information sharing between preschools and primary schools, preschools may use electronic information systems to record and share information about children. Preschools can also use such systems to provide parents with access to information and for communication.

Personal data that can be recorded in Vala preschool includes:

• Basic child information: Name, ID number, legal residence, fee payer, parental circumstances (married, single, disabled person, employee, student), placement and division, language, and child's photo.
• Basic information about parents/guardians according to the national registry and contacts: Name, ID number, phone, email, and siblings of preschool age.
• Parents can request additional relatives to be registered.
• Regarding child placement: Daily care, daily meals, start date, end date, applications (see applications section).
• Other information: Allergies, special needs, medication. Only if it is necessary to record the information in Vala for the child's safety.
• Additional information that can be recorded in Vala: Name and phone number of authorized pickup persons, child's attendance, special education hours, and notifications.

As a general rule, information can be recorded in Vala to prevent emergencies or to ensure staff responsible for children's welfare are aware of and can respond to potential risks and are aware of these in their work. This allows for recording information about life-threatening conditions, such as severe allergies and epilepsy, in Vala preschool. Other sensitive personal data, such as information about illnesses or diagnoses, should not be recorded or entered into Vala preschool. It could, however, contain a reference to illness or diagnosis records.

Usage recording

All user logins to Vala preschool are logged. The change history records all changes to actions in Vala. These include date of change, explanation, new value, previous value, and who made the change.

Event logging is done for security and property protection purposes and helps ensure that data in the system is protected against unauthorized access, changes, deletion, theft, or damage.

Automatic decision making

• No automated decision-making occurs in Vala preschool.
• Other ways to access information

If parents make a justified request for access to information through other means, such as email, phone, or mail, school staff should try to accommodate such requests, provided it serves the child's interests and needs. Consider the nature and importance of the information in question and whether the child's special needs or circumstances require communication in a specific manner.

Information about Office 365 use

Reykjavík City preschools use Office 365 in their daily operations. Office 365 is run by Microsoft Corporation. Office 365 comprises various tools/systems, mostly: The suite includes Word, Excel, PowerPoint, OneNote, OneDrive and SharePoint.

• More information about Office 365

Preschool staff

Preschool staff who need information for their work have access to information about children and their parents. Preschool staff are bound by confidentiality.

Directorate of Education

The Directorate of Education may need access to information about preschool children.

• Personal data processed by the Directorate of Education

Assistance for children and school services

Article 22 of the Preschool Act addresses the implementation of school services. It states that children who need special assistance and training, as assessed by recognized diagnosticians, are entitled to such services within the preschool. These services should be carried out under the guidance of specialists as decided by the preschool principal and school services in accordance with Article 21 of the Preschool Act, in consultation with parents.

It also states that the preschool principal should coordinate the work of those handling individual children's matters under Article 21 within each preschool. Consultation should also be made with municipal social services regarding individual children's matters as deemed necessary.

In implementing school services, municipalities should emphasize good connections between preschools and primary schools with continuity in school activities as a guiding principle. Municipal school services for preschools are addressed in Regulation No. 444/2019 on municipal school services for preschools and primary schools and student protection councils in primary schools. The first paragraph of Article 10 of the aforementioned regulation states that preventative work in preschools and primary schools includes education, assessment and projects for students, school staff and parents. This aims to ensure students' schooling goes as well as possible and the school atmosphere is as positive as possible. Students who may have physical, psychological or social difficulties should receive appropriate support and educational assistance to actively participate in school activities. The same provision also states that in preschools and primary schools, staff should assess which students may have difficulties with reading or other learning challenges. They should use appropriate assessment tools, respond systematically, and ensure all students receive necessary assistance. Progress should be monitored regularly and addressed promptly.

According to the third paragraph of Article 10 of the regulation on school services, if further examination and diagnosis is needed based on the assessment under the second paragraph, the principal or their representative should request specialist assistance. School service staff should assist preschool and primary school staff in assessing students who may have physical, psychological, or social difficulties that could affect their academic progress. School services should also assist preschool and primary school staff in analyzing learning conditions, provide advice on how to respond, and refer to appropriate resources. School services staff should ensure appropriate assessment tools are available, provide such tools as needed, and assist with implementation and follow-up in cooperation with education authorities.

