Although the General Data Protection Law (LGPD), Law No. 13,709, passed in August 2018, has been postponed for the second time and is now scheduled to take effect in May 2021, it is an essential regulatory milestone for an increasingly digital world. The LGPD also applies to the education sector. However, schools and institutions of higher education should already be compliant or in the final stages of compliance by now, according to experts in the digital sector. This is not yet the case, just as it is not for most companies and government agencies in Brazil. 

The LGPD is based on the principles of transparency and ongoing updates regarding the purpose of collecting data, whether physical or digital. Using data beyond what is necessary or outside the scope agreed upon with the user is considered an unlawful act subject to punishment, as is storing data for longer than necessary. 

"Given that school is one of the places where children and adolescents spend the most time in their lives, it is clear that this long journey carries with it an incredible historical legacy that will accompany the individual on all the other paths they take," explained Alessandra Borelli, an attorney specializing in digital law and executive director of Nethics Educação Digital.

In other words, the improper collection of data must be stopped in order to avoid potential penalties from the National Data Protection Authority (ANPD), the supervisory and regulatory body that will play an important role in ensuring compliance with the law in the country. 

For school administrators, in particular, data protection is important as a matter of business ethics in and of itself, as part of the social mission of education and the protection of students. It is also a competitive advantage, because the protection of students’ rights can be a factor in choosing an educational institution.

"The current shift toward the digital environment due to the novel coronavirus pandemic only intensifies this discussion, as new applications—such as videoconferencing—are being used, and virtual learning environments are being used more frequently,” said Guilherme Forma Klafke, a professor at FGV Direito-SP and project leader at the Center for Teaching and Research in Innovation (FGV-CEPI), who cited a set of five scenarios that highlight the importance of data protection:

- Sharing data for other purposes without the user’s knowledge. Every app has Terms of Use and Service and a Privacy Policy. It is not uncommon for them to state that they may share this data with business partners—the Zoom app, for example, did not make it clear that it shared access data (device type, IP address, date and time of access) with Facebook. Since these companies may already have this identifying information from other sources, they cross-reference this data with their own databases. It’s no wonder that ads on websites always seem to be exactly about what we were searching for online. The Cambridge Analytica scandal alerted the international community to the risks of the political use of personal data—such as the manipulation of election campaigns. 

- Personality development in children and adolescents. It is widely argued that the family and school are the primary settings for the education of children and adolescents. However, platforms such as YouTube and Facebook are capable of offering content tailored to these individuals’ interests, reinforcing not only positive aspects of personality development but also negative ones—for example, by exacerbating violent or self-destructive behaviors. When using these apps in the classroom—Google Classroom with YouTube, for example—one must be aware that they are collecting data from students.

- Security risks and data breaches. The less secure an app is, the more exposed students’ personal information will be. Imagine a leak of email addresses and passwords—which can be obtained if the tool isn’t secure—especially since most people use the same password for multiple apps. Or imagine a leak of academic records or even students’ essays and political or religious views.

- Future uses of the information. One characteristic of the internet is that information can remain there indefinitely. A few years ago, a leak of teachers’ comments recorded in school records sparked outrage in the community. Those comments are still available online—and, worse, there’s no guarantee they haven’t been edited after all this time. Without protecting students’ data, there’s no way of knowing what information might resurface in the future to be used against them. 

- Storage of sensitive data. Due to regulatory requirements, to provide services, or for business purposes, educational institutions store sensitive student data, such as skin color, gender, and health information. Information about health issues, for example, must be handled with the utmost care.

Where should schools begin to comply with the LGPD?

The main task for schools and universities is to review all existing contractual documents with their students, employees, and contractors, in addition to implementing a data protection and privacy policy. The law also highlights the need for investments in the information security infrastructure of schools and universities, with the goal of protecting data against potential leaks. 

In the case of children under 12, for example, the LGPD requires specific consent from parents or legal guardians for the processing of personal data. For all other students, it is essential that we understand what data is collected and whether it is consistent with the purpose stated by the educational institution.

With the LGPD taking effect, educational institutions will need to be prepared to ensure that the data they collect is gathered on a legal basis. “It is important for everyone to carefully read the new consent forms that will be introduced under the new law, so that the data authorized for collection and processing is justified in a way that aligns with the institutions’ needs,” emphasized Alessandra Borelli.

For those who are just beginning to adapt their educational institution, Guilherme Klafke recommended that the first step be to understand and manage the information by mapping all data flows. “It’s important to remember that personal information isn’t just about students, but also about all employees and even the students’ guardians.” 

Other important tips listed by the experts:

- Have the technology and legal departments work together with management to develop the necessary measures. They should maintain constant communication;

- Review the institution’s contracts with service and application providers, as well as with students and their guardians, if any. Verify that these providers comply with the law;

- Create and/or strengthen information security and privacy policies, which involves not only new rules for the collection and use of information, but also training for the entire staff;

- Allocate a portion of the annual budget to ensure the ongoing updating of infrastructure, software, and the professionals involved.

Just as schools and educational institutions provide safe physical environments, it will be essential for them to rethink their practices and ensure safety in the virtual environment as well.