Should parents be concerned that the
Minister for Education now has direct access to student data? Should such
processing also include the ID Card number when such processing is being
justified as “research”? Should the legal justification of student data
processing be achieved through a legal notice published under the Employment
and Training Services Act or through a more detailed (and studied) legislation?
Is LN76/2014 paving the way to the creation of a ‘Student Profiles’ database?
Legal Notice 76/2014 regarding
Data concerning Persons in Educational Institutions Regulations 2014 has
created furore in relation to the powers available at law to process data,
including personal data relating to students.
In a nutshell, LN76/2014, published
under the Employment and Training Services Act (and not under the Education Act),
is directly granting new powers (Reg. 4(1)) to the Minister of Education and
Employment himself to obtain data he may require from educational institutions
with respect to students attending such educational institutions. According to
the said legal notice, the data to be supplied must include a legally valid
identification document number (ID Card Number) due “to the importance of secure identification of students”.
This means that the individual child/student
will be identifiable and the data provided can be easily and quickly linked to
such child or student.
Furthermore, Regulation 4(3) stipulates
that, “without prejudice to the
generality of the provisions of subarticle (1), the data which may be required
shall include data relating to age, sex, ability, educational attainments and
other data of the persons to whom they relate as appear to the Minister to be
necessary to be used for research purposes and to provide for adequate advise
to be given on employment prospects and to prepare plans for their training pursuant
to the provisions of the Act” [the Employment and Training Services Act].
LN76/2014 also grants the Minister
direct powers to obtain from the Employment and Training Corporation data,
including ID Card Number, that the Minister may require in relation to persons
listed in the Register of persons seeking employment as well as “any other information it may have about any
other person”.
Unfortunately, the present
wording of LN76/2014 is raising more questions and casting more doubt in
relation to the processing that can be directly carried out by the Minister
than addressing the challenges that the processing of student data pose. This
is further compounded by the fact that both the Education Act and the
Employment and Training Services Act already provide for certain powers that
the respective authorities (and not the Minister directly) have with respect to
the processing of student data in order to carry out their functions as
established by Law.
Why do we need LN76/2014 therefore?
I ask, is this the correct way to
legitimise the collection and processing of student data, which will intrinsically
contain ‘personal data’ and ‘sensitive personal data’ as defined in the Data
Protection Act?
In his initial reactions to the
announcements made on Sunday 6th April that the Opposition will request a revocation of
this Legal Notice, the Minister for Education and Employment (by means of a
statement issued by the Department of Information) stated that Article 16 of
the Education Act already provides for the Education Directorates to request
such data, adding that: “The above cited
Article 16 was introduced by means of Act XIII of 2006 thus the Opposition
Leader is incorrect in stating that for the first time, the Minister for
Education shall have children’s personal data.”
The fact is however, that no
other current law in force grants direct powers to the Minister (as opposed to
legally established entities such as (i) the Education Directorates (ii) the National
Commission for Further and Higher Education and (iii) the Employment and
Training Corporation) to obtain and process student data for “research” purposes.
The fact is that, unlike present
legislation, LN76/2014 is introducing new powers for the Minister to obtain
student data through the choice of very broad, unclear and dangerous
provisions.
Present position under the Education Act
The Education Act provides under
Article 64 for the establishment of the National Commission for Further and
Higher Education whose aims and functions are listed in Article 65. These aims
and functions are mostly policy, strategy and licensing related and do not
provide for specific power in relation to single or specific individual cases
of students. Article 66 of the Education Act provides inter alia that in reaching its aims, the Commission shall “collect information, data and statistics
for the performance of its functions” as well as to publish reports and
statistics on higher education in Malta.
Article 68 of the Education Act
further provides that:
“68. (1) The Commission shall have full access to all information
available to public providers of further and higher education and it shall have
the right to request all data it may require both from public and private
providers and this data shall be transmitted to it within a reasonable time
from when it was requested.
(2) The Commission shall have access to statistics and to economic and
social data as required so that the Commission and its Secretariat may be able
to perform their functions in accordance with this Act.”
Even though it appears that the
Commission has the authority to limitedly obtain personal data (which has not
rendered been anonymous at source) as established under Article 68, it does not
appear that the Commission is empowered to use such data other than for
statistical purposes to enable it to fulfil its functions as listed in Article
65.
Article 16 of the Education Act
also grants, as the Minister rightly stated, certain powers to the Education
Directorates (but not the Minister) with respect to the collection, exchange
and processing of student data.
Article 16 reads:
“16. (1) Every Directorate may request, collect and verify any information,
data and statistics, as may be required for the performance of its functions.
