Suggestions regarding the protection of personal data in online education during the COVID-19 pandemic process

The online education process in all primary and secondary as well as undergraduate and graduate education institutions during the pandemic process has brought along some questions and problems for students, teachers and academics. Teachers and academics have to be part of the online system established by the Ministry of Education and the universities in order to share documents and videos online with their students. Managers and administrations even sometimes apply pressure on them regarding uploading documents, information and videos to the system in certain periods. Hence, many questions and anxiety came up for teachers and academics regarding how the copyrights of shared documents and articles will be protected, how reliable the system in which they have to register is, how personal data will be protected, and how they will protect themselves in the case that the video conferences with students and the uploaded videos to the system are shared for commercial purposes and on commercial platforms.

In this regard, as the Alternative Informatics Association, we will try to give some suggestions and advices which are open to other suggestions, improvement and transformation.

Regarding the documents and articles that you have shared with your students, we think that “access to information is a fundamental right”. Therefore, access to sources such as lecture notes, articles, videos etc. should not be restricted.

In accordance with the Law on Intellectual and Artistic Works, you will already own the copyright of the articles and documents written by you in case of plagiarism and citation, since you own the originals of them.

However, in case you want to prevent attainment of commercial income and sharing on commercial platforms, you can get various open source licenses for your documents and videos. You can get information on this matter on http://ozgurlisanslar.org.tr/.

In case that you are concerned about the protection of personal data:
Videos and photographs that you upload to the system are personal data accordance to the Personal Data Protection Law. During the pandemic process, it is possible that personal data are recorded for the purpose of public welfare in the field of public health or in order to protect vital interests. However, the protection of personal data that you have shared both with the university and students has not been suspended and they are still under protection. The Personal Data Protection Authority in Turkey has published a statement on this matter https://www.kvkk.gov.tr/Icerik/6721/KAMUOYU-DUYURUSU-Covid-19-ile-Mucadele-Surecinde-Kisisel-Verilerin-Korunmasi-Kanunu-Kapsaminda-Bilinmesi-Gerekenler-

Moreover, the European Data Protection Board (EDPB) established within the context of the recently updated legislation (GDPR) has published a statement on the international legislation on personal data protection.
https://edpb.europa.eu/news/news/2020/statement-edpb-chair-processing-personal-data-context-covid-19-outbreak_en)

In this regard, all states, institutions and organizations should respect human rights while using digital surveillance technologies during the fight against pandemic. Regarding this matter, you can take a look at the text, of which we are a signatory, published by EDRi: https://edri.org/wp-content/uploads/2020/04/Joint-statement-COVID-19-and-surveillance-FINAL1.pdf

On the other hand, in accordance with Article 5 entitled “Conditions of personal data processing” of the Personal Data Protection Law, the Ministry of Education and universities cannot process personal data without the explicit consent of the respective person regarding videos and photographs uploaded to the system.

However, in case that “it is compulsory for the protection of the life or bodily integrity of someone else” and/or “data processing is compulsory for the establishment, use or protection of a right or for the legitimate interest of the data controller on the condition that it does not violate the fundamental rights and freedoms of the respective person”, personal data can be processed without the explicit consent of the respective person. When the relevant provision is evaluated under the light of the Covid-19 pandemic and its results, the documents and information, videos and photographs and the recording of the IP numbers of the respective person can be processed without their explicit consent.

However, the disclosure requirement for universities and other institutions as data controllers continues. Therefore, there is the disclosure requirement concerning employees, namely, teachers and academics, as it is specified in Article 10 of the Personal Data Protection Law. While acquiring personal data, the data controller (of universities or other institutions) or the authorized person is obliged to inform respective persons (teachers and academics) on;

(i) the identity of the data controller and its representative, if any,
(ii) the purpose for which personal data are processed,
(iii) to whom and for which purpose processed personal data can be transferred,
(iv) the method and legal reason of personal data collection,
(v) and other rights of the respective person.

In this regard, universities and other institutions have to prepare a disclosure text and an explicit consent text.

The compulsory transition to distance education due to public health does not remove all legal obligations of universities, institutions and organizations as data controllers. In accordance with Article 12 of the Personal Data Protection Law, the data controller has to take all kinds of technical and administrative measures which are necessary for providing the proper safety level for the purpose of;

a) preventing the illegitimate processing of personal data,
b) preventing the illegitimate access of personal data,
c) ensuring the preservation of personal data.

Therefore, it has to aim at the anonymous processing of the information and data uploaded to the system. (The data should be processed on the condition that they are collected in a way that personal data cannot be recovered.) The disclosure text should clearly state that they will be only kept throughout the Covid-19 period, and specify where and how they will be kept, whose access will be allowed and the conditions of transfer to third persons.

In case that images and photographs in the videos uploaded by you are shared by your students on social media and other platforms against your will, criminal and legal liabilities will arise for students as well in terms of Articles 135-140 of the Turkish Penal Code and the Personal Data Protection Law.

In this regard, universities and institutions as data controllers should publish a separate disclosure text and warning for students.

Alternative Informatics Association, April, 6, 2020