Personal data processing in Reykjavík City primary schools

Education

This education is provided with reference to Act No 90/2018 on Data Protection and the Processing of Personal Data (here referred to as the Data Protection Act) and the European Parliament and Council Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data pertaining to the rights of individuals versus primary school.

The information concerns all Reykjavík City primary schools. Detailed information about the procedures in each school may be found on its website or in informational materials that the school sends in connection with the aforementioned school processing of personal data.

Here, 'parent' refers to those who have custody of a child according to the Children's Act Bo. 76/2003.

If you have questions about the processing of personal data in school

Parents have the right to access their child's information. The limitations on the right to information follow the provisions of Article 17 of the Administrative Procedures Act No. 37/1993 and Article 9 of the Information Act No. 140/2012.

A parent without custody of a child has the right to receive information about the child from the primary school. Parents’ rights to information are covered by Article 52 of the Children's Act No. 76/2003, with subsequent amendments.

The guardian has the legal responsibility for a child until it is of legal age, cf. the fifth paragraph of Article 28 of the Children's Act No. 76/2003.

If you have questions about the processing of your children’s’ personal data, you can contact your child's primary school or the Data Protection Officer of Reykjavík City.

It should be noted that before parents are given personal data to which they are entitled, they must confirm their identity.

School's Data Protection Officer

The Data Protection Officer of Reykjavík City, and all municipal workplaces, is Dagbjört Hákonardóttir, a lawyer.

The Data Protection Officer's task is to monitor compliance and assist the controller and processors in complying with privacy legislation.

Purpose and legal basis for processing personal data

The main purpose of processing personal data in Reykjavík City's primary schools is to fulfill the legal obligation that applies to the primary school.

According to the Compulsory School Act No. 91/2008, with subsequent amendments, the obligation to attend school is generally for ten years, but it can be shorter. All children, typically aged 6-16, are obliged to attend primary school. Parents take care of their children's interests of school age.

Parents have to provide primary schools with information needed to educate and ensure the welfare of the child in accordance with Article 18 of the Compulsory School Act. The rules mandate full confidentiality and due process for personal data obtained or attached to a child from preschool, in accordance with the prevailing Act on Data Protection and the Processing of Personal Data. Parents should be informed about this information. Data processing must be overseen by the principal or other specialists, acting on behalf of the municipality, pursuant to its directives.

A regulation has been issued based on the Compulsory School Act, Regulation No. 897/2009, about the Processing, Deletion, and Dissemination of Information and Parents’ Rights to Access Information about Their Children. In addition to it, more regulations related to the processing of students' personal data are in effect, such as Regulation on the Transfer and Dissemination of Information between Preschools and Primary Schools No. 896/2009, with subsequent amendments. Additionally, Regulation No. 585/2010 on Support for Students with Special Needs in Primary Schools, with subsequent amendments, and Regulation on School Service No. 444/2019 specifically address the processing of sensitive personal data of students.

In the school's activities, photos and videos of students are also taken. This happens in connection with the statutory operation of the school, such as due to student projects, and a photo is taken for documentation in the school's electronic information systems, Námfús or Mentor. In addition, image capture and use of image material may be necessary to ensure appropriate measures and correct response to life-threatening diseases, such as in the cases where a student has been diagnosed with acute allergies or epilepsy.

As the aforementioned usage is integral to the activities of the primary school, it is exempt from requiring parents' consent for photography.

It is generally considered permissible to record image material at public events in primary school operations if they are group pictures or overview pictures. If parents object to such photography, the manager will consider these comments and evaluate them on a case-by-case basis.

Occasionally, pictures of students are taken and published based on parental consent. The photos are used to give parents and students insight into the activities that take place in the school and may be posted on the school's website or other public platforms. Parents can revoke their consent at any time. The revocation of consent does not impact the legality of any photography and picture publication that occurred prior to the revocation. If not revoked, the consent remains valid as long as the respective child is enrolled in the school.

• Guidelines and instructions regarding photography in the operations of the Department of Education & Youth

All domestic primary schools that are data controllers and, consistently with the above, have the authority based on the first paragraph of Article 9, and the first paragraph of Article 11, of the Data Protection Act to process students' personal data.