(2) A Directorate shall have access to all information which another
Directorate, the Colleges and schools may possess, and is entitled to request
and obtain all data it may require from students, parents, personnel and from
public and private educational institutions, and this data should be given to
it within a reasonable time from the date of request.
(3) Every Directorate shall have access to other statistics and data of
an economic and social nature as required in order that it may perform its
functions according to this Act.”
It is immediately clear that the
powers listed in Article 16 are limited to the Educational Directorates “for the performance of its functions”. The
Education Act list such directorates as being (i) the Directorate for Quality
and Standards in Education and (ii) the Directorate for Educational Services.
The powers and functions of these Directorates are listed under Articles 8 to
12 of the Education Act.
Interestingly, Article 9(2)(d) of
the Education Act provides that the Directorate for Quality and Standards in
Education, as one of its functions, shall “ensure
that all information, data and statistics required for the drafting and the
planning of policy, strategies, guidelines and directives in education are collated,
compiled, analysed and researched, and, subject to any other law, take all
necessary steps so that these may be accessible to whosoever is involved and
who may have an interest”.
Again it is clear that such
processing by the Directorate of student data is purely related to policy and
strategy purposes.
But LN76/2014 in its present form
is not the Education Act (it was not even published as a Legal Notice under the
Education Act) and the Minister is not a Directorate. The powers available
under Article 16 of the Education Act are very different to the powers
available to the Minister under LN76/2014.
Present position under the Employment and Training Services Act
The Employment and Training
Services Act provides in Article 5 for the establishment of the Employment and
Training Corporation (the “Corporation”) whose functions with respect to
employment service and training under Articles 10 and 16 respectively.
The Corporation’s main functions
are therefore (i) “in general to provide
and maintain an employment service to assist persons to find suitable
employment and to assist employers to find suitable employees” [Art 10(a)]
and in particular: “to assist persons seeking
employment by guidance and advice on the choice of employment, and the training
and retraining which may be necessary”[Art 10(b)(iii]; and (B) “to provide training courses or other
schemes for the purpose of assisting persons desiring to fit themselves for
gainful occupation, or desiring to improve or update the quality of their
knowledge and skills for the same purpose” [Art. 16(1)(a)].
Article 27 of Employment and
Training Services Act further provides that:
“27. (1) The Corporation may from time to
time require any person in charge of a school to furnish in such manner as may
be requested and within a reasonable time such particulars as the Corporation
may require with respect to pupils leaving school or who, while attending
school, attain a stated age.
(2) Without prejudice to the generality of
the power conferred in subarticle (1), the particulars which may be required
shall include such particulars, relating to age, sex, ability, educational
attainments and other particulars of the persons to whom they relate as appear
to the Corporation to be necessary or expedient to enable adequate advice to be
given on employment prospects and to prepare plans for their training pursuant
to the provisions of this Act.
(3) Any person who fails to comply with any
request made under this article shall be guilty of an offence against this
Act.”
Similar to the provisions
contained in the Education Act, it appears therefore that the Corporation already
has the authority to limitedly obtain personal data with respect to pupils
leaving school or having attained a stated age (which has not rendered
anonymous at source) as established under Article 27 of the Employment and Training
Services Act. Therefore, also here, it appears that the Commission’s powers are
limited (i) to anonymize such data and use it for statistical purposes or (ii)
to process such data to “enable adequate
advice to be given on employment prospects and to prepare plans for their
training” which would also mean that this is carried out with respect to
persons “seeking” employment (Art. 10) and persons “desiring” to fit themselves
for gainful occupation or improve their quality of knowledge and training
(Art.16) both of which require active requests made by the persons concerned.
One will instantly notice the
similarities that exist between Article 27 of the Employment and Training
Services Act and Regulation 4 of LN76/2014 with the following important
distinctions:
1. Whilst
under Article 27 of the Employment and Training Services Act it is the
Corporation which is empowered to obtain data, Regulation 4 of LN76/2014 is
empowering the Minister directly;
2. The
data to be provided to the Corporation pursuant to Article 27 of the Employment
and Training Services Act relates to “pupils
leaving school or who, while attending school, attain a stated age” whilst
the data to be provided to the Minister under Regulation 4 of LN76/2014 relates
to “students attending such education
institutions”. LN76/2014 defines “educational institutions” as “any childcare, school or other institution
or entity offering education, whether at a pre-primary, primary, secondary,
post-secondary or tertiary level and also includes further and higher
educational institutions and institutions offering formal and non-formal
learning and vocational education”;
3. Data
provided under LN76/2014 must be accompanied by a legally valid identification
number;
4. Whilst
both Article 27(2) of Chapter the Employment and Training Services Act and
Regulation 4(3) of LN76/2014 make it clear that the powers available under
Article 27(1) and Regulation 4(1) are not being limited, Regulation 4(3) of
LN76/2014 additionally provides that the data may be used by the Minister for
“research”. Article 27(2) of the Employment and Training Services Act refers to
the provision of adequate advise to be given on employment prospects and to
prepare plans for training pursuant to the provisions of the Employment and
Training Services Act but does not include any direct reference to “research”.
