Where is our children's data?

Dear families,

When we leave our children at school, we trust that it is a safe space. We care about their physical, emotional, and academic well-being. However, there is an invisible but crucial aspect that we often overlook: the management of their private information in the digital environment.

Lately, the Department of Education (Conselleria) has been replacing public management systems and classroom tools in schools with platforms from large private companies (such as Microsoft 365 or tools controlled by subcontractors). This may be presented to us as a purely technical change or as something "more convenient," but it is a decision with deep implications.

And this is not an abstract concern: in July 2024, the Balearic educational management system (GestIB) suffered unauthorized access that exposed personal data of students and families, and the new tool replacing it, Llull, has been awarded to a private company for 5.4 million euros, with schools reporting failures since January.

Why should we care as families?

• It's not just grades: These systems do not only record grades and absences. They also store minutes from counseling meetings, psychological support interventions, or school bullying case files. Highly sensitive data of minors.
• Loss of control: By delegating the custody of this data to tech multinationals, our children's information falls under the umbrella of foreign laws (such as those of the US), which allow their authorities to demand access to the information and can also prohibit the company from notifying us.
• Opacity: No one from the outside can examine how these systems work or who accesses the data: neither the new Llull, developed by a private company without public transparency regarding its code, nor Microsoft's platforms, where not even the administration itself can verify what is done with our children's information. What cannot be audited cannot be monitored.

Our children are not customers; they are students in training. Their privacy and the safeguarding of their most personal records is a constitutional right that we must all defend collectively.

And alternatives already exist and work. The Community of Madrid has been serving its entire educational community for years with EducaMadrid, a public platform built with free software and under the control of the administration itself. And Europe is moving in this same direction: in June 2026, the European Parliament replaced Google with a European search engine on all its computers, the Commission presented its technological sovereignty legislative package, and France has ordered each ministry to develop a plan to eliminate its dependence on foreign technology. What we are asking for our children's schools is what European institutions are already doing for themselves.

What can we do this week?

• Ask the parent-teacher association (PTA / AFA): Bring up the debate at the next meeting of your school's family association.
• Demand answers from the School Council: As family representatives, we have the right to ask formally in writing which data of our children is sent to third-party servers and what measures are being taken to protect their privacy, as well as to request the publication of the data protection impact assessment required by European regulations when minors' data is processed on a large scale.
• Join forces with teachers: Many teachers share this concern, but an individual teacher asking questions can be ignored; organized families cannot. When the administration sees that families and teachers are asking for the same thing—transparency and guarantees regarding minors' data—responding is no longer optional.