Teachers and schools: anonymizing student records and exam papers
Schools share report cards, exam papers and class lists. See what GDPR Recital 38, FERPA and CNIL guidance require, and what to mask first.
Jane Example teaches ninth grade history. Her school just asked her to send last term's essays to a moderator outside the building. She wonders what to black out, and why children's records get more care than most other files. This guide explains what the law protects, and how to prepare a report, a class list or an exam paper before it leaves the school.
Schools produce paperwork about children every week. Report cards, class lists, incident logs and exam papers all carry names, birth dates and sometimes health notes. Each one can end up with an inspector, another school, a moderator or a researcher. The question is not whether to share these documents. It is how much of a child's identity to leave visible when you do.
Why does a child's data need extra protection?
Recital 38 of the GDPR, the EU's data protection law, says children merit specific protection because they are less aware of the risks and their own rights. This recital explains the reasoning behind GDPR Article 8, on a child's consent. As a European Union regulation, the GDPR applies directly and the same way in every member state, so a French, German or Irish school starts from the same rule.
In practice, this means schools should share less, not more. A ten-year-old cannot object to a data transfer the way an adult employee might. So the responsibility sits with the adults handling the file: mask names and details before a document leaves the building, not after someone complains.
What does France require? CNIL guidance and the INE
In France, the CNIL, the national data protection authority, publishes guidance for schools and after-school programs. It covers concrete cases: what a school can ask at enrollment, consent before a canteen scans a child's hand, limits on camera coverage, and rules for watching pupils during an online exam. Each case comes back to the same duty: collect only what a task actually needs.
French pupils also carry an INE, the national student number. A government deliberation from June 2023 describes the INE as a school-year code plus a non-meaningful sequence number, built to follow a student's path through school without exposing personal details. Treat the INE like a name: mask it before sending a document outside the school.
What does the US require? FERPA de-identification
In the United States, FERPA, the Family Educational Rights and Privacy Act, lets a school release education records without consent once they are de-identified. Under 34 CFR 99.31(b), a school must reasonably determine that a student's identity is not identifiable, even when combined with other information the recipient might already have. That last part matters: a small class list can still identify someone by grade or seat alone.
What do Germany and the UK require?
German rules sit at the state level. Guidance from the Saxon data protection authority allows a grade distribution chart with no names attached, since nobody can be identified from it. Sharing details with a supervisory school office is allowed, but the same guidance recommends anonymizing the file where possible before it leaves the school.
In the UK, the ICO, the Information Commissioner's Office, explains two ways to ask for a pupil's file. One is a personal-data request, under data protection law. The other is a request for the official education record, under separate education rules. Either way, a school should already know what is in a file and who is named in it before anyone asks. None of this blocks normal school life. It asks staff to think before a file goes out the door.
Exam papers for moderation: what should you remove?
Moderators and external examiners often need real scripts, not summaries. The obvious step is removing the cover sheet with the student's name. That is not enough on its own. A handwriting sample is a strong identifier by itself, and so is a name written again inside the answer, in the margin, or on a diagram.
- Replace the name with a candidate number before scanning or copying.
- Check every page for a repeated name, not only the cover sheet.
- Look at margins, diagrams and the back of the last page.
- Keep the name-to-number list separately, away from the moderator's copy.
- Get a second person to check a sample before you send the batch.
Document by document: what should you mask?
| Document | Who receives it | What to mask |
|---|---|---|
| Report card sent for a school transfer | New school's admin office | Home address, parents' phone numbers, any health note |
| Exam script sent to a moderator | External moderator or examiner | Student name, swapped for a candidate number, handwriting on cover pages |
| Incident report for the school board | School board or local authority | Names of the pupils involved, unless the case requires them |
| Anonymized dataset for a university study | External researcher | Names, birth dates, addresses, the INE or any national student number |
ONYRI Sanitize is a browser tool built for this kind of paperwork. It masks names, birth dates and addresses in a report or a letter before you send it, and a custom rule can catch a student number format like the INE. Its limit: on a scanned exam script, on-device text recognition does not read handwriting automatically. Mask a handwritten name by hand with the “Draw an area” tool, or cover it before you scan the page.
None of this needs to slow a school down. Decide what a document needs before you send it, not after. Mask the child's identifying details first, keep the key on a separate list, and check a sample page before the whole batch goes out the door.
Frequently asked questions
Does GDPR give children extra rights compared to adults?
Recital 38 of the GDPR asks for specific protection for children's data, not a separate set of rights. In practice, this means schools should minimize what they share and explain choices in plain language a child can follow.
What is the INE and can a school share it?
The INE is the French national student number, tracking one pupil across their schooling. Treat it as identifying information and mask it before sending a report, a transcript or an exam file outside the school.
Does FERPA require parental consent to share a class list?
Not if the school properly de-identifies it first. Under 34 CFR 99.31(b), a school can release education records without consent once no student's identity remains reasonably identifiable, including through other information the recipient may already hold.
Is a grade distribution chart personal data?
Not on its own, according to Saxon data protection guidance. A chart showing how many students got each grade, with no names attached, does not identify anyone and raises no data protection concern.
Why is handwriting a data protection problem on exam papers?
A handwriting sample can identify a student almost as reliably as a name. Removing the cover sheet is not enough. Check every page, including margins and diagrams, before an exam script leaves the school.
Sources & references
- Regulation (EU) 2016/679 (GDPR): Recital 38EUR-Lex
- FERPA: education records and de-identificationU.S. Department of Education, Student Privacy Policy Office
- 34 CFR 99.31 — Conditions for disclosure without consentCornell Law School, Legal Information Institute
- Accessing pupils' informationInformation Commissioner's Office (ICO)