Autumn Cleaning in the Cloud: Are You Taking Care of Students' Digital Footprints?

When graduation season is over and students have started their summer holidays, one of the most complex tasks within school-administered IT comes to the fore: managing personal data that is no longer needed. Has your school remembered to delete the data of the students who have graduated this year?

Managing data erasure—or "purging" (gallring) as it is formally known—is in practice about complying with two legal requirements at the same time: the obligation to archive important records and the requirement to delete personal data that is no longer needed.

Finding that balance on your own can feel challenging, but Edudata is ready to assist you with the deletion process in compliance with current legal requirements.

Digital Pollution: An Invisible Risk

Many organizations today suffer from "data pollution". This is information that serves no purpose but remains stored anyway. This not only creates clutter and higher storage costs, but also poses a significant security risk. If a data breach occurs, the damage is substantially greater if you are storing personal data of students who no longer attend the school.

The Balancing Act Between GDPR and the Archives Act

In public sector operations, simply following the GDPR's principle of data minimization is not enough. The school system is governed by two conflicting requirements:

• National Archive Laws: In the Nordic region, the right to public records and historical documentation carries heavy weight. Here, we cannot just delete anything (such as grades).
• GDPR (General Data Protection Regulation): Requires personal data to be deleted as soon as the purpose of the processing has ceased. The "right to be forgotten" is central.

The challenge for school management is determining exactly when a piece of data transitions from being an active record to becoming either an archive object or "digital pollution" to be discarded.

Did you know? In Sweden and Norway, archive legislation takes precedence over GDPR regarding a public authority's obligation to preserve public records. This means that certain data (like grades) must be saved, while other data (like chat logs or drafts) must be deleted.

National Differences at a Glance

Even though GDPR is a shared requirement across the Nordics, national regulations for data purging look different:

• Sweden: The Archives Act governs, and purging requires local decisions; grades are preserved forever, while administrative data is often purged after two years in accordance with the Data Protection Act.
• Norway: The Archives Act (Arkivloven) requires the preservation of archive-worthy documents, but the Data Protection Authority (Datatilsynet) emphasizes that other data (files, logins) must be systematically deleted as soon as a student relationship ends.
• Finland: The Archives Act (Arkistolaki) and Data Protection Act (Tietosuojalaki) govern; deletion takes place according to an archive formation plan that specifies when data in school systems like Wilma must be destroyed.
• Denmark: The Archives Act (Arkivloven) means that digital data is often transferred to the National Archives (Rigsarkivet), which legally enables the school to then delete the information from its own systems.

Even if the processes look a little different (some delete entirely, others move to central archives), the goal is the same: the school should not be holding onto "data pollution" in its active systems after a student has left.

Edudata's Perspective

At Edudata, our mission is to simplify the school's digital everyday life. Are you unsure if your current structure meets legal requirements, or do you just want to brainstorm how you can reduce manual cleaning? Contact us at Edudata—we will gladly help you get your data flows in order, all the way from enrollment to graduation.