All examinations by school services concerning individual students must be done in consultation with and with formal parental consent. It is prohibited to charge for such examinations.

When suspicion arises about deviations in a child's development, assistance is requested from the preschool's special education director in consultation with parents. If necessary, advice is sought from a special education consultant, speech therapist, or behavioral counselor working in school and recreation services at the Center in the relevant city district, or from a psychologist under the Department of Welfare.

If warranted, the preschool can apply for additional funding from the Department of Education & Youth to support the child. The child may also be referred for further examinations at external institutions such as the State Diagnostic and Counseling Center, Hearing and Speech Center, Training Center, independent speech therapists, etc.

Services to preschools in teaching and social counseling and psychological services take place at the City's Centers.

Parents of preschool children can request examination, diagnosis and counseling for their children. In addition, school administrators, teachers, school and career counselors, or other school or school health services staff, as the case may be, can request such specialized assistance in consultation with and with the consent of the parents.

In the preschool, the special education head of division serves as a contact person for services promoting children's well-being.

• More information on integrating services for child welfare

All diagnoses of their children must be done in consultation with and with parental consent, and parents must be informed of the results.

Parents can review or obtain copies of documents held by school services containing personal information about their own children based on provisions of preschool laws, information and/or data protection laws, as applicable.

The Department of Education & Youth employs behavioral counselors and Special Education Consultants who advise teachers. Working on individual children's cases is generally done with parental consent.

School services are addressed in Articles 21 and 22 of the Preschool Act and in Regulation No. 444/2019 on municipal school services for preschools and primary schools and student protection councils in primary schools.

Teams established for individual children's cases

The preschool may temporarily establish teams for children when special responses are needed, so the child can benefit from their preschool attendance and make progress. Minutes are taken at formal team meetings and stored in the child's personal file.

The team can be interdisciplinary, based on cooperation between professionals and parents, and can be a support team of parents, preschool and other parties.

Assessment and educational records

Preventative work in preschools includes assessments and educational documentation to ensure children receive appropriate teaching and assistance. This work occurs in cooperation with parents, specialists from Reykjavík City Centers, and other experts. All school service assessments in preschools concerning individual children must be done in consultation with and with parental consent.

According to the first paragraph of Article 10 of the School Service Regulation, preventative work in preschools and primary schools includes education, assessment, and projects for students, school staff, and parents. The goal is to ensure the best possible education and a positive school environment. Students who may have physical, psychological or social difficulties should receive appropriate support and educational assistance to actively participate in school activities.

School staff should assess which students may have difficulties with reading or other learning challenges using appropriate assessment tools. They should respond systematically and ensure all students receive necessary assistance. Progress should be monitored regularly and addressed promptly.

If further examination and diagnosis are needed based on the assessment, as per the second paragraph of Article 10 of the School Service Regulation, the principal or their representative should request expert assistance. School service staff should assist preschool and primary school staff in assessing students who may have physical, psychological, or social difficulties that could affect their academic progress. School services should also assist preschool and primary school staff in analyzing learning conditions, provide advice on how to respond, and refer to appropriate resources.

The assessment tools used may vary between preschools. The preschool provides information about the assessment tools used.

Surveys and studies

Preschools must conduct internal evaluations in accordance with Article 18 of the Preschool Act No. 90/2018 to assess and monitor quality. Municipalities must conduct external evaluations in accordance with Article 19 of the Preschool Act. The Directorate of Education also conducts external evaluations in accordance with Article 20 of the Preschool Act. Evaluation and monitoring can proceed via studies or surveys. Active participation of staff, children and parents is expected as appropriate.

Preschool administrators may approve participation in research or surveys to enhance knowledge of school and leisure activities that can benefit the school community. When a study is aimed at children and young people who have not yet reached the age of 18, formal permission is, however, required from the Office of the Department of Education & Youth. This applies to questionnaires for children, interviews, focus groups and/or field observations. Depending on the nature of the study, additional written parental consent may be needed, or it may be sufficient just to inform parents, i.e. intended consent. Information on the type of consent to be obtained is set out in the Office's authorization.

