The Commissioner for Information of Public Importance and Personal Data Protection conducted an extraordinary field supervision inspection on the implementation of the Law on Personal Data Protection (“Official Gazette of RS”, No. 87/2018) regarding the data processing of minors within the portal “Zdravitas” by the Ministry of Education as Data Controller.

In the procedure of extraordinary inspection supervision, it was established that the Ministry of Education and the Institute for the Evaluation of the Quality of Education and Upbringing, within the Strategy for the Development of Education and Upbringing in the Republic of Serbia until 2030 (“Official Gazette of the RS”, No. 63/21) and the accompanying Action Plan, developed the project Development and application of the software for monitoring the physical development and development of motor skills of primary and secondary school students. The project was launched on the Cooperation Agreement regarding the establishment of a platform for monitoring the students’ physical and motor status, within the framework of physical and health education classes, with the Office for IT and eGovernment which provides continuous technical support for the design, harmonization, development, and system functioning, while ensuring data protection, safety and security measures.

The aforementioned agreement more closely regulates the rights and obligations regarding the establishment and management of a software solution – an information system for recording and monitoring the physical and motor status of students within the framework of physical and health education classes, by which the Office was obligated by the Ministry, for the purpose of establishment of the portal ” Zdravitas”, to procure and implement software (administrative and user software); provide the necessary infrastructure and resources for the system operation, ensure the necessary integrations of the “Zdravitas” system with a single sign-on (single sign-on system available at eid.gov.rs); provide continuous technical support for the functioning of the “Zdravitas” portal with complying data protection provisions, safety and security measures, in accordance with the regulations governing Electronic Administration and Information Security, as well as to sign a contract on personal data processing, where the Ministry of Education was to draw up and submit to the Office’s signature the Agreement on Personal Data Processing in accordance with Article 45 of the LPDP and the Decision on Establishing Standard Contractual Clauses (“Official Gazette of the RS”, No. 5/20), by which the Office is to take over the management and maintenance of the said information portal after the implementation of the software solution “Zdravitas”. A Personal Data Processing Agreement was concluded between the Ministry of Education and the Office for IT and eGovernment, regulating the relationship between the contracting parties in connection with the personal data processing activities entrusted to the Office by the Cooperation Agreement regarding the establishment of a platform for monitoring students’ physical and motor status.

During the inspection supervision proceeding, it was determined that the legal basis for the establishment of the “Zdravitas” portal is contained in Article 177, paragraph 1, point 3a) of the Law on the Fundamentals of the Education and Upbringing System (“Official Gazette of the RS”, No. 88/17, 27/18, 27/18, 10/19, 6/20, 129/21 and 92/23), which stipulates that the data for determining the students’ physical and motor status within the educational system, and gathered through the students’ physical and motor status monitoring system under the framework of physical and health education classes are to be entered in the register of children, students, adults, and students.

Monitoring the development of physical and motor skills of students is determined through the teaching programs within the scope of Physical and Health Education subject, namely:

• Rulebook on the teaching and learning plan for the first cycle of primary education and upbringing and the teaching and learning program for the first grade of primary education and upbringing (“Official Gazette of the RS – Educational Gazette”, no. 10/17, 12/18, 15/18, 18 /18, 1/19, 2/20, 16/22, 1/23 (correction), 13/23, 14/23 and 11/24);
• Rulebook on the teaching and learning program for the second grade of primary education and upbringing (“Official Gazette of RS – Education Gazette”, no. 16/18, 3/19, 5/21, and 13/23);
• Rulebook on the teaching and learning program for the third grade of primary education (“Official Gazette of the RS – Education Gazette”, no. 5/19, 1/20, 6/20, 7/22, and 13/23);
• Rulebook on the teaching and learning program for the fourth grade of primary education (“Official Gazette of the RS – Education Gazette”, no. 11/19, 6/20, 7/21, 1/23, and 13/23);
• Rulebook on the teaching and learning plan for the fifth and sixth grade of primary education and upbringing and the teaching and learning program for the fifth and sixth grade of primary education and upbringing (“Official Gazette of RS – Education Gazette”, no. 15/18, 18/18, 3 /19, 3/20, 6/20, 17/21, 16/22, 13/23, and 14/23);
• Rulebook on the teaching and learning program for the seventh grade of primary education (“Official Gazette of the RS – Education Gazette”, no. 5/19, 1/20, 6/20, 8/20, 5/21, 17/21, 16 /22, 13/23, and 14/23);
• Rulebook on the teaching and learning plan for the seventh and eighth grade of primary education (“Official Gazette of the RS – Education Gazette”, no. 18/18, 13/23);
• Rulebook on the plan and program of teaching and learning for high school (“Official Gazette of the RS – Educational Gazette”, no. 4/20, 12/20, 15/20, 1/21, 3/21, 7/21, 14/23);
• Rulebook on the teaching and learning program of general education subjects in vocational schools (“Official Gazette of the RS – Educational Gazette”, no. 7/13 and 14/23);
• Rulebook on the plan and program of gymnasium teaching and learning for students with special sports skills (“Official Gazette of the RS – Education Gazette”, number 11/13);

Monitoring, evaluation, and recording of students’ physical abilities is carried out and based on the Manual for monitoring the students’ motor skills and physical development within the framework of physical and health education classes, which are available on the official websites of the Institute for the Evaluation of the Quality of Education and Upbringing and the Institute for the Improvement of Education and Upbringing;

In the inspection supervision proceeding, it was determined that the purpose of data processing is determined in Article 181, paragraphs 1 and 2 of the Law on the Fundamentals of the Education and Upbringing System. On the “Zdravitas” portal, the following student data are being processed: first name, last name, name of one parent (legal representative), JMBG (Unique Master Citizen Number), JOB (Unique Educational Number), date, place, and the municipality of birth, gender, body height, mass, body mass index (body fat within the body composition), running for 20m with a progressive increase in speed, sit and reach flexibility test, 30 seconds sit to stand test, long jump, pull-up hold, and speed cones 4x10m running, following the said regulations on the teaching and learning program within the subject of Physical and Health Education and manuals for monitoring the students motor skills and physical development, and that the Portal does not process data on the students’ health status. The “Zdravitas” portal will contain data from the records that schools already maintain as part of Physical and Health Education.

Students’ personal data on the user part of the portal will be in the form of reports on motor skills and physical development and will be accessible only to parents or legal representatives of students who are authorized. If parents/legal representatives are not authorized users of the portal, the said data could also be downloaded from the competent teacher at the school.

In addition to the administrator, the data in the administrative part of the portal can only be accessed by the authorized user, i.e. the school director, school employees – an authorized person designated by the school director, form teacher, primary teacher, and physical and health education teacher for the students for whom they are responsible.

Before establishing the portal, the Data Controller assessed the impact of the planned processing actions on personal data protection and undertook technical, organizational, and personnel measures, to achieve the appropriate level of data security regarding the risk. Also, the Data Controller created an application form to obtain parameters (username and password) for accessing the user part of the “Zdravitas” portal. Upon supervision inspection of the said form, it was determined that to obtain access parameters, the entry of the following personal data is required:

• for the student: first and last name, class, and name of the school;
• for the parent/legal representative: name, surname, unique master citizen number (JMBG), e-mail address, and signature of legal representative.

Based on the factual situation, it was determined that the Ministry of Education processes data under Article 12 of the LPDP, and the data subject’s consent is not required for the processing in question.