The situation
While preparing the annual accreditation, your school’s management team does a simple inventory: where does students’ information live? The result surprises everyone. The lists with families’ names, addresses and phone numbers are on each teacher’s personal phone, forwarded over WhatsApp from the school office. The photos of school activities — hundreds of them, with students’ faces — are kept in the personal galleries of whoever took them, and some were posted on teachers’ personal accounts. A teacher who left last year presumably still holds all those files. There is no consent from families for the use of images, and no protocol saying what is kept, where, who has access and what is deleted when someone leaves. None of this was done with bad intent. It all works — until the day something goes wrong.
◆ The comment on each course of action is generated by AI from this section’s legal framework, whose official texts are in Spanish. It orients you; always verify the article in the legal framework.
For whoever facilitates
Facilitator’s notes
The inventory this school carried out is the first step almost nobody takes, and what it found has a legal name. Collecting, keeping or disclosing another person’s personal data by automated means, intentionally and without their consent, is a criminal offence, and the negligent form is punished with a fine (Art. 198 and Párrafo I, Ley 74-25); the legal person may also be liable, under the conditions of Arts. 8 to 11, whose entry into force is deferred (Art. 199, Ley 74-25; Art. 31, Ley 44-26). The practice this school describes is not, in itself, that offence — the intent is missing; what it does is leave the school and every teacher a single incident away from it. Disclosing the image of a child or adolescent in a way that affects or stigmatises them is an aggravated attack on privacy (Art. 186, Ley 74-25); the student’s image and identity are protected rights (Art. 12, Ley 136-03 — the Code for the Protection of Children and Adolescents); and the Código de Ética (the MINERD code of ethics) already prohibits using social media and technological tools for any purpose other than academic formation (Art. 10 b, Orden Departamental 22/2023) and requires that, for formative purposes, staff do not deal with a student individually, but in group meetings or with their guardians present (Art. 13 b, Orden Departamental 22/2023). That information should also live in an institutional channel rather than on each person’s phone is a good practice the school should adopt, not an express mandate of that rule. Option a is the complete institutional answer: it turns a culture of good faith into a system with rules — and option d is in fact its urgent first chapter, because the files outside the school are the most live risk. Option b protects by stopping everything, but blanket bans do not last: with no institutional alternative, the informal practice returns within weeks. Option c is the most tempting and the most fragile: “nobody has complained” is not a protocol, and a circular without a system shifts the risk onto each teacher’s individual judgement. Question for the group: if a family asked tomorrow for all the photos and data the school holds on their child, could we answer them — and in how many phones would we have to look?
The team’s commentary
Two readings of this scenario
Español — The Spanish version is the reference text — the legal verification described in the audit report was carried out on it.
Audit report — the independent legal review of this material, with the errors we found and corrected (page in Spanish).
Comprehensive AI learning designed for educators, by educators. From awareness to mastery.