Informative notes from the education sector

In June 2025, the Spanish Agency for Data Protection (AEPD) sanctioned an educational center with €10,000 after a complaint was filed by the parents of a student. The reason was the creation of an institutional email account without a valid legal basis, as well as a lack of security measures, which caused a breach that led to the identity theft of the minor in Google Classroom.

Main events

The complaint was filed in July 2023. The parents reported that the center created an email account without consent, violating the principle of legality in data processing. During the investigation, the AEPD found that unauthorized access had been made to the student's Google Workspace profile, from which messages were sent in her name.

The Agency also detected deficiencies in the password system, which was generated in a poorly robust manner —from the student's initial and the mother's date of birth—and did not require users to change them after the first access. Furthermore, the center's privacy policy did not include the contact details of the Data Protection Officer (DPO), which hindered the exercise of the rights of the affected parties.

Violations of the GDPR

The AEPD concluded that the center violated:

• Article 6.1 – Legitimacy of processing: absence of valid consent from the parents.
• Article 13 – Transparency and information: omission of the DPO's contact details in the privacy policy.
• Article 32 – Security: serious deficiencies in the password system and security breach management.

Conclusion

Although the center implemented corrective measures later, such as internal training and updating its privacy policy, the AEPD emphasized that these actions do not eliminate the violations committed.

This resolution reminds us of the importance of strict compliance with the GDPR, especially when processing data of minors, which are considered particularly sensitive. The Agency insists that educational centers must guarantee valid legal bases, adequate security measures, and transparency, thereby reinforcing the protection of students' privacy in digital environments.

Download the full PDF document below.