Who works with the personal data?

Sending personal data to third parties (processors)

Reykjavík City uses the help of so-called processors to host the personal data processed in its primary schools. Processors include InfoMentor ehf. and Námfús ehf. This may also apply to other IT Services. Such parties may have access to personal data in relation to primary school activities, but their involvement is based on a written agreement with the City of Reykjavík, ensuring the security and confidentiality of the data. To get more information about the above, contact the Data Protection Officer of Reykjavík City.

Information about the use of the electronic information system Mentor

Some primary schools in Reykjavík use the electronic information system Mentor based on a processing agreement that the school has made with InfoMentor ehf.

Mentor is a learning management system used for recording and delivering information about students and communicating with them and their parents.

Parents and students get access to the Mentor system when the student is studying in a primary school that uses the system.

A parent's email address will be used for communication with primary school and the email address will be sent to other parents to support and strengthen the relationship between parents. You can go into the settings of the system and adjust your access so that your email address will not be made accessible to other parents within the system or at the school. You can log into the system either through the Mentor homepage or by using the App. Detailed instructions on signing in, changing passwords, and how to create password for students who haven't registered an email in Mentor can be found in the Mentor User Manual.

The personal data that can be registered in Mentor includes:

• Student's and parents' names
• Student's and parents' ID numbers
• Connection to the student, mother, father, or another person
• Student's language
• Parents' native language if other than Icelandic
• Address of the student and parents
• Parents' email
• Student's email
• Parents' phone number
• Details for primary contacts selected by parents; name, ID number, address, phone number, and relationship to the child.
• Student's photograph
• Exam grades
• Educational assessment
• Absences
• Homework.
• General recording in a "diary" of events that take place during school hours and concern the student.
• Emergency information about potentially life-threatening illnesses, such as acute allergies and epilepsy.

In exceptional cases and only if there is a specific need, schools can register sensitive personal information about the student's health in Mentor. This can include emergency information about potentially life-threatening illnesses, such as acute allergies and epilepsy.

The main rule is not to register in Mentor other sensitive personal information than mentioned above, such as information about diseases or diagnoses. It could, however, contain a reference to illness or diagnosis records.

Through Mentor, you can do the following:

• View the student's class schedule
• View assignments and report cards
• School calendar
• Weekly schedule
• Study blocks
• View the student's teachers' information
• Send email to contact teachers and school staff
• View announcements from the school.
• View exam grades, educational assessments, and homework
• View student's absences
• View diary entries about school-time events; The person recording in the diary decides who can access the diary entry. You can choose from the following options; parents, school administrators and homeroom teachers, school administrators only, all staff related to the student who have access to the system.
• View the child's class/group information, class roster.
• The parent association can email parents if the school principal has given them access.
• After-school programs operated at the school can email parents.

If the school uses Mentor, parents and students can make use of an "app" which is a shortcut into Mentor's system. Through the app, registration and information that the school enters can be viewed in the same way as through the homepage, except for the family web which is only visible through www.infomentor.is. Detailed instructions on how to access the app and how to use it can be found in the User Manual.

More about Mentor

Automatic decision making

No automatic decision-making takes place in Mentor.

Usage recording

All user logins in the Mentor system are recorded or "logged".

Information recorded includes: Username, school, IP address, and the pages accessed in the system.

The recorded IP addresses indicate the geographical location where they are recorded by specific companies. They only indicate a broad geographical location, not a precise location. Geographical location could be relevant if, for example, in cases where there are punishable actions such as system breaches.

Event logging is for security and property protection and is part of ensuring that all data in the system is protected against unauthorized access, alteration, and destruction, theft, or damage.

The collected information is only reviewed and used if there is a reason that aligns with the purpose for which the information was collected. This information will not be handed over to others without the consent of the recorded individual or a decision by the Icelandic Data Protection Authority. However, it may happen that the police are handed such information if there are suspicions of punishable actions. Strict access controls apply to InfoMentor for this data and all employees have signed confidentiality declarations.

Námfús

Some primary schools in Reykjavík use the electronic information system Námfús based on a processing agreement that the school has made with Námfús ehf.

