Data Protection in Schools, Universities, Non-Profit Organizations, and Religious Institutions
Example: Protestant and Catholic Data Protection Law
Special features of data protection law for private, church-based organizations
Schools, universities, non-profit, charitable, and church-based institutions regularly process personal data, including particularly sensitive categories of personal data such as health data and data relating to children. These typical circumstances require secure data protection structures and the sustainable, value-oriented involvement of all staff.
A transparent presentation of the implementations and technical and organizational measures for the protection of data and personal rights, especially to parents, is also necessary in this area.
Jordan & Wagner Rechtsanwaltsgesellschaft mbH supports schools, universities, non-profit, charitable, and church institutions, foundations, and (support) associations, in data protection management, as external data protection officers (DPOs), auditors, consultants, and in further training. In-house training courses or seminars on data protection law are also offered.
The VDP Association of German Private Schools Baden-Württemberg e.V. is organizing a full-day seminar on data protection law on July 6, 2023, at the Haus der Wirtschaft in Stuttgart with expert speaker Dr. Thomas A. Degen, specialist lawyer for information technology law (IT law), certified data protection officer TÜV Süd (DSB-TÜV) , lecturer and examiner at the Baden-Württemberg Cooperative State University Stuttgart (DHBW).
Private schools in particular have to comply with a wide range of specific legal requirements. For institutions that are affiliated with a church, the General Data Protection Regulation (GDPR) does not apply across the board. Instead, special data protection laws apply. This applies to private schools and other non-profit educational institutions, provided they belong to church-run or foundation-run organizations. This is because religious communities can independently regulate their constitutionally protected areas and independent responsibilities, as is the case for private schools run by Catholic or Protestant organizations, without state supervision. Independent laws have been passed for this purpose. On May 24, 2018, the Church Data Protection Act (KDG) of November 20, 2017, and the Church Data Protection Act of the Evangelical Church in Germany (EKD Data Protection Act – DSG-EKD) of November 15, 2017 (Data Protection Act of the Evangelical Church) were passed.
These special laws are responsible for the lawful implementation of data protection in church institutions. The data protection laws of the churches are very similar in many respects to the secular GDPR, which has been applicable since May 25, 2018; however, they also have various area/sector-specific features. This concerns both content-related regulatory and supervisory aspects of data protection law.
For example, Section 6 of the KDG on the “lawfulness of the processing of personal data” stipulates in paragraph 1 that the processing of personal data is only lawful if a) this law or another ecclesiastical or state legal provision permits or requires it.
Another example is the so-called media privilege of the church institution responsible within the scope of application of the KDG pursuant to Section 55 of the KDG. In journalistic and editorial reporting in the daily and trade press and in social media, images and films showing affected persons, including children, may be permissible. The diocesan data protection officers have stated that, when dealing with images of minors, blanket consent from the legal guardians is now sufficient; in some circumstances, even this is not necessary. In short: "Data protection officers now consider it permissible to obtain blanket consent from legal guardians for the publication of photos, for example for an entire school or kindergarten year or for specific events such as summer camps. Consent can be obtained at the time of registration or on the first day of school or kindergarten. This represents a change in the conference's previous position, according to which each individual image had to be approved by the legal guardians. (...) In addition to consent, the conference now also considers a balancing of interests to be a possible legal basis for the collection (photography) and publication of images.
This means that, under certain conditions, explicit consent from the legal guardians can be waived. On the basis of a weighing of interests between the institution and the persons depicted, images can thus be collected and published without the need to obtain consent. The resolution cites Section 23 of the German Art Copyright Act (Kunsturhebergesetz) as the criteria for this. (...)."
The media privilege under Section 55 KDG a complex legal positions due to the textbook-like balancing of various fundamental rights: The fundamental rights of communication and freedom of the press under Article 5 GG and the fundamental right to informational self-determination (personality, human dignity, Article 1, Article 2 GG) are to be granted equally. We lawyers resolve this through practical concordance. It follows that, due to media privilege, the individual rights of those affected under Sections 14 ff. KDG can, at best, only be asserted to a limited extent.
Jordan & Wagner Rechtsanwälte mbH provides clarification on the relevant data protection rules of special data protection and church law and helps affected institutions and their business partners to understand and implement them. For example, we are external data protection officers for various private, ecclesiastical, and secular (non-profit) institutions and foundation organizations, including in the school and university sector.
