EdLaw
Bayern — Schuldatenschutz (BayEUG Art. 85, 85a)
The data-protection core of the Bayerisches Gesetz über das Erziehungs- und Unterrichtswesen: the legal basis for Bavarian public schools' processing of pupil, parent and staff data, and the statutory footing of the state-run school IT (the Art. 85a "automatisiertes Verfahren", operationally the BayernCloud Schule world). Bavaria is the second-largest German Land by our subscriber base (26 of 150 mapped active subscriptions — see the TODO Germany entry).
Fact text is German (authentic language); this README is curation.
Applicability to EdTech
- Processing is task-bound and catalogued: schools may process data required for their statutory tasks, with the pupil/teacher/parent data categories spelled out (Art. 85(1)); schools are obliged to process the Art. 85a/113a data through the Staatsministerium-provided school administration software (Art. 85(1) Nr. 1) — third-party admin tooling must coexist with, not replace, the state system.
- Transfers for other purposes are locked to the BayDSG conditions (Art. 85(2)).
- Art. 85a establishes the central processor: the Staatsministerium may appoint a public body as an Art. 28 GDPR Auftragsverarbeiter for schools (Art. 85a(1)), with the processable data catalogue in Art. 85a(2). A vendor product handling pupil data in Bavaria operates alongside this state-mandated processing chain; the school-side lawful basis for third-party tools flows from Art. 85(1) task-necessity plus GDPR — Bavaria has no NSchG-§ 31(5)-style express platform clause, so ministry guidance and the school's own DPIA carry more weight here.
- Supervision: Bavarian public schools answer to the Landesbeauftragter für den Datenschutz (BayLfD); private-sector vendors in Bavaria answer to the BayLDA — Bavaria is the one Land with two DPAs.
Contents
| Document | Covers |
|---|---|
| DATENVERARBEITUNG.md | BayEUG Art. 85, 85a — Verarbeitung personenbezogener Daten, automatisiertes Verfahren |
Scope note: the BayDSG (general Land data-protection act Art. 85(2) points into), the BaySchO (school regulations, incl. its provisions on digital tools) and KM guidance can be added when needed.
Key obligations at a glance
- School processing bounded to statutory tasks with an express data catalogue (Art. 85(1)); mandatory use of the state school-administration programme for the catalogued data (Art. 85(1) Nr. 1).
- Purpose-changing transfers only under the BayDSG conditions (Art. 85(2)).
Enforcement
BayLfD for public schools; BayLDA for private bodies (the vendor side). No school-specific penalty regime beyond the general data-protection machinery.
Related
- BDSG — the federal act on the vendor side
- Niedersachsen NSchG — contrast: NI has an express learning-platform clause (§ 31(5)); Bavaria works through task-necessity plus the state IT chain
- EU GDPR
Sources
Meta
Statute text in DATENVERARBEITUNG.md is reproduced verbatim in German from BAYERN.RECHT (gesetze-bayern.de, current consolidated text) and built/re-verified mechanically by tools/bayern-recht/build_by_bayeug.py (verify mode; do not hand-edit statute text). Sentence numbers appear as ^N; anchors derive from printed labels ({#a85-1-1} = Art. 85 Abs. 1 Nr. 1). The two-DPA supervision note reflects the standing Bavarian split (BayLfD/BayLDA) — regulator structure, not extracted statute text.