Finnish Data Protection Authority held that school data serve teaching only
The decision of the Finnish Data Protection Authority of 4 September 2026 defines the limits of relying on Article 6(1)(c) GDPR in digital education; the full text of the decision in our Judykatura database is available at this link. The Authority confirmed that the statutory duty to provide education may constitute a legal basis for using electronic educational programmes, but only to the extent genuinely necessary for teaching.
The rest of this analysis, all theses and the full text of the ruling are available with an AKTUALNOŚCI PLUS subscription.
Find out how EU supervisory authorities, administrative and civil courts and the CJEU reason their decisions — and keep your organisation aligned with current case law.