Irish schools breach GDPR rules regarding religious and nonreligious beliefs

Irish schools are breaching their obligations under GDPR and human rights law, in relation to the right of parents and students to not attend religious teaching and worship while not disclosing sensitive information.

Atheist Ireland has written to the Data Protection Commissioner, the Department of Education, and the ETBI about these concerns.

Schools have never taken on board the rights of parents under GDPR. There is no requirement, constitutional or otherwise, for any parent to disclose their religious or nonreligious beliefs to their school if they opt for their child to not attend religious teaching or worship.

Schools also have responsibilities in relation to the processing and sharing of personal data that has been obtained from parents and students to provide aggregated data to the Department of Education. Schools can not use this data for other purposes.

Despite this, both primary and second level schools routinely ask parents to meet them to discuss intrusive and personal questions about their reasons for wanting to opt their child out of such teaching.

Information about this sensitive data is kept on file and routinely shared with teachers, departments, and patron bodies. In some cases we have heard that the local priest is informed if a parent decides that they do not want their child to attend religious teaching.

Data Protection in ETB schools

In 2018 the Department of Education & Skills issued two Circular Letters in relation to Religion in ETB schools at second level. Circular Letter 0013/2018 was issued in February 2018. Circular Letter 0062/2018 was issued in October as a clarification of the earlier Circular.

In Circular Letter 0062/2018 the Department of Education and Skills referred to the GDPR requirements of ETB schools in relation to seeking information from parents or students about whether or not they are of any religion.

The Department of Education & Skills stated in Circular 0062/2018 that:

“5. GDPR requirements

GDPR places an increased emphasis on transparency, accountability, and security standards for personal data. Schools should note that the clarification in section 2 about the content and delivery of the Department-approved NCCA Religious Education syllabus means that there should be no requirement for the school to seek information from parents or students about whether or not they are of any religion, and in section 4 of this circular it is a matter for a parent to come forward where a school is proposing to offer religious instruction rather than the school seeking information from parents about their religion.”

The ETBs have not take on board the requirements of GDPR outlined in the Department of Education’s Circular Letter in October 2018, as their umbrella body ETBI (Education & Training Boards Ireland) has told them to maintain the status quo.

The ETBI issued an Overarching Statement to all ETBs (attached). It stated that:

“Until such time as the Core Value Review and consultations with the DES are complete, ETB schools should maintain the status-quo in relation to the provision of Religious Education and opting-out arrangements.”

This means that the Requirements of GDPR in relation to transparency, accountability and security standards for personal data have been put on hold while the ETBI carry out a Core Value Review. The requirements of GDPR take precedence over any Core Value Review and they should not have been put on hold.

In their statement the ETBI refer to Section 9(d) of the Education Act 1998 as the reason for keeping the status quo, and not implementing the Circular Letters issued by the Department of Education in 2018. Section 9(d) of the Education Act does not give the ETBI a legitimate reason to continue to seek or to keep on record without consent sensitive information about the religious or non religious beliefs of parents and students.

Section 9(d) of the Education Act obliges Boards of Management to use their available resources to promote the moral, spiritual, social and personal development of students and provide health education for them, in consultation with their parents. Consulting with parents means that sensitive information could be disclosed and processed as parents have a right to opt their children out of Relationship and Sexuality Education on the basis of conscience (Section 30 of the Education Act 1998). We believe that Section 9(d) of the Education Act further obliges the ETBs to implement GDPR regulations. It makes no sense to use this section of the Education Act as a reason to not implement them.

Data Protection in all schools

The Circular Letter issued by the Department of Education & Skills only discusses GDPR issues in relation to ETB schools. However, GDPR issues around transparency, accountability, and security standards for personal data should apply to all schools.

The Constitution (Article 44.2.4) and Education Act 1998 (Section 30.2(e)), recognise the right of students to not attend religious teaching in any publicly funded school. There is no legal requirement for any parent or student to reveal to schools/teachers what religion they are, if any, in order to exercise their Constitutional right to not attend religious teaching in publicly funded schools. This is a fundamental right (Article 10 of the Charter of Fundamental Rights) and also recognised by the European Convention (Article 9).

There is a link between GDPR and the European Convention. The European Court has said that individuals have a right not to be required to reveal their faith or religious beliefs, and also not to be compelled to assume a stance from which it may be inferred whether or not they have such beliefs in the education system (ECHR Grzelak v Poland June 2010, para 87).

Despite this, the vast majority of schools in Ireland have brought about a situation whereby parents and their children must reveal directly or indirectly to schools and teachers whether or not they are of any religion in order to exercise their Constitutional and Human right to not attend religious teaching.

Many schools have Religious Education Departments and Chaplains, and sensitive information is shared without any consideration given to GDPR or human rights. Some parents and children from minority religious backgrounds, especially those living in rural areas, do not want the school and teachers knowing and keeping a record that they do not belong to or do not believe in any particular religion, and that they do not belong to the religion of the majority.

Some parents have told us that when they enquire about not attending religious teaching, that they are called to a meeting in the school where their reasons for not attending religious teaching are discussed in detail, using intrusive and personal questions, in order to coerce them to permit their child to attend. The general view amongst parents and schools is that a reason must be given for not attending religious teaching.

There is no legitimate reason for any school to know or keep a record of the religion or beliefs of those families who exercise their fundamental right not to attend religious teaching or worship. Issues around consent in relation to this sensitive data are never given any consideration by schools and teachers are not trained to look at the right to not attend religious teaching in light of GDPR.

Conclusion

Irish schools are breaching their obligations under GDPR and human rights law, in relation to the right of parents and students to not attend religious teaching and worship while not disclosing sensitive information.

There is no requirement, constitutional or otherwise, for any parent to disclose their religious or nonreligious beliefs to their school if they opt for their child to not attend religious teaching or worship.

Schools also have responsibilities in relation to the processing and sharing of personal data that has been obtained from parents and students to provide aggregated data to the Department of Education. Schools can not use this data for other purposes.

Atheist Ireland has written to the Data Protection Commissioner, the Department of Education, and the ETBI about these concerns.