Schrems II increases DNP delay

– When the Schrems II ruling was issued in the European Court of Justice, the legal requirements for digital national tests changed, meaning they will be postponed, says Eva Westberg, General Counsel at the National Education Agency.

The Sherims 2 ruling was issued in June 2020. Why was the decision not made earlier?

– There was a lot of negotiations with our supplier to resolve the situation. We have now received a new offer from the supplier that we will work with in the future, says Eva Westberg.

More specifically, the National Agency for Education has assessed that changes are required in both the operation and support of the cloud service to be used. The testing platform supplier of the Swedish National Education Agency is located in the United Kingdom and operates in Australia. So you must The National Education Agency ensures that personal data can be handled within the EU / EEA region, instead of in the UK, but only on condition that they have an adequate level of protection, i.e. a sufficiently high level of protection according to the General Data Protection Regulation (GDPR). In this case, the country does not need to be a member of the European Union or the European Economic Area, but is still certified to handle personal data.

General Data Protection Regulation (GDPR) and Schrems II

– If there is an adequate decision, any decision indicating that the UK is handling personal data in a manner that is compliant with the GDPR, the supplier can operate and support the testing platform there as well. But that decision won’t come until this fall, which is why we currently have the range from fall 2024 to fall 2025. This fall will also see a more detailed schedule, says Marcelo Maroni, director of the National Tests Digitization Project at the National Education Agency.

Marcello Marrone believes the message is very sad for the school and school principals who have been far ahead of the preparations for DNP and who have been eager to get started. But he believes there is now more time to prepare, but the delay is not a reason for a slowdown.

– We have seen that there are schools and principals who would welcome more time to prepare, both technical and organizational. These schools, but also the ones that have progressed a lot, now have a good chance of being really ready when the time for DNP comes.

How will this decision affect other systems in the school that also store data in cloud services?

– I can’t really answer that. At the National Education Agency, we are fully focused on developing a testing platform for the 1 million users annually who have compliance with the General Data Protection Regulation (GDPR). However, we do not want to point a whole hand, we are not a spokesperson trying to say how all schools should do in their daily activities. Marcelo Maroni says it is the responsibility of every principal or school to manage their own systems when responsible for personal data.

How does work continue?

– In addition to the suitability decision this fall, we will also complete an impact assessment in consultation with the privacy protection agency, IMY, which will provide an opinion on the safeguards measures we, along with our suppliers, can take to reduce risk. They might see something that we didn’t think of, or it could be all right. In any case, we want to take our responsibility to ensure everything is handled properly, says Marcelo Maroni.