English · Slovenščina · Hrvatski
Data protection impact assessment - template
Wise Ed, module Third-party access (guardians, payers, sponsors). For the school's data protection officer, to complete, decide on and keep. Prepared by Wise Technologies as a starting point; it is not legal advice.
The module is off by default; a school switches it on. Before it is switched on, the school decides whether a DPIA is required (GDPR Article 35) - processing data about students under 18, sharing study results and invoices with third parties, and keeping a record of views usually points that way. This page describes what the software does; the grey fields are the school's.
1. The assessment
| Controller (the school) | |
|---|---|
| Data protection officer | |
| Assessment made by, on | |
| Processor | Wise Technologies d.o.o., Ljubljana, Slovenia (hosting and operation of Wise Ed) - under the existing data processing agreement: |
| Review due | (and whenever the settings below change) |
2. What the processing is
Purposes
- A guardian of a student under the age of majority sees the parts of the student's school data the school has decided to show (timetable, exams, grades and progress, attendance, announcements, invoices, conversations with the class teacher).
- A payer (a company or a person who pays the student's fees) sees the invoices addressed to it, with the payment slip, the status and the reminders - and receives one collective invoice for several students.
- An adult student chooses, person by person and part by part, what a parent, a payer or a sponsor sees, and can withdraw it at any time with immediate effect.
Data subjects
Students (including students of 16 and 17 where the school enrols them); the third parties themselves (guardians, the contact persons of payers and sponsors).
Data
| About the third party | name, e-mail address (how they sign in), phone, language, the kind of link (guardian, payer, sponsor), the relation, the payer in Finance it pays as, sign-in devices and one-time codes. |
|---|---|
| About the student, shown per part ("scope") | timetable; exam dates and registrations; grades and progress toward the degree; attendance and absences; the school's announcements; invoices and payment slips; for a minor's guardian only, conversations with the class teacher. |
| Never shown to a third party | adjustments (accommodations) and anything about health; requests and their documents; the student's own messages; for a payer or sponsor, conversations. |
| Grants | which scope the student granted to whom, when, and when it was withdrawn. |
| View log | one row per link, scope and day on which the third party opened that part (not per click). The student sees it for the last 12 months; the third party is told on their page that their views are recorded and the student can see them. |
Recipients
The third parties, through the parent portal (/a/parent) of the school's web; the school's staff with the roles that open the module's screens; Wise Technologies as processor.
3. Lawful basis
| Who sees | Basis the school relies on (to confirm) |
|---|---|
| Guardian of a minor | The school's statutory task or legitimate interest under national law: . Parental care ends at 18 in Slovenia, Croatia, Serbia and Bosnia and Herzegovina, and no law there gives a parent a 16- or 17-year-old's higher-education data - so the module shows a minor's guardians nothing until the school ticks what to show. |
| Anybody, for an adult student | The student's consent (Articles 6(1)(a) and 7), per person and per scope, withdrawable at once. A guardian the school links with a written legal reason (a court-appointed guardian) is the exception; the reason is logged. |
| Payer, for invoices addressed to it | Contract or legitimate interest of the payer and the school (Article 6(1)(b) or (f)): . Anything beyond those invoices needs the student's consent. |
| Sponsor | The student's consent only. The student's screen says the choice is theirs and the school does not require it - consent is not a condition of study (Article 7(4)). |
4. Necessity and proportionality
- Minimisation by scope: a third party sees only the parts granted or set; a payer only invoices addressed to it.
- Defaults: the module off; the portal off; the minors' scopes empty.
- Coming of age: when a student reaches the age of majority, every guardian link stops showing anything until the student keeps, narrows or ends it.
- Collective invoices: a line that would reveal a status (financial aid for a status, a waiver) reads as a plain "reduction" on an invoice addressed to a payer.
- Transparency: the student sees who looked at what and when; the third party is told their views are recorded.
- Retention: the view log is kept for the number of days set in the module's settings ( days; the default is three years, 1095 days); grants and links stay as long as the student's record, ended ones as history: .
5. Risks and measures
| Risk | Measures in the software | Likelihood / severity after them (school) |
|---|---|---|
| Somebody reads another family's data | Sign-in by a one-time e-mail code or the school's invitation code; revocable device credentials; every read goes through one check that answers "not found" for anybody else's link. | |
| A third party sees more than the student wants | Per-scope grants, effective at once; nothing shared until the student shares it; the student can end a link. | |
| Pressure on a student to share (a sponsor, an employer) | The grant screen states the choice is the student's and not required by the school; withdrawal is one tap and is not shown to the sponsor as a reason. | |
| Special-category data reaches a third party | Adjustments, health entries, requests and documents are never a scope; status-revealing reductions are anonymised on payer invoices. | |
| A parent keeps access after the student comes of age | The link sees nothing from the day of majority until the student answers; the student is told. | |
| Wrong person linked by the office | The office is asked before a link waits for an adult's consent and before a payer link names a payer that is not on the student's account; every change is logged. | |
| The view log is kept too long | Retention is a setting; older rows are deleted. |
Further risks the school sees and its measures:
6. Settings the school decides before switching the module on
- Age of majority (empty = the country's):
- What a guardian of a student under age sees (empty by default):
- Days the view log is kept:
- Who in the office may open the module's screens (roles):
- How students, guardians, payers and sponsors are informed (Articles 13 and 14):
7. Outcome
| Residual risk | |
|---|---|
| Prior consultation with the supervisory authority needed (Article 36)? | |
| Data protection officer's opinion | |
| Decision, by, on |