Námfús is a learning management system used for recording and delivering information about students and communicating with them and their parents.

Parents and students get access to the Námfús system when the student is studying in a primary school that uses the system.

A parent's email address will be used for communication with primary school and the email address will be sent to other parents for the same class/group to support and strengthen the relationship between parents through Námfús. You can go into the settings of the system and adjust your access so that your email address will not be made accessible to other parents within the system or at the school

You can log into the system via the Námfús website.

The personal data that can be registered in Námfús includes:

• Student's and parents' names
• Student's and parents' ID numbers
• Connection to the student, mother, father, or another person
• Student's language
• Parents' native language if other than Icelandic
• Address of the student and parents
• Parents' email
• Student's email
• Parents' phone number
• Details for primary contacts selected by parents; name, ID number, address, phone number, and relationship to the child.
• Student's photograph
• Exam grades
• Educational assessment
• Absences
• Homework.
• General recording in a "diary" of events that take place during school hours and concern the student.
• Emergency information about potentially life-threatening illnesses, such as acute allergies and epilepsy.

In exceptional cases and only if there is a specific need, schools can register sensitive personal information about the student's health in Námfús. This can include emergency information about potentially life-threatening illnesses, such as acute allergies and epilepsy.

The main rule is not to register in Námfús other sensitive personal information than mentioned above, such as information about diseases or diagnoses. It could, however, contain a reference to illness or diagnosis records.

Through Námfús, you can do the following:

• View the student's class schedule
• View assignments and report cards
• School calendar
• Weekly schedule
• Study blocks
• View the student's teachers' information
• Send email to contact teachers and school staff
• View announcements from the school.
• View exam grades, educational assessments, and homework
• View student's absences
• View diary entries about school-time events; The person recording in the diary decides who can access the diary entry. You can choose from the following options; parents, school administrators and homeroom teachers, school administrators only, all staff related to the student who have access to the system.
• View the child's class/group information, class roster.
• The parent association can email parents if the school principal has given them access.
• After-school programs operated at the school can email parents.

Access to class roster

The principal can decide that parents have access to the class list in Námfús with the names of their children's classmates along with contact information, such as parents' names, their emails, and phone numbers. This information may only be used to improve the welfare of the children in question.

If the principal grants access, a parent can remove access to their information, either in whole or in part, by going to "settings" in the Námfús system. If a parent chooses, for example, to have the email open, their email address will not appear to other parents, just the possibility to send mail. Detailed instructions on settings can be found in the Help button on the parent's front page.

Primary school parent association

The school has an active parent association and representatives on the board of the parent association may receive a list of the students' parents, along with their ID numbers, to collect association fees as per the school principal's decision. The school must ensure that information is sent to the parent association representative securely, if in an encrypted document. In addition, the primary school can send parents information from the parent association or provide banks with information to collect the parent association's membership fees.

Parents can select whether they are on the parent association's mailing list in Námfús. At the same time, the school can use labeling in Námfús to give parents in the parent association's board the authority to send emails to other parents related to the association's activities.

Automatic decision making

No automatic decision-making takes place in Námfús.

Usage recording

All user logins to the Námfús system are recorded or 'logged' and are discarded after a certain time, unless there are objective reasons to keep them longer.

Information recorded includes: Username, school, IP address, and the pages accessed in the system.

The recorded IP addresses indicate the geographical location where they are recorded by specific companies. They only indicate a broad geographical location, not a precise location. Geographical location could be relevant if, for example, in cases where there are punishable actions such as system breaches.

Event logging is for security and property protection and is part of ensuring that all data in the system is protected against unauthorized access, alteration, and destruction, theft, or damage.

The collected information is only reviewed and used if there is a reason that aligns with the purpose for which the information was collected. This information will not be handed over to others without the consent of the recorded individual or a decision by the Icelandic Data Protection Authority. However, it may happen that the police are handed such information if there are suspicions of punishable actions. Strict access controls apply to Námfús for this data and all employees have signed confidentiality declarations.