As explained, Regulation 4(1) of
LN76/2014 is in no way limited by Regulation 4(3) so one can read Regulation
4(1) on its own which leads one to conclude that the power of the Minister to
obtain student data from educational institutions might not be necessarily
limited to the purposes as contained in Regulation 4(3). At best, this is
incorrect drafting.
It is also unclear what exactly
is the “research” mentioned in Regulation 4(3). From the answer given in
parliament by the Minister with respect to PQ 8395 it appears that the data
will be processed in relation to the Jobs+ initiative. Publicly available
information on Jobs+ seems to be limited.
The website of the Education
Ministry only provides a couple of paragraphs in relation to this initiative:
“Jobs+ is an initiative where
social partners and representatives of the political parties are entrusted with
the task of advising and co-ordinating with Government issues relating to the
labour market. Such initiatives are discussed within the Active Labour Market
Counselling and Action Committee.
The
Committee’s remit is as follows:
·
design a holistic
active labour market policy that addresses the long-term needs of the labour
market;
·
ensure that there
is adequate funding to promote an on-going active labour market policy;
·
co-ordinate with
the Ministry for Employment the implementation of active labour market
policies;
·
monitor labour
market and training programmes;
·
analyse the
effectiveness and efficiency of labour market and training programmes;
·
make
recommendations to the Ministry for Education and Employment on how labour
market and training programmes can be improved.”
It remains unclear who will
actually be undergoing this “research” (will it be the Corporation, the Commission,
the Minister himself?) as well as why the Active Labour Market and Action
Committee would require something more than statistical data (as opposed to
student data relating to identifiable individuals) in order to fulfil its remit
as indicated above.
Unfortunately, the term “research”
as contained in LN76/2014 remains undefined.
Furthermore, Article 54 of the
Employment and Training Services Act provides as follows:
“54. (1) The Minister may make regulations
generally for giving effect to the provisions of this Act, and the enforcement
thereof, and in particular, but without prejudice to the generality of the
foregoing -
(a) for providing for any matter which is
required or authorised by this Act to be prescribed;
(b) for prescribing the powers and
procedures of the Authority in the hearing and disposal of appeals under this
Act.”
It is questionable therefore
whether Article 54(1) of the Employment and Training Services Act does in
effect give the powers to the Minister to issue regulations such as LN76/2014
especially in light of Regulations 4 and 5 of the same LN76/2014 which are not
strictly “giving effect to the provisions
of this Act [the Employment and Training Services Act] and the enforcement thereof” but are in effect creating and
granting wide new powers directly to the Minister which could be introduced not
through a Regulation but through an amendment to the main Act itself.
Our Data Protection Act
Chapter 440 of the Laws of Malta
provides that personal data should only be processed if the data subject
provides his consent or if one of the exceptions listed in Article 9 are met.
Such exceptions include when processing is necessary for compliance with a
legal obligation to which the controller is subject (Art 9(c))(in this case the
educational institutions by virtue of LN76/2014); or when processing is
necessary for the performance of an activity that is carried out in the public
interest or the exercise of official authority vested in the controller or in a
third party to whom the data is disclosed (Art.9(e)); or processing is
necessary for a purpose that concerns a legitimate interest of the controller
or of such a third party to whom personal data is provided, except where such
interest is overridden by the interest to protect the fundamental rights and
freedoms of the data subject and in particular the right to privacy (Art 9(f)).
It is questionable whether
LN76/2014 in its present form would be able to pass the tests posed by Article
9 (c),(e) or (f) of Chapter 440.
Article 8 of Chapter 440 provides
that the processing of personal data for historical, statistical or scientific
purposes shall not be regarded as incompatible with the purposes for which the
information was collected but provided that (i) the appropriate safeguards are
in place so that data processed for these purposes is only kept for a period
not longer than necessary and, most importantly, (ii) personal data processed
for these purposes should not be used for any decision concerning a data
subject.
It is still unclear from the text
of the Legal Notice itself whether the data collected pursuant to LN76/2014
will be solely used for statistical purposes or will lead to any specific
decision concerning a data subject. If data collected pursuant to LN76/2014 is
used for any specific decision concerning the data subject, this might be in
breach of the same Chapter 440. The statements made that LN76/2014 is solely
required for research purposes really contrasts with the requirements to provide
an ID Card number under the same legal notice.
