Een privacyrechtelijk perspectief op de (zieke) mbo-student

The digitization of education has advanced significantly. An institution cannot provide good education without processing personal data, including sharing the student’s data with third parties. Educational technology can be used for many purposes and can be acquired from many different commercial parties. However, what is technically possible does not always mean that it is permissible (the law) or desirable (ethics). The educational institution may not 'just‘ use – sometimes sensitive – personal data of a student. Student’s have data protection rights. This study focused on what is legally permissible. Secondary Vocational Education laws and regulations have been tested against the General Data Protection Regulation (GDPR) and the General Data Protection Regulation Implementation Act (UAVG). I investigated the conditions under which the funded Secondary Vocational Education institution may restrict the privacy of the (sick) student. In doing so, I used two perspectives, the internal processing by the institution and the external sharing of personal data with parents. This thesis consists of a collection of articles published between 2017 and 2021 (chapters 2 to 6). I added epilogues (paragraphs 2.10, 3.12, 4.7, 5.8 and 6.9) and an introduction (chapter 1), and concluded by answering the main and sub-questions, recommendations and concluding considerations (chapter 7). Section 7.4 also presents four categories of data processing that are not in line with the GDPR. Progressive insight is included in section 7.1. For the purpose of the readability of the thesis, it is good to first take note of this, in particular with regard to the lawfulness of processing (sections 7.1.1 and 7.1.2).