School WhatsApp group and GDPR

After a few quiet months during the summer holidays, school WhatsApp group is becoming very active again. Do these groups comply with the GDPR?

What does the Spanish Data Protection Agency (AEPD) say about school WhatsApp groups?

The Spanish Data Protection Agency (AEPD) does not recommend the use of instant messaging applications (such as WhatsApp) between teachers and parents.

The Spanish Data Protection Agency (AEPD) states that schools should not use WhatsApp or other similar applications to communicate officially with parents; except in exceptional emergency situations such as, for example: in case of accident or illness during a school trip.

The Spanish Data Protection Agency advises that, to send academic communications, teachers should use institutional educational platforms.

In this regard, the AEPD published the “Guía para centros educativos”, where it explains how personal data (especially of students and their families) should be handled by educational institutions.

Likewise, the AEPD has the Canal Joven: a reference tool for minors, their parents, teachers and the public to resolve doubts about issues related to the privacy and data protection of minors.

Parents themselves create school WhatsApp groups

The AEPD’s recommendation is limited to the use of WhatsApp by teachers to communicate with students’ parents; it says nothing about the creation of school WhatsApp groups created by the students’ own parents (without the presence of teachers).

Even if it’s a WhatsApp group where they talk about topics that might interest you (because your child is in that class), as we already pointed out in a previous post about work WhatsApp groups, including someone in a WhatsApp group without their consent means exposing their personal data (phone number, name and profile picture) to the rest of the members.

To avoid legal problems, we recommend sending an invitation link; so that joining the group is entirely voluntary.

What should parents keep in mind when communicating through the school WhatsApp group?

To prevent violations of children’s privacy and data protection in WhatsApp groups created by parents, the school WhatsApp group should adhere to the following guidelines:

• Purpose and limits of the channel: To share information of general interest to the students (and families) of the class; as a group.

This is not the channel for discussing issues affecting individual children or matters between two children. This is primarily to avoid publicly exposing them and violating their privacy, which is specifically protected by Article 84 of the LOPDGDD (protection of minors on the Internet) and the general principles of data processing in Article 5 of the GDPR.

For individual cases, you should speak directly with the guardian of the affected minor.

• Minors and identifying data: As these are issues that affect minors, special attention must be paid to what is said and how it is said.

In order not to violate the privacy of children or process personal data without legitimacy (article 4.1 of the GDPR, which defines personal data as “any information relating to an identified or identifiable natural person”), data that allows them to be identified directly or indirectly should not be provided (for example: names and surnames, clothes they wear, specific details of health or behavior).

• Images and consent: Images (photos/videos) of people are personal data.

Organic Law 1/1996, on the Legal Protection of Minors (Article 4) establishes that any intrusion into the privacy or image of a minor that may be contrary to his interests (even if there is consent from the minor or his legal representatives), will be considered an illegitimate intrusion.

In accordance with privacy regulations (article 6.1.a of the GDPR on consent and article 7 of the LOPDGDD on the consent of minors), images of minors should not be shared by this group without the express consent of their legal guardians.

If you have given your consent to share an image in this group, its use is strictly limited to personal and domestic purposes (Article 2.2.c of the GDPR and Article 2.2.a of the LOPDGDD). This means that photos or videos shared in the school WhatsApp group cannot be posted on social media or shared outside the group itself.

The most serious cases of violation of privacy or unauthorized dissemination of images of minors may result in civil liability claims (compensation for damages to honor and image under Organic Law 1/1982, on civil protection of the right to honour, personal and family privacy and one’s own image) or be dealt with through criminal proceedings (articles 197 et seq. of the Penal Code, taking into account the automatic aggravating factor due to the status of minor).

Sandra Santiago, Lawyer.