LN76/2014 makes no distinction
between ‘personal data’ and ‘sensitive personal data’. In practice, LN76/2014
gives the power to the Minister to collect all data whatsoever including the
health or sickness history of a student (a typical example of sensitive
personal data) as held by the educational institution. However, Chapter 440 provides that sensitive
personal data should only be processed if the data subject gives his explicit
consent or if the data was made public (Art. 12). Sensitive personal data may also
be processed if appropriate safeguards are adopted and the processing is
necessary in order for the controller to be able to comply with any law
regarding employment, to protect the vital interests of the data subject and
legal claims can be established exercised and defended (Art13). Clearly,
therefore, if LN76/2014 is interpreted as providing any power to the Minister
to obtain such sensitive personal data without any restriction, one would
seriously question whether such power is in direct breach of established data
protection rules and principles.
LN76/2014 will also create a
further obligation on all educational institutions pursuant to Article 19 of
Chapter 440 which provides that data controllers (the educational institutions)
have an obligation to inform their data subjects (or parents or guardians)
about the recipients of such data. In this case, the educational institutions
will need to inform the parents that their children’s information might be
transmitted directly to the Minister if he so requests to be used for
“research”. It is questionable as to whether the Minister is aware of this
corollary obligation which will be created on the educational institutions.
More questions than answers
It might appear to the lay person
that the scope behind LN76/2014 is the direct or indirect creation of “Student
Profile” containing intimate details of the students from the first day they
enter into childcare up to university and beyond. Unfortunately, LN76/2014 is raising serious questions which go
beyond the possible legitimate intentions of the administration to pursue the
Jobs+ initiative. Any initiative should not prejudice the fundamental right to
privacy of citizens. The apparent creation of this Student Profiles, from the
day a child enters into childcare up to leaving the educational machine, poses
Orwellian fears which LN76/2014 is further fuelling as opposed to addressing.
Minister Bartolo, in a comment to
the Times of Malta on the 7th April 2014 stated that “the kind of information they were after was the subjects chosen by
students in higher education, their performance and the kind of job
opportunities they had”. This however further raises questions as
the powers granted directly to the Minister by means of LN76/2014 are far
greater. In fact, LN 76/2014, in its definition of “educational institution” also
includes childcare centres as well as primary and secondary schools.
If it is true that the Minister only
wants information relating to higher education, then why was “educational institution”
so broadly defined?
The Student Profiles, if created,
will enable a very powerful database which can lead to serious abuse,
especially if such database is controlled directly by the Minister, also in
light of the fact that such Student Profiles might potentionally include
sensitive personal data.
What will be the purpose of these
Student Profiles? Who will oversee such database? For what purposes will such
database be used? Will it be solely a repository for processing statistical
data? What security, technical and organisational controls will such database
be subject to? How will the data subjects (as well as their guardians and/or
parents) be informed of such new processing? All these are questions that come
to mind.
At the very minimum, the processing
by government of such powerful and all-encompassing Student Profiles should be
governed by ad hoc subsidiary legislation similar to existing subsidiary
legislation issued under the Data Protection Act to govern the processing of
personal data in substantive areas as is the case with the processing of
personal data by the police or by providers of electronic communications
services.
Why are the powers conferred by
LN76/2014 given directly to the Minister as opposed to any other authority
responsible for the direct research (and which would be primarily focused on
the processing of data for statistical information)? Can one conclude that that
the powers granted to the Minister under LN76/2014 are disproportionate to the
aims of Jobs+ and can lead to perceived risks of privacy infringement? The
answer is yes.
In my opinion, one should better
consider amending Article 68 of the Education Act and Article 27 of the
Employment and Training Services Act to make them more in line with the
objectives of the Jobs+ initiative. Surely, the promulgation of LN76/2014 is
not the way to go.
A serious discussion should also
be initiated with respect to the anonymization of personal data used for
statistical purposes. The fears created by LN76/2014 render such discussion
even more urgent when it clearly appears that, by virtue of Regulation 4(2) of
LN76/2014, a valid ID number is being required. This can mean that (i) no anonymization
will take place and that such ID number will be a key piece of data
underpinning the same Student Profile and (ii) data being collected under
LN76/2014 will not be limitedly used for “research” and statistical purposes.
The use of pseudonymised data within the public sector, including such use for
statistics and research to fulfil the functions of the Commission and the
Corporation (as well as any initiative similar to Jobs+) should be studied in
detail. Unfortunately, it appears that LN76/2014 is pointing towards a totally
opposite (and dangerous) route. Similarly, the powers of the Minister to obtain
personal data from the ETC and the Registry of persons seeking employments
should also be questioned.
Whilst the intentions behind
Jobs+ might be laudable, LN76/2014, in my humble opinion, is not the way to
legislatively implement such schemes.
No comments:
Post a Comment