Transfer between preschools

When a child transfers between preschools or from preschool to primary school, the preschool principal must ensure necessary personal data is securely transferred to the receiving school. If the receiving school is unknown, data will not be sent until a request is received.

The preschool principal or qualified municipal expert, as determined by the committee per the second paragraph of Article 4 of the Preschool Act, assesses the need for information for the child's planned primary school education and is responsible for sharing it with the relevant primary school.

The preschool principal must inform parents about information following the child between schools and parents' right to know about such information. When necessary, preschools use a form prepared by the Department of Education & Youth, which must be presented to parents and their confirmation obtained. Each preschool's curriculum must specify what information will follow a child between preschools or to primary school. It's the principal's responsibility to inform parents about the type of assessment data that accompanies students transferring between schools or onto secondary school, including parents' rights to receive a knowledge of such information transfer.

The above is subject to Regulation No. 896/2009 on Information Sharing Between Preschools and Primary Schools, with subsequent amendments.

Processing on the basis of the Administrative Procedure Act, Information Act, and other acts

Preschools may be required to provide documents under the Administrative Procedure Act No. 37/1993, the Information Act No. 140/2012, or the Child Protection Act No. 80/2002, in accordance with the second paragraph of Article 17 of the Data Protection Act No. 90/2018.

Integration of services for child welfare

In preschools, the special education director typically serves as the contact person for child welfare services.

• More information on integrating services for child welfare

Statistics Iceland

Information is transferred to Statistics Iceland to meet legal obligations as per the provisions of Article 5 of Act No. 163/2007 on Statistics Iceland and Public Statistical Reports. This includes information about the child's preschool, ID number and name, hours of stay, native language, and support. Support information is not shared in a personally identifiable manner.

Other processing

Preschool operations may involve other personal data processing not listed above.

What happens to personal data and how long is it stored?

When applications are received through umsokn.vala.is, they are recorded in the school's electronic information system, a database hosted by Advania ehf. At the end of each school year, the archives manager or individual designated by an administrator reviews children's personal files, ensuring all documents are printed and filed according to Reykjavík City preschool record-keeping guidelines, if not submitted electronically.

Preschools are required to submit records under the Public Archives Act No. 77/2014. Therefore, they are not permitted to destroy documents and data that they receive or create without permission from the National Archives of Iceland. This obligation includes submitting all documents received or created by preschools to the Reykjavík Municipal Archives for future preservation. Electronic records, databases, and document storage systems must also be transferred to the Reykjavík Municipal Archives.

• More information about the Reykjavík Municipal Archives is available on their website

Therefore, personal data that is subject to the above is stored indefinitely. However, as previously mentioned, the Reykjavík City Council decided on March 7, 2023, to dissolve the Reykjavík Municipal Archives in its current form. It decided to transfer the Reykjavík Municipal Archives' projects and collections to the National Archives of Iceland. Consequently, from January 1, 2024, Reykjavík's administration and institutions will submit their documents to the National Archives of Iceland. Tasks related to receiving data, supervision, and consultation will also move from the Reykjavík Municipal Archives to the National Archives.

Rights

Parents have the right to access their child's information. The limitations on the right to information follow the provisions of Article 17 of the Administrative Procedures Act No. 37/1993 and Article 9 of the Information Act No. 140/2012.

A parent without custody of a child has the right to receive information about the child from the preschool. Parents’ rights to information are covered by Article 52 of the Children's Act No. 76/2003.

You may have the right to access the personal data that the City of Reykjavík processes. You may also have the right to object to the processing, have the information corrected, request that it be deleted, have the processing limited, and/or have the information delivered to you or a third party in machine-readable format.

• More information about these rights can be found in Reykjavík City's privacy policy

Please note that if you are dissatisfied with Reykjavík City's handling of your personal data, you can always contact the City's Data Protection Officer at personuverndarfulltrui@reykjavik.is, call 411 1111, or submit a complaint to the Icelandic Data Protection Authority.

• Icelandic Data Protection Authority website