From now on Dasaran.am to receive parents' consent prior to processing personal data of pupils

On 30 November 2018, Personal Data Protection Agency received an application from the "Freedom of Information Centre of Armenia" on checking the compliance of processing the personal data within "Dasaran" educational program being implemented by the "School of New Generation" NGO to the requirements of the Law of the Republic of Armenia "On the protection of personal data".

Within the framework of administrative proceedings instituted on the initiative of the Agency, inquiries were sent to a number of state and non-governmental bodies to clarify whether the data processed within "Dasaran" educational program are being sent to them.

The proceedings conducted by the Agency revealed that within the framework of "Dasaran" educational program, the "School of New Generation" NGO failed to provide any third party with personal data: analytical materials containing depersonalised data were provided to the Ministries of Science and Education of the Republic of Armenia and the Republic of Artsakh; moreover, personal data collected within the territory of the Republic of Armenia are only provided to the Ministry of Science and Education of the Republic of Armenia and personal data collected within the territory of the Republic of Artsakh are only provided to the Ministry of Science, Education and Sport of the Republic of Artsakh.

 As regards the fact of obtaining consent on the data processing, the Agency also sent several inquiries to the "School of New Generation" NGO for receiving information necessary in the proceedings, as a result, in the course of the proceedings, a section entitled "Personal data protection policy" was added in dasaran.am. website and prior to rendering a decision in the proceedings, the data processing within the framework of "Dasaran" educational program was brought in line with the Law of the Republic of Armenia "On the protection of personal data", which may be considered as one of important results recorded by the proceedings.

The proceedings also confirmed that "Dasaran" educational program applies sufficient physical, technical and organisational measures to protect users’ personal data from any unauthorised leakage, use, change and destruction.

Sample study conducted by the Agency showed that after adding the "Personal data protection policy" section, it is introduced both the new users of the website and already registered users of the website when they enter the section for the first time after adding the section.

 Thus, as a result of the proceedings, the Agency recorded that the data processing within the framework of "Dasaran" educational program is in line with the Law of the Republic of Armenia "On the protection of personal data". At the same time, taking into consideration the application of the "Freedom of Information Centre of Armenia" NGO and the materials submitted by it, as a result of the proceedings the Agency demanded from the "School of New Generation" NGO to ensure proper awareness (notification) of all users of dasaran.am with regard to obtaining the consent. In execution of the latter, the "School of New Generation" NGO informed by a letter sent to the Agency that they had ensured awareness (notification) of all users of dasaran.am with regard to the consent, in particular, within the framework of re-editing "Personal data protection policy", all users registered on the website and each newly registered user receive a notification, confirming their consent on personal data processing, only whereafter they receive permission to use the system.

One of the important results recorded under the proceedings is the co-operation between the Agency and the civil society in the field of protection of personal data, since, on the one hand, the "Freedom of Information Centre of Armenia" NGO used to keep the issue of protection of personal data in the centre of attention and informed the Agency, on the other hand, the "School of New Generation" NGO, not waiting for a decision to be rendered with regard to the proceedings, still in the course of the proceedings, improved its personal data processing policy and brought the personal data processing fully in line with the Law.