0

I'm writing some software for use in a school. An essential function of the software is to email students using their school provided email account.

My question is, does GDPR apply to the storage and processing of solely student email addresses?

The email addresses are of the format <student-id>@<schooldomain>.sch.uk.

I will not be storing any PII that can link the email address to any particular individual, further than their student ID number, and this will be accessible only to individuals (teachers) who already have access to full student records in other computer systems.

Improve this question

2 Answers 2

Reset to default
2

The email address is PII

1 student, 1 email address. The email address itself uniquely identifies someone so it's PII.

Improve this answer
2
  • Thanks, so I'll need to publish a privacy policy and some kind of opt-in? Given the students won't be registering themselves (it will be done by school staff), do you have any advice for how this should be approached?
    – Chris Pickford
    Commented Apr 3, 2020 at 13:07
  • a) the school should already have a privacy policy b) why would you need consent? If you do, the student has to give it, the teacher can’t do it by proxy.
    – Dale M ♦
    Commented Apr 3, 2020 at 21:02
1

I'm writing some software for use in a school.

... full student records in other computer systems.

does GDPR apply to the storage and processing of solely student email addresses?

The school has a range of computer systems, now including yours that processes email addresses only.

Even though your system does not by itself allow to identify persons by email address, the school (which is the data processor and controller here) easily can. GDPR applies to the storage and processing done by processor as a whole, not to individual system units within its infrastructure.

Surely, you won't be saying that GDPR applies to one table in the database but not the other? Same here, just slightly bigger scale.

Improve this answer
3
  • Thanks. I guess my understanding of the difference is that I'll be storing the email address data in my own database, rather than on-premise in the school. Does that mean that I will therefore be the data processor?
    – Chris Pickford
    Commented Apr 3, 2020 at 13:04
  • @ChrisPickford Yes – if the school wants you to process personal data on your behalf, they will likely have to engage you as a data processor, which involves a contract that must cover certain items per Art 28 GDPR. This means that you would be forbidden from using the data for your own purposes, but also simplifies your compliance: you don't have to be concerned with the legal basis for processing, and don't have to provide a privacy policy.
    – amon
    Commented Apr 5, 2020 at 8:52
  • @amon That's really helpful information. Thank you. I'll look into article 28.
    – Chris Pickford
    Commented Apr 5, 2020 at 14:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .