Schrems II delays DNP even further

– When the ruling on Schrems 2 came down in the EU court, the legal terms for digital national exams changed, meaning they would be delayed, says Eva Westberg, chief legal officer at the Swedish National Agency for Education.

The Schrems II ruling was issued in June 2020. Why was the decision not issued sooner?

– There have been a lot of negotiations with our suppliers to resolve the situation. We have now received a new offer from the supplier we will be working with in the future, says Eva Westberg.

More specifically, the Swedish National Agency for Education has made an assessment that changes are required in both the operation and support of the cloud service to be used. Test bench supplier Skolverket is based in Great Britain and operates in Australia. Therefore it must The Swedish National Agency for Education ensures that personal data can be processed within the EU/EEA area, or in Great Britain, but only on the condition that it has an appropriate level of protection, i.e. a sufficiently high level of protection in accordance with the GDPR. In this case, the country does not have to be part of the European Union or the European Economic Area, but is still approved to handle personal data.

GDPR and Schrems II

– If there is an appropriate decision, i.e. a decision indicating that the UK handles personal data in a GDPR-compliant way, the service provider can operate and support the trial platform there as well. But that decision will not come before this fall, which is why we have currently extended fall 2024 to fall 2025. This fall there will also be a more detailed timetable, says Marcelo Marrone, director of the National Examinations Digitization Project at the National Council of Universities. education.

Marcelo Marrone believes the news is particularly sad for principals and schools who were ahead in their DNP preparations and who were eager to get started. However, he believes there is now additional time for preparations but the delay is no reason to slow down.

– We have seen that there are schools and principals who would welcome more time to prepare, both at a technical and organizational level. These schools, as well as those that are far ahead, now have a good chance of being truly ready when the time comes to implement the DNP.

How will this decision affect other systems in the school that also store data in cloud services?

– I can't really answer that. At the Swedish National Agency for Education, we are fully focused on developing a testing platform for 1 million users per year that is GDPR compliant. Having said that, we don't want to point fingers, we are not a spokesperson trying to define how all schools should do in their day to day operations. It is the responsibility of every school or school administrator to manage their own systems when they are data controllers, says Marcelo Marrone.

How does work continue?

– In addition to the adequacy decision in the autumn, we must also complete a consequence assessment in consultation with the privacy watchdog, IMY, which will provide a statement on the preventive measures we, together with our suppliers, can take to reduce the risks. Maybe they see something we didn't think of, or that everything is fine. In any case, we want to take our responsibility to ensure everything is handled correctly, says Marcelo Marrone.