Processing of personal data in school bands
Reykjavík City operates four school bands in Vesturbær and Miðborg, Austurbær, Árbær and Breiðholt, and Grafarvogur. This page provides information about privacy and processing of students' and parents' or guardians' personal data in Reykjavík City school bands.
Personal information
Reykjavík City school bands process certain personal information of students who apply and are enrolled, their parents/guardians, and staff.
New electronic system
Reykjavík City school bands are adopting a new electronic information and registration system, SpeedAdmin, to replace the current School Archive system. Existing student and parent/guardian information from School Archive has been transferred to SpeedAdmin.
Education
Below is information about the processing of personal data for students and their parents/guardians who apply to and are enrolled in City-run school bands. This information is necessary for parents/guardians and students to review to ensure transparency regarding the personal data processing mentioned above.
Each school band is responsible for processing personal data, as defined by the Data Protection Act No. 90/2018, with certain obligations. Reykjavík City is also considered a data controller under the Act, as the City registers users in the system. SpeedAdmin provides access to its registration and information system and is considered a data processor under the law. The Data Protection Act outlines responsibilities for data controllers and processors. This includes informing how students' and parents/guardians' personal data is processed in educational solutions used in school activities.
Reykjavík City's Department of Education and Youth has conducted a risk assessment and data protection impact assessment for SpeedAdmin. The Department of Education and Youth (SFS) has made a special processing agreement with SpeedAdmin on behalf of Reykjavík City's school bands.
What is the purpose for processing the personal data and its basis?
Reykjavík City and its school bands need to process children's and parents’/guardians' personal data for school band applications. This includes processing students' data to handle applications, register children, manage their participation after starting, and give parents/guardians access to information about their children's progress.
This processing is necessary to fulfill Reykjavík City's legal obligation to offer students the opportunity to participate in recreational and social activities. The legal basis for processing is that it's necessary for tasks carried out in the public interest and in the exercise of official authority, as per Article 9, Paragraph 1, Item 5 of the Data Protection Act No. 90/2018. The legal obligation for Reykjavík City as a municipality is found in Articles 5, 18, 33, and 47a of the Primary School Act No. 90/2008, and Article 7a of Regulation No. 897/2009 on sharing and handling student information in primary schools and parents' right to access information about their children.
If sensitive personal data, such as medical information or diagnoses, is processed for school band applications and registration, it's based on Article 11, Paragraph 3 of the Data Protection Act. Generally, such information is not recorded in SpeedAdmin. However, information about life-threatening conditions like severe allergies or epilepsy may be recorded to ensure student safety, based on Article 11, Paragraph 1, Item 3 of the Data Protection Act.
Remote teaching
SpeedAdmin offers remote teaching in "Study planner". This feature needs special activation. Remote teaching is intended for exceptional cases.
To ensure remote teaching as needed and required, all demands must be met. This includes guidelines from the Icelandic Data Protection Authority on remote teaching in schools. Remote teaching uses the website Vonage.com. It is specifically noted that recording lessons is not possible.
App
An app is also available for the solution, both on Android and iOS.
App login is the same as web solution login. The app can be used for recording. Recordings are stored like other information in SpeedAdmin. Recordings are encrypted at rest. Recordings are not stored centrally or on the device. They are only stored in the solution itself. When played, they play from there. Education and procedures for app recordings will be provided if needed.
What personal data is processed?
- Student information: Identification (number), name, ID number, address, mobile phone, home phone, other phone, email, gender (boy, girl, non-binary/other), photo, parent/guardian information, school notes, guardian notes, department, class, primary school, other school, enrollment date, payer of school fees, continuing education, teaching, guardians, equipment rental, school application, attendance (date, presence (attended, late, excused, absent, holiday) teacher absent, explanation), exams, assignments, photos and action log for SpeedAdmin use. Information about life-threatening illnesses, when and if applicable.
- Parent/guardian information: Identification, name, ID number, address, mobile phone, home phone, other phone, email and notes, mark, equipment rental and action log for SpeedAdmin use.
Parents or guardians may need to give consent for photos and videos as needed.
Where does the information come from?
For children already in a school band, information from School Archive (the previously used solution) will transfer to SpeedAdmin.
For new applications, the parent or guardian applying provides child information through SpeedAdmin. Reykjavík City gets basic information about the child and parents or guardians from Registers Iceland. Reykjavík City may also get necessary information from the Department of Education & Youth database. Information related to school band activities is processed. Information is recorded in SpeedAdmin when applicable.
How long is the personal data kept?
Students and their parents or guardians can access SpeedAdmin while enrolled in the school band. When students leave and SpeedAdmin access needs to be closed, Reykjavík City's computer rules apply. Reykjavík City must transfer records to the Reykjavík Municipal Archives after a set time, as required by the Public Archives Act, No. 77/2014. This entails that the municipality is prohibited from destroying or disposing of any record that falls within the scope of the Act, except by special authorisation from the National Archivist. Reykjavík City is required to transfer personal information to the Municipal Archives for retention after the specified time.
More specifically, personal information is transferred to the Municipal Archives according to Reykjavík City's record retention schedules. Usually, records are transferred to the National Archives after 30 years, but digital records go to the Municipal Archives after five years.
How do we ensure the security of personal data?
The City of Reykjavík safeguards personal data through appropriate organizational and technical measures, including access controls and encryption. All City staff handling personal information are bound by confidentiality.
Sharing personal information with third parties
Application information in SpeedAdmin is shared with the child's school band. It's recorded in the band's student register using SpeedAdmin. A processing agreement is in place with SpeedAdmin as the processor. Students and parents or guardians get access to monitor the child's progress.
To bill school fees, a list from SpeedAdmin is transferred to Agresso, the City's billing system.
This information moves from SpeedAdmin to Agresso:
- Name, ID number, student level, school year, payer's ID number, instrument rental, school band cost center, and fee amount.
SpeedAdmin data is stored securely within the European Economic Area (EEA).
The City of Reykjavík will not share any other personal data with third parties unless the City is required to do so on the basis of law, governmental orders, or a court order. The City will also not transfer personal data outside the European Economic Area without specific authorization and without informing you.
Objections to data processing
Parents or guardians can object to the processing of personal data in SpeedAdmin by contacting the principal for the relevant school band. Objections will be reviewed and alternative solutions may be offered for students if deemed necessary.
Automated decision-making
Automated decision-making is not used in applications or operations of Reykjavík City school bands.
Your rights
Parents or guardians may have the right to access personal data processed by Reykjavík City related to their child's registration in a school band. They may also have the right to object to processing, request corrections, deletion, limited processing, and/or receive information in a machine-readable format.
More information about these rights is available in Reykjavík City's privacy policy.
Complaints about processing
If dissatisfied with Reykjavík City's handling of personal data, parents or guardians can contact the City's Data Protection Officer or file a complaint with the Icelandic Data Protection Authority.