Is information posted on a forum on a social media platform about exam results a breach of the GDPR?

ANSWER

The controller of students' personal data is the university. Teaching staff (lecturers) are employees or persons cooperating with the university who process students' personal data on behalf of the controller (the university). Information about a student's name and exam grade constitutes personal data within the meaning of Article 4(1) GDPR, so the controller should not disclose it to unauthorized persons.

As a rule, it is accepted that a personal data breach will include, for example, posting a collective list of exam results on examination room doors or publishing them on an extranet or intranet. In this case, posting such a collective list by a lecturer on a social media platform will also constitute a personal data breach.

If the information about exam results allowed identification of a natural person (name and surname + result), publishing it on a social media platform constitutes a personal data breach under Article 4(12) GDPR. If, however, the communication of information about exam results concerned each person individually, we are not dealing with unauthorized disclosure of personal data, i.e. a breach of the natural person's personal data.