Other ways to access information

If parents make a reasoned request for access to information to be provided also by other means than through Mentor or Námfús, such as by email, phone or mail, school staff should endeavor to comply with the request, as this would serve the interests and needs of the child. Consideration should be given to the nature and importance of the information in question and whether the child's special needs or circumstances require a certain form of communication.

Google Workspace

Google Workspace is a solution designed as part of the Reykjavík City primary school curriculum and a step towards modernizing teaching methods. The solution offers students access to specific tools used in teaching and introduces them to responsible and constructive Internet use. These tools can be used to create and distribute digital documents, enhance student-teacher communication and facilitate collaboration. Google Workspace is primarily intended for student use and will prove useful in project work on computers. Students can save projects in their home directory and submit them when completed.

It's important to note that students' Google Workspace access for school work is not comparable to personal Google use.

In brief, the difference is as follows:

• The student's access and corresponding data are protected from other users' visibility. Therefore, students must decide to share documents if they want other users to see them.
• Google Workspace does not own students' data. Students always hold the rights to the documents and data stored in the G-Suite environment. Where students leave the school, their access, and the connected data, is automatically deleted, considering some of the data may need to be archived for the National Archives according to the Public Archives Act No. 77/2014.
• Google Workspace contains no advertisements. Therefore, students' data is used strictly for academic purposes and is neither used for marketing nor resold to third parties.

Students are assigned a username that provides them access to the Department of Education & Youth Google Workspace,  and all data stored there. The username ending with @gskolar.is grants students access to Gmail, a core service of Google Workspace. This enables students to learn and improve email skills in the Google Workspaces school solution under teacher guidance. The email system is accessible to all students and works for both intra-system and external mailings.

Along with Gmail, students can find the following programs in Google Workspace's core services: Google Drive for the student’s data storage, Google Classroom for submitting and receiving assignments, and Google Hangouts Meet for video calls between students and teachers.

• Learn more about Google Workspace for Education (IS)

Office

Primary schools in Reykjavík City have the option to use Office 365 in their daily operations, which applies to both staff and students. Office 365 is run by Microsoft Corporation.

• Find out more about Office 365's privacy policy

When a student enrolls in one of the City's primary schools, information from the digital information systems of schools, either Mentor or Námfús, is transmitted to IT Services of Reykjavík City. This includes information such as the student's name and ID number, the digital information system used by the school, and the specific school where the student is enrolled.

Based on this information, a user name (example: TeSK05) and an email address (full name) are created from the student's name. The username cannot be traced back to the student as it consists of the first two letters of the first and last name (in English alphabet) along with two random numbers. This information is written into the Active Directory (AD) and synchronized with Office 365 along with the 'Job Title’ Nemandi (Icelandic for student). Information flows through the system, and no student information is collected by the Department of Information Technology.

Office 365 comprises various tools/systems, mostly:

Word, Excel, PowerPoint, OneNote, OneDrive, and SharePoint.

Student usage of Office 365 is under the supervision and responsibility of teachers during school hours. However, when students utilize their Officer 365 access outside of school, usage is under the guardians' responsibility. Students have the option to download and install Office 365 software on computers outside the school to complete homework. Therefore, guardians are encouraged to monitor the secure handling of student personal information, how students work with the information in the software, and what information enters the system.

Primary school staff

Primary school staff who need access to student and their parents' information for their jobs have access to this information.

Directorate of Education

The Directorate of Education maintains a collection of data from national achievement exams and other tests administered in educational institutions.

Parents or schools can request the assistance of a specialized specialized council of specialists for bullying issues, operating under the Directorate of Education and the responsibility of the Ministry of Education and Culture, if an appropriate solution has not been found within the school or municipality despite repeated attempts and the involvement of specialist services. In cases where it's necessary for the processing of such matters, the Directorate of Education is allowed to gather information from parties other than schools, such as sports clubs and from the health care system, as long as the parties involved have consented to this data collection.

• More about what personal data the Directorate of Education processes

Student support

Article 17 of the Act Compulsory School states addresses students with special needs. It states, in the first and second paragraphs, students are entitled to have their educational needs met in regular primary schools, without discrimination, regardless of physical or mental disabilities. It also stipulates that students who struggle academically due to specific learning difficulties, emotional or social obstacles, and/or disabilities - as defined in Article 2 of the Act on the Affairs of Disabled People - have the right to special support in line with their identified needs. This includes students with reading disability, chronically ill students, and others with health-related special needs.

