For example, if a sixteen- or seventeen-year-old vocational student is sick at home for a few days and consequently misses classes, Van Erp gives as example. "According to compulsory education law, that student must disclose what ails them, whether it's the flu, a broken leg, or a mental disorder, to avoid prosecution by the attendance officer." However, Van Erp continues, registering the nature of the illness in these cases in vocational education is in conflict with privacy law. "Moreover, we should question whether it is desirable for an educational institution to inquire about the nature of the illness in case of short absences, while we find it undesirable as employees of an employer."
Van Erp analyzed the current educational laws in vocational education and compared them with the GDPR. She looked at data processing related to enrollment and student attendance, among other things. The reason was a case at a vocational education institution. They wondered if they were allowed to share a progress report about a student with parents, or if that would violate the GDPR.
Van Erp's research shows that legislation is unclear on various points. This can lead to arbitrariness: data may be processed differently in Groningen than in Nijmegen. "It's not a pleasant message that your institution may be acting in violation of a law," says Van Erp. "But the regulations are (too) complicated. Outdated educational laws need to be critically examined in relation to strict privacy laws." Van Erp developed a step-by-step plan for vocational education institutions to help them assess when they may register and share data.