Data Protection and Education: the INEP’s issue

Children’s data protection and access to information are at the core of a recent controversy involving INEP, the Brazilian official body to research on education. The issue of access to school census and Brazilian students’ data (mostly minors) was even included in a draft bill. What are the equation’s elements for the protection of personal data and the information about Brazilian education? What needs to be taken regarding personal data of minors?

The INEP’s microdata issue

INEP is the educational research body  from the Ministry of Education in Brazil. As such, it is responsible for research on education, data, statistics and indicators provision, that serve different sectors of society, among other responsibilities. INEP information is crucial for diagnosis, evaluation, design and execution of public policies, studies, guidelines, among other instruments related to education, whose importance is undeniable.

The availability of INEP data also involves microdata which, in turn, includes personal data, such as age, race and date of birth. The volume of this data is enormous, considering the Brazilian population. At the same time, the various possibilities for processing personal data, increasingly refined by technological advances, increase what can be done with this microdata – whether these uses are legitimate or not. In addition, the entry into force of the General Data Protection Law (LGPD) represents major challenges in terms of adequacy, especially for public bodies, which do not have the same resources as the private sector, for example.

In this context, an analysis developed by the Federal University of Minas Gerais (UFMG) pointed out that the way INEP publicized the microdata, despite being, in theory, pseudonymized, led to very high chances of re-identification. Among the results of the study, some databases had a risk of up to 87% chance of identifying the personal data owner. Considered the LGPD applicability to data of identified or identifiable natural persons; the technical infeasibility of guaranteeing, until now, the effective anonymization; the compliance with the personal data protection regime; the ethical and methodological requirements of statistical research with human beings; in addition to the high risk that identification can mean for individuals, INEP chose not to make microdata available.

Especially in recent years, the widespread practice of the Brazilian government has been contrary to scientific evidence, even denialist in different spheres – including the most essential ones, such as public health. In this case, however, the opposite happened: the INEP acted in accordance with the technical recommendations for the protection of the personal data processed by the Institute. It also complied with evidence on the very high risks of identification for data subjects, including children, whose personal data, under the LGPD and the full protection established by the Brazilian Children Statute, must follow a regime even more protective and secure.

Avoiding the identification possibility becomes an even more important goal when we think about the high rates of violence against children in the country. An even greater effort must be made to ensure that, for example, minors who are under the witness protection system, who have protective measures, are threatened or harassed, may be victims of abuse and exploitation are not identifiable. Another risk involves the possibility of further discrimination from undue access to the school persons to their performance. In cases like this, irreversible damage could be done. In addition to the technical effectiveness of anonymization and the application of the LGPD, the issue involves the protection especially of childrens, who must be fully protected by the whole of society, under the terms of the Constitution.

Access to information is also necessary

Due to the role that INEP’s data and information have for educational policies and the control, by society, of education in the country, there were many reactions against the Institute’s decision. Specifically, the draft bill 454/22 sought, at first, to rule out the application of several LGPD guarantees, so that the data could be disclosed. The need for information on education for its advancement is undeniable. Likewise, access to information cannot be suppressed from citizens, nor can the LGPD be used as a shield against the transparency that must be demanded from the government. In this sense, the intention of the draft bill 454 can be understood as legitimate, but mistaken. As pointed out by the Rights on the Network Coalition, the unavailability has a technical, not normative, justification. The initial proposal of the draft bill weakened the protection of personal data in Brazil, which still has a long way to go. More than that, changes in the LGPD represent severe blows to the data protection system in Brazil, which is still at such an early stage of implementation. Therefore, the changes offered by the PL 454/22 report, which eliminated the proposed amendment to the LGPD, already represent advances, but must still be monitored.

Data protection in education is key

The movement on the issue and the concern with the protection of personal data, notably of children in the Brazilian education system, without ignoring the importance of information for educational guidelines, has already led to changes in the initial proposal of the draft bill 454/22. In this sense, the established dialogue is welcome and very necessary in the search for parameters for transparency that make viable policies, research and effective controls over the education system in Brazil. This initiative, however, cannot rule out the protection of personal data, much less that of children.

The INEP issue involves technical parameters, the feasibility of anonymization and the recognition of technological development for the effective protection of personal data by public entities. It also includes important aspects for a key branch for the country, which is education. It is also an opportunity to recognize and put into practice the fundamental right character of personal data protection. Even more, as it involves an immense amount of data on children, the priority given to their protection, more than understandable, must be supported. In this sense, the debate to balance different demands must continue and mature in order to understand the protection of personal data as an essential element of transparency and the access to information.