site.btaEducation Minister: No Personal Data Leaked by Sale of Bulgarian School Platform

Addressing Parliament during Question Time on Friday, Education and Science Minister Galon Tsokov said that personal data on Bulgarian citizens used in the Shkolo school platform have not leaked as a result of the platform's sale to British company Juniper Education. The question was asked by Borislav Gutsanov and Ivan Petkov MPs of BSP for Bulgaria.

It was apparently prompted by a massive scare among parents on social media over a possible leak of children's personal data following the acquisition of Shkolo.bg by the UK company in January 2024. Set up in 2016, Shkolo.bg gained popularity when the Education Ministry ordered schools to replace the conventional paper grading and attendance registers by online records from the 2022/2023 school year. It is used by 1,800 schools in Bulgaria and has 2 million users, including educators, pupils and parents. 

Tsokov explained that his Ministry had approached both the Commission for Personal Data Protection and the owners of the software. External service providers, including providers of electronic registers, and the educational institutions which are their clients must conclude contracts and data-protection and information-security agreements, cleared with the Commission for Personal Data Protection, for the use of data from the National Electronic Information System for Pre-School and School Education. While the Education Ministry is not a party to these agreements, they must be submitted to it, he specified.

"What is particularly important is that the infrastructure on which the electronic register data are stored and its location remain unchanged. The data storage infrastructure is not a subject of acquisition. The operational functioning of Shkolo OOD, which is a Bulgarian company, is not directly affected and continues to be managed by the same managing directors on the basis of the contracts and agreements with the schools. Shkolo argues that the acquisition of ownership to the company's capital is a share transfer transaction and by no means affects the property, contractual relations, ownership rights or other aspects," Tsokov said. 

The Minister also quoted the Commission for Personal Data Protection as saying that the Shkolo ownership transfer does not breach personal data protection rules and the change in the shareholding of a company with registered office in the territory of Bulgaria, incorporated and registered under Bulgarian law, does not affect its personal data protection commitments in its capacity as data controller or processor. The Commission pointed out that change of ownership is a normal practice for far larger data processors, such as banks and insurers, telecoms and utilities.