Comments by the President of the Personal Data Protection Office on the Proposed Amendments to the Education Law

The parliamentary draft amendment to the Education Act addressing the issue of electronic school records is vague and requires further clarification. Unfortunately, the proposed regulations do not resolve key issues. They are insufficient to establish a comprehensive legal framework for cybersecurity in the area of digital school records.

Mirosław Wróblewski, President of the Personal Data Protection Office, presented Dariusz Salomończyk, Deputy Chief of Staff of the Sejm of the Republic of Poland, with comments regarding the regulations that will govern the use of electronic school records.

The legislative proposal primarily involves changes related to the free provision of digital school records to students and their parents. The President of the Personal Data Protection Office stated that the draft is not comprehensive and maintains the current model, in which commercial entities serve as providers of digital school record systems. Most importantly—in the area of personal data protection—the draft regulation is also fragmented in nature.

In the supervisory authority’s view, the implementation of solutions that affect data processing in digital school records should be preceded by a regulatory impact assessment. Conducting a privacy test would help create a digital record-keeping system that is consistent, comprehensive, and compliant with the principles of personal data processing.

The President of the Personal Data Protection Office emphasised that laws governing education must satisfy two conditions simultaneously: processing necessary to fulfill a legal obligation incumbent upon the controller and to perform a task carried out in the public interest or in the exercise of official authority. Both of these conditions must be appropriately enshrined in the laws governing the field of education, including, first and foremost, the Education Act.

Regulations governing digital school records should also be reconsidered in light of cybersecurity challenges. The processing of personal data in such records—and on a nationwide scale—will be of immense importance from a security perspective. In the case of large digital platforms serving schools, consideration should be given to adopting solutions that ensure the security of personal data at a level commensurate with cyber threats. These could include appropriate IT security standards for ICT systems and a proper platform certification system guaranteed by public entities.

The solutions recommended in the supervisory authority’s opinion—regarding digital school records—should be comprehensive. Consideration should also be given to requiring data processors to obtain additional certification and to granting the competent minister the authority to maintain a public database of certified entities.

DPNT.401.429.2026