S.L. 586.7 Art. 5Processing by educational institutions.

(1) Educational institutions may process personal data in relation to students, parents and legal guardians for administration purposes and for the daily operations and efficient running of such institutions for the purpose of providing their students with the necessary educational services as required under the Education

Act.

(2) Personal data in relation to students may also be processed for the following purposes:

(a) academic progress monitoring which includes performance data, examination and, or assessment results associated with the students;

(b) organisation of functions and, or activities which may form part of curricular and extra-curricular requirements, provided that where the processing is related to informal activities the consent is obtained from the students themselves if applicable, or from their parents or legal guardians.

(3) Medical data in relation to the students attending the institutions, as provided by medical professionals and, or by the parents or legal guardians, or by the students themselves where applicable, may also be processed by the educational institutions in the best interest of their students, and provided that:

(a) such data are held in separate distinctive files in a secure manner; and

(b) if the students are following compulsory schooling, such data may be forwarded in the best interest of the students, to another educational institution to which students are transferred; and

(c) such data are destroyed once the students stop attending the institution concerned.

(4) Student welfare data may also be processed by the educational institutions in the best interest of their students, and provided that:

(a) such data are held in separate distinctive files in a secure manner; and

(b) if the students are within compulsory schooling, such data may be forwarded in the best interest of the students, to another educational institution where students are transferred to; and

(c) such data are destroyed once the students stop attending the institution concerned.

(5) Educational institutions may process visual images provided that consent is obtained from the students themselves if applicable, or from the parents or legal guardians.

(6) Educational institutions may keep records of their students for historic purposes provided that no special categories of data and student welfare data are retained for such purposes.

(7) Subject to the provisions of regulation 8, educational institutions may process personal data for research and statistics purposes to perform tasks which are required by the education authorities in terms of regulation 4, or in the legitimate interest of the educational institution to provide the necessary education to their students.

(8) Consent required under this regulation shall be obtained from the students themselves if applicable, or from their parents or legal guardians, prior to disclosure of personal data to third parties unless such third parties are any of the following:

(a) education authorities processing personal data in terms of regulation 4;

(b) another educational institution where a student is transferred to;

(c) examination bodies as part of the examinations process and, or national assessments;

(d) health authorities in the fulfilment of their functions under the Public Health Act;

(e) hospitals, clinics and other medical professionals where students need medical attention;

(f) the Police in cases of criminal investigations;

(g) social workers or support agencies or authorities where there is suspicion or where it is alleged that the welfare of the student is not being protected;

(h) the Corporation in accordance with the Employment and Training Services Act in terms of regulation 4 of these regulations;

(i) any court, as required in judicial proceedings.

(9) Without prejudice to the provisions of regulation 8, the Corporation, in fulfilment of its statutory functions and in accordance with the Employment and Training Services Act, may request educational institutions to be provided with personal data of students pursuing studies in such institutions. For this purpose, educational institutions shall provide such data in their possession provided that students whose data are being forwarded shall have attained the age of fourteen years at the time of the request.