School does not have to delete personal data of former student

The right to be forgotten is not absolute: if you have a legal obligation to retain data, you are not required to delete it in response to a request for removal. For example, a primary school was permitted to retain the socio-emotional report of a former pupil, because the law requires schools to maintain a student tracking system and an educational report. However, you must always respond to such a request and explain why you were unaware of the information.

A conflict arose between the parents of a student and a primary school regarding a teacher's findings. The parents wanted to enroll their child elsewhere, but the new school refused after reading the Zien! report from the old school. The parents asked the old school to delete the data — but the judge ruled that this was not required.

Processing of personal data by schools

With the Zien! report, schools map the social-emotional functioning of students through observations, along seven dimensions (well-being and engagement, linked to empathy, social initiative, social flexibility, social autonomy, and impulse control). This data is stored in the ParnasSys Zien! system.

The right to be forgotten

The parents filed a request for removal based on the right to be forgotten. This obliges an organization to erase personal data if there is no longer a good reason to process it — for example, if consent is withdrawn or the retention period expires. The school did not comply with the request, after which the parents went to court and demanded the removal of the entire report, meeting notes, and annotations.

The school must store the data correctly

The court (ECLI:NL:RBOBR:2021:5776) assessed whether the school was permitted to process the data and whether it still had a sufficient interest in doing so. In doing so, Article 8, paragraph 6 of the Primary Education Act (Wpo), which obliges schools to use a student and education monitoring system, was taken into account. This is a legal basis that justifies schools maintaining reports in the Zien! system. The data forms part of the educational report, which schools must retain for a statutory retention period. The former school was therefore permitted to retain the data.

Do not delete immediately with every request

The case shows that you do not automatically have to press the delete button with every removal request. If you are legally obliged to retain data, you may not simply erase it. Data may also still be needed, for example, to collect outstanding invoices. You are, however, obliged to respond to the request: if you do not delete certain data, you must explain why. If you are required to delete, it may be necessary to ask other organizations with whom you shared the data to delete every copy.

Frequently Asked Questions

Do I always have to delete personal data upon request?

No. The right to be forgotten is not absolute. In the event of a statutory retention obligation, or if the data is still needed (such as for outstanding invoices), you are not required to delete.

Do I have to respond to a removal request?

Yes, always. If you did not delete certain data, you must explain why. If you are required to delete, you may also ask recipients of the data to delete their copies.

Why was the school allowed to keep the data?

Because the Wpo requires schools to maintain and retain a student tracking system and an educational report. That legal obligation takes precedence over the request for expulsion.

Questions about the right to be forgotten?

The privacy lawyers at MKB Juristen advise you on which data you must or may retain and how to respond to requests. View our expertise in privacy and data protection or schedule an intake meeting .