AP: Education may only use social media after agreements with companies

Schools are not allowed to simply use social media. The Dutch Data Protection Authority concludes that this is only allowed if educational institutions 'make clear agreements' with such companies about what they do with the data.

The Dutch privacy regulator conducted research into the use of social media by an unnamed educational institution . He wanted to use social media as a marketing channel, but first asked the AP for advice. He now concludes that this is not simply allowed. Although the AP did not investigate the specific network, the regulator concludes that there are general rules that schools must adhere to. Schools should therefore make agreements with platforms. In these agreements 'the risks must be mitigated'. Such agreements concern, among other things, the way in which and the location where social media companies store data, or what happens if a data subject wants a photo removed. “You need to know where you can turn if you want to get your rights. Is that at your school or university? Or is that at the social media company? That should be clear,” says AP chairman Aleid Wolfsen.

Schools must always make these agreements, even if, for example, permission is requested from those involved. In this case, that happened during the investigation, but according to the AP, this is not always enough to be allowed to use social media under the GDPR.

The AP notes that the ruling applies directly to all educational institutions in the Netherlands. In practice, this means that many schools will have to stop using social media unless they make such concrete agreements. That is not impossible, the AP also says. In the past, two large educational umbrella organizations, SURF and Sivon, managed to make agreements with Google. That company adapted G Suite for Education after those agreements, although the process took several years.