In compliance with Regulation No. 585/2010, as amended, on Special Supports for Primary School Students with Special Needs, it's the principal's role to assess whether there are students in the school who need special educational support. The principal is also responsible for responding quickly and adequately to the identified special needs of students and other aspects of their situation as needed.

This includes organizing learning support for students starting school who have special needs based on available information.

It's the principal's duty to ensure assessments of special needs and planning of support are always conducted in consultation with parents and teachers, including homeroom teachers and special education teachers. Furthermore, the principal should consult with other professionals or school health services as needed.

Support for students with special needs should be provided by homeroom teachers, special education teachers, or other teachers as needed. The principal can also hire outside personnel for special support, if deemed necessary, upon obtaining approval from the municipality.

All diagnoses of students and their learning conditions should be made in consultation with and with the consent of the parents, who should be informed of the outcome.

Student-protection councils of primary schools

The Principal is responsible for coordinating the work within each school of those handling the individual student issues relating to school services, educational guidance, and school health services through establishing a student-protection council. Furthermore, cooperation with municipal social services and the child-protection authorities regarding individual student issues should be promoted as needed, in accordance with the fourth paragraph of Article 40 of the Act on Compulsory School.

The principal appoints the student-protection council for one year at a time and is responsible for the operation of the Council, which should take into account the circumstances at the school in question. Principals or their representative oversees the student-protection council's operations.

In the student-protection council of a primary school, positions are held by the principal and/or representative they appoint, the caregiver for students with special needs, a representative of school health care, a representative of the municipality's school service, and a school and career counselor. Additionally, representatives from the municipality's social service and child protection authorities might participate in the council's work when necessary.

The student-protection council addresses specific measures for individual students or groups of students that have been brought to the council. The Council assesses what additional information is needed and invites to its meeting the class teacher and parents, as well as other parties involved if necessary.

Because of this, the head of the after-school program or youth center or others may also be invited to council meetings in line with Article 20 of Regulation No. 444/2019 on School Services.

If a student doesn't receive adequate assistance because of a disability, illness, or academic, social, or emotional difficulties, the matter can be referred to the school's student-protection council.

Parents are generally informed if their child's case is formally referred to the school principal or the Student Protection Council, and cooperation with parents to resolve issues is sought whenever possible.

School service

Services for primary schools in the areas of educational counseling and psychological services are provided through the City's service centers.

Parents of primary school students can request examinations, diagnoses, and counseling for their children. In addition, school administrators, teachers, school and career counselors, or other school or school health services staff, as the case may be, can request such specialized assistance in consultation with and with the consent of the parents. Requests should be directed to the principal.

All diagnoses of students and their learning conditions should be made in consultation with and with the consent of the parents, who should be informed of the outcome.

Parents can access or request copies of data held by the school service with personal data about their own children, based on the provisions of the Compulsory School Act, Information Act and/or the Data Protection Act, as applicable.

Behavioral counselors, teaching counselors, and special education counselors operating on behalf of the school service provide advice to teachers. Any work on the cases of individual students is done with the consent of the parents.

• View the regulation on school services

Mobile team

Schools can request guidance and counseling from the mobile team, a service of the Department of Education & Youth's office, for situations involving children who exhibit severe violence or cause significant disruption at school. In cooperation with the principal and with written consent from the parents, the head of division for the mobile team can submit an application for involvement in cases that have not been resolved by school services. The application should include basic information about the relevant case and its previous handling.

School health services

School healthcare in primary schools follows the current Health Service Act. The planning and organization of school healthcare require consultation with the school committee and principal. The district health center is responsible for the school healthcare and is also responsible for the data created there.

School healthcare includes screenings, lifestyle and well-being discussions, vaccinations, health education, along with counseling for students, their families, and school staff

Participating in the work of the student-protection council among other roles in the school’s councils and teams is part of school healthcare tasks.

