Schools have legal support for class lists

Sometimes the question of contact lists and class lists in preschools and schools arises. The function of class lists exists in all school portals, but what does the General Data Protection Regulation (GDPR) say about this? Below, we have gathered information about the legal basis and the reasons preschools and schools have for using these lists.


Legal basis

Creating contact lists and class lists in preschools and schools is allowed because the school can have a legal basis for this processing. The Swedish Data Protection Authority (formerly Datainspektionen, now IMY) and the Swedish Association of Local Authorities and Regions (Sveriges Kommuner och Regioner) state in their responses to questions from governing bodies and other interested parties that school administrations need class lists to carry out their activities, and there is legal support for this. The processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR and Section 2(1) of the Swedish Data Protection Act).


For independent schools (friskolor), an interest balancing test can be used instead. This means that the school's interest in processing personal data outweighs the student's interest in not having their personal privacy violated in individual cases.


Schools that assess that class lists facilitate the school day have the required legal basis and can create class lists with names, phone numbers, and addresses available in the class, provided they allow students and guardians who do not wish to participate to withhold their contact information. Since there is legal support for having the list in public preschools and schools, it is also considered a public document that could be requested. In cases where the student has protected population register information or there is specific confidentiality for a particular student, the student's information should not be included in the class list. It should be considered part of the school's operations that parents know which children are in the class, and therefore, there should be no obstacle to disclosing these lists.


The principle of data minimisation means that unnecessary information should not be included. Therefore, full personal identification numbers should not be included, but in some cases, dates of birth may be acceptable if necessary for the context.


Start from the preschool's or school's task

Nils Ehrenberg, a lawyer at the Swedish Data Protection Authority (then Datainspektionen, now IMY), explains in "lararen.se" that a preschool or school should start from its task when formulating the reasons for disclosing class lists.

"One reason could be that it makes it easier to create security when parents and children/students can contact each other. Here, the legal basis could be the public interest and an interest balancing test."

"Planning a common school trip, which benefits the cohesion between students and parents, could be another reason."


Additional reasons to use class lists include:

  • Creating a sense of security in the class by having contact information for everyone and knowing that other parents can always be reached.
  • Organizing group meetings and class trips. Class lists are needed to allow everyone to get to know each other and build cohesion in the class.
  • Engaging class councils and class parents who are necessary in many schools for distributing information.
  • Facilitating integration. If parents with no background in the Swedish school system do not sign up for voluntary lists, there is a risk that their children will not be contacted for playdates or invitations to shared activities.
  • Consent is not required
  • Consent from guardians or students is not necessary to establish class lists. Consent is also not a practical method. In principle, it could be possible to base the processing on consent (for both municipal schools and independent schools), but it may be difficult to argue that the power relationship is particularly equal between the school and the individual student. 


Consent is not required 

Consent from parents or students is not necessary to create class lists. Consent is also not a practical method. In principle, it could be possible to base the processing on consent (for both municipal and private schools), but it may be difficult to argue that the power relationship between the school and the individual student is particularly equal. However, it is possible to let parents themselves choose how much information is displayed to other parents, such as allowing them to choose whether mobile numbers or addresses should be included.


The General Data Protection Regulation (GDPR) does not give parents the right to demand that the school compile class lists and provide them to parents. It is up to the school to decide on this and whether it is possible in accordance with the GDPR, for example, by considering whether class lists facilitate students' education.


It is beneficial to have a centralised decision. To provide clarity for everyone in preschools and schools, it is good to make decisions at the operational level (board, executive director, or head of operations) that this processing can be carried out and that it is supported by Section 2(2) of the Data Protection Act. By doing so, the data controller has taken a stance that it is a necessary processing (in the sense of this concept in the GDPR) to carry out the school's operations, and it is supported by a decision made with the support of a law or other regulation.


Contact lists and class lists in Unikum

In Unikum there are contact lists based on statements from the Swedish Data Protection Authority (IMY) and the Swedish Association of Local Authorities and Regions (SKR).


The contact lists are accessible to teachers, students, and parents. To adhere to the principle of data minimisation for students and parents, social security numbers or birthdates are not displayed in the contact lists. If the municipality has synchronization with the current childcare and student register, students'/parents' contact information is hidden from other students/parents, but they can choose to display their contact information to other students and parents.