The Personal Data Protection Authority found deficiencies and omissions in the protection and security of personal data in the Ministry of Education's "e-school" and "e-datacenter" information systems, which are processed by a private contractor, giving it a period of 6 months to comply with its recommendations.
The "e-school" system concerns the secretarial support of primary, secondary and technical-vocational education school units, and the "e-datacenter" system concerns the establishment of a central registry for the management of the data of the educational and administrative staff of the controller.
The shortcomings identified by the authority are related to the adequate documentation and systematic supervision of the security measures implemented, as well as to "user authentication and the management and support of systems", but also to the more general obligations it has under the law on the protection of personal data.
