Recommendations
The provision that stipulates that the Secondary School collects, processes, keeps, sends and uses personal data contained in the personal data collections for the needs of the integrated data base kept by the Ministry of Education is not clear. It should be defined where the data can be sent and under what circumstances.
According the Law on Secondary Education consent of the data subject is not envisaged for the categories of personal data which are collected in practice. The electronic Register contains health data, blood type, UPBN of the parent and for all those data the consent should be envisaged by law. Access to this data should be also regulated in the software.
Keeping period of personal data should be defined for every personal data collection well as inserting provision for personal data protection as it is done in the Law on Primary Education.