Series on Data Protection and Corona – Part 7: Online Learning Tools and potential Data Protection Concerns

27. March 2020

In the process of the spreading COVID-19 pandemic, more and more schools are closing to keep the school staff and children safe. However, this results in the duty of the parents to keep their children educated and preserving their motivation to learn and study.

Online learning tools and platforms have seen a rise in the past few years, as the demand for additional learning rises, as well as the requirement for the schools and students to adapt to a digitalized process gains in importance. In the wake of the current spread of the Coronavirus, these tools may help parents brave the daunting task of suddenly being in charge of their children’s education.

However, it is important to keep in mind that with online learning tools also comes issues and challenges in regards to the protection of the personal data of the children. Not only are registration data a requirement for the use of the tools, in addition a lot of them need to collect the student’s learning data, e.g. learning time, evaluation of tasks or exams as well as social interactions if they are sharing it with, for example, their class.

In the following, we would like to shed some light on different data protection aspects and things to look out for, in two different constellations. On the one side, the use of independent third party apps or tools and on the other, tools procured or offered by the schools and teachers.

Independent Providers

In the case of independent third party providers, there is a big range of online learning tools available. Each of them has a different array of personal data they collect, and it is very important to read privacy notices if you do not want the personal data of your child potentially used for marketing purposes, or transferred to third countries.

The good thing in regards to third party learning tools is that in most cases, only the e-mail address is required for registration. That allows the option to leave the real names and information of your children blank, instead allowing for the use of pseudonyms to shield from potential unwanted data processing and keep anonymity.

Especially in regards to providers based in Germany, the data protection standards are quite high, and therefore pose less of a threat to the child’s personal data. However, even with high standards in their country of origin, there are tools like Studysmarter, which allow in their privacy notice (available in German) for the learning data of the users to be processed for the enhancement of the tool. Furthermore, many of these online learning tools use applications through Google or Facebook, which likely transfer their data to the USA, and thus might be accessible to the American government.

In most of the cases of third party online learning tools, the third parties are the controllers of the data collected. However, some tools like for example Antolin are processors due to the constellation of the platform’s setup. In such cases, the teacher acts as an admin for the students’ accounts, and keeps control of the data collected. That ensures an additional safeguard in the processing of the children’s personal data, since the teacher controls through instructions and customizable online classrooms what data is processed.


Opposed to the above, schools have increasingly started to develop and offer their own online learning tools, or collaborate with third parties to provide more individualized online learning options. This leads to the positive fact that, since the school is still the controller of the collected personal data, the same safeguards are in place as during a regular school attendance.

In Germany, in such a case the processing is based on the school’s institutional authority to provide education. Because of that, the legal grounds for the processing are Art.6 I lit.e GDPR, Art.6 III sentence 1 lit.b GDPR which refers to the respective state’s school laws and school data protection laws. Therefore, the data protection in such cases is bound to specialized legal obligations.

However, since the school and the teacher usually are the ones administrating their online learning platforms, there is less chance for the students to stay anonymous. In order to fulfil their educational duty and to grade or help the students in specific cases, the teacher needs to be able to identify each student and the class they belong in. Parents might have to keep an eye on the social exchange with classmates over these learning tools as well, since personal data, which is not necessary for the educational duties of the school, does not fall under their processing competence.

In that regard the Datenschutzkonferenz (DSK) in Germany has released an orientation guide on online learning tools that schools are recommended to follow in order to stay GDPR compliant. The guide touches in detail on the different aspects of the processing of students’ personal data, and gives pointers on how school are supposed to process personal data collected in online learning tools.

Overall, it is important for parents and children to be informed by the controller in the terms of Art.13 GDPR in order to be sure about the type of processing taking place, and make sure the necessary consent has been requested in case of profiling or marketing purposes.

Where possible, it is recommended to give the least amount of personal data required, especially if the online learning tool is not handled by the child’s school but rather by a third party provider. In addition, parents should look out for third country transfers, as the safeguards in other countries do not necessarily compare to the standards in their country of origin.

We also recommend keeping an eye on your child’s usage of the tool and monitoring their handling of their own personal data.

The series on data protection and corona will be continued with the last blogpost of the series on the subject of social assessment of the importance of data protection.

For more up-to-date information (in German) you are welcome to follow us on Twitter.

We wish you all the best, stay healthy and protect yourself and others.