Dirección General de Innovación y Formación del Profesorado

What happened

The DPA held that the Ministry of Education and Sports of Andalusia’s provision of cloud-based educational services to public schools violated GDPR provisions relating to transparency, privacy by design, international data transfers and DPIA duties. The Ministry used Microsoft as a processor for this activity.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(a) · 5(1)(b)Read →
• Art. 6Lawfulness of processingRead →
• Art. 13Information to be provided where personal data are collected from the data subjectRead →
• Art. 25Data protection by design and by defaultRead →
• Art. 30Records of processing activitiesRead →
• Art. 32Security of processingRead →
• Art. 35Data protection impact assessmentRead →

• Accountability
• DPIA
• Data principles
• Data security
• Transparency
• Unlawful processing