Surveys and studies

In connection with the evaluation and quality assurance in primary schools, internal evaluations must be carried out as prescribed in Article 36 of the Act on Compulsory Education No. 91/2018. In addition, municipalities shall conduct external evaluations according to Article 37 of the Act on Compulsory Education. The Directorate of Education also conducts external evaluations in line with Article 38 of the Act on Compulsory Education. Evaluation and monitoring can proceed via studies or surveys.

School principals can agree to participate in studies or surveys to increase knowledge about school and recreational activities that could benefit the school community. When a study is aimed at children and young people who have not yet reached the age of 18, formal permission is, however, required from the Office of the Department of Education & Youth. This applies to questionnaires for students, interviews, focus groups, and/or field observations. Depending on the nature of the study, additional written parental consent may be needed, or it may be sufficient just to inform parents, i.e. intended consent. Information on the type of consent to be obtained is set out in the Office's authorization.

Access to class roster

The principal can decide that parents have access to the class list in the school's electronic information system with the names of their children's classmates along with contact information, such as parents' names, their emails, and phone numbers. This information may only be used to improve the welfare of the children in question.

If the principal grants access, a parent can remove access to their information, either in whole or in part, by going to "settings" in the school's electronic information system.

Primary school parent association

The school has an active parent association and representatives on the board of the parent association may receive a list of the students' parents, along with their ID numbers, to collect association fees. The school must ensure that information is sent to the parent association representative securely, if in an encrypted document. In addition, the primary school can send parents information from the parent association or provide banks with information to collect the parent association's membership fees.

Parents can select whether they are on the parent association's mailing list in Mentor. At the same time, the school can use labeling in Mentor to give parents in the parent association's board the authority to send emails to other parents related to the association's activities.

After-school programs and youth centers

The director of an after-school program or youth center, associated with a primary school, has access to the school's electronic information system, referred to as the 'recreation gateway. This access is used to disseminate information about recreational activities on behalf of the Department of Education & Youth via email to parents. Those involved with the Reykjavík City Recreation Card who provide structured recreation for children and adolescents in Reykjavík also have the opportunity to present their activities in the recreation gateway in collaboration with the director of a recreation center and directors of after-school programs and youth centers at the respective primary schools. Directors of after-school programs and youth centers can also view basic information about registered students and their emergency contacts - such as address, telephone number and email address - and an emergency information box that may include necessary details about a child's allergies and information about contacts that can be reached in emergencies if parents cannot be contacted. However, directors of after-school programs and youth centers cannot modify student information or that of their emergency contacts the school’s information system.

Parents can choose whether they receive email from the recreation gateway. In their area of the information system, they can use a check-mark if they do not want such emails.

If a student is using the after-school program's service, information about the student's absence from school may be passed on to the after-school program. If there are valid reasons, the cause of the absence may be reported. Furthermore, a primary school can exchange general information about day-to-day communications with a child with an after-school program or a special youth center, if it serves the child's immediate interests.

Recreation specialist in primary schools

While the primary school is open, a recreational consultant employed by the after-school program at the school may work at the school premises.

The recreational consultants' task is primarily group work carried out in collaboration with primary school staff, aimed at strengthening social skills and self-image and increasing social activity among children. To enable recreational consultants to undertake this task, it may be necessary to provide them with various general personal data about students in the group that may be relevant to the group work.

Regarding work with students on an individual basis, this will not be done except in consultation with the principal and in consultation with parents and teachers.

Secondary schools

Secondary schools are responsible for registering students according to clause 2, article 32, of Act No. 92/2008 on Upper Secondary Education. According to Article 44 of the Act, specific duties of individual secondary schools regarding student registration and the preconditions the school sets for registration are determined. Details of registration are specified in Regulation No. 1150/2008 on Student Enrollment in Secondary Schools, with subsequent amendments, and in the general part of the national curriculum for secondary schools.

The second paragraph of Article 27 of the Act on Compulsory Education stipulates that it's not permitted to disclose information about students' grades to anyone other than the students themselves and their parents. However, it is permissible to share this information for student transfers between schools and enrollment in secondary schools, provided that complete confidentiality and treatment in accordance with the current Data Protection Act and processing of personal information law is observed.

It's also permissible for the principal or other specialists on behalf of the municipality to provide, with the consent of a parent, necessary personal information about individual students to secondary schools. This necessary information may include, for instance, pedagogical, medical, psychological, special education evaluations, and other diagnoses. Consent refers to informed consent according to the Data Protection Act No. 90/2018.

The transfer of information to secondary schools is carried out through the school's electronic information system, Mentor or Námfús, through Menntagátt, which is operated by the Directorate of Education.

When the preparation for enrolling primary school students in secondary schools begins, data flows from the electronic information systems of primary schools, Mentor or Námfús, into a database that stores data for the application process on the Menntagátt application website of the Directorate of Education. This is the same database that keeps the data of secondary schools, which they access through their INNU access.

The following information is shared from primary school systems to INNU:

• Parent/guardian name and email address
• Student's ID number
• Primary school subjects (both mandatory and elective)
• Educational assessment
• Standardized grades, as applicable
• Comments
• Assessment criteria
• ID number of the school that reported the grade

Department of Education & Youth Office

The office of the Department of Education & Youth manages a student database called Hafdís, operated under a processing agreement with Miracle. This database contains information about all students residing in Reykjavík, whether attending Reykjavík City primary schools, independently run primary schools, or those in other municipalities. The objective is to digitally store the academic records of all Reykjavík City primary school students in one centralized, active database, so that office staff can access data on student’s schooling. Moreover, the database allows the Department of Education & Youth to ensure that all children living in the area attend primary school, as required by law.

The Department of Education & Youth's office can access student information related to the allocation of funding to schools for student support, and this can include sensitive personal information

The Department of Education & Youth's office also has access to information related to the collection of fees for meal services. When parents apply for meals from Vala School Meals, subscription information and details about the student are transferred to a system operated by Idega hugbúnaður hf., a processing agent.

Primary schools can consult with the Department of Education & Youth's office for individual issues, in addition to a counselor working there in cooperation with parents and schools. To provide effective counseling, the counselor may need to gather personal data on the conditions of the relevant students, and this information is stored securely.

Processing on the basis of the Administrative Procedure Act, Information Act, and other acts

There may be situations where primary schools are obliged to provide data under the Administrative Procedure Act No. 37/1993, the Information Act No. 140/2012 or the Child Protection Act No. 80/2002, in accordance with the second paragraph of Article 17 of the Data Protection Act No. 90/2018.

How is the safety of your personal data ensured?

The City of Reykjavík safeguards personal data through appropriate organizational and technical measures, including access controls and encryption.

Primary school staff and others involved in student matters are required to respect full confidentiality regarding the affairs of children and their parents that they learn about in their work. This must be done in accordance with the second paragraph of Article 12 of the Act on Compulsory Education.

What happens to personal data and how long is it stored?

When information is received through an application for primary school via My Pages, it is logged in the school's electronic information system, which is a database hosted by either InfoMentor or Námfús, as applicable.

At the end of each school year, the manager of the archives or the person assigned the task by a manager oversees student files. They ensure that all student-related data has been printed and filed in individual folders, in line with guidance for document storage for Reykjavík City's primary schools.

Primary schools are obligated entities under the Act on Public Archives, No. 77/2014. Therefore, they are not permitted to destroy documents and data that they receive or create without permission from the National Archives of Iceland. This obligation also includes delivering all documents and data received or generated by the primary school to the National Archives for future storage. Electronic records, databases, and document storage systems must also be transferred to the National Archives.

Therefore, personal data that is subject to the above is stored indefinitely.

• More about the National Archives

Rights

Parents have the right to access their child's information. The limitations on the right to information follow the provisions of Article 17 of the Administrative Procedures Act No. 37/1993 and Article 9 of the Information Act No. 140/2012.

A parent without custody of a child has the right to receive information about the child from the primary school. Parents’ rights to information are covered by Article 52 of the Children's Act No. 76/2003.

You may have the right to access the personal data that the City of Reykjavík processes. You may also have the right to object to the processing, have the information corrected, request that it be deleted, have the processing limited, and/or have the information delivered to you or a third party in machine-readable format.

• Find out more about your rights in the Data Protection Policy