Welcome 7- 8 March, 2019 Zagreb

Kathy Stetson Executive Director CEESA Paul Buckley Director American International School of Zagreb

Session 1: The Foundations of Data Privacy Cosimo Monda, ECPC Legal Framework – context. What is Personal Data / Data Protection: Key concepts of GDPR Principles (lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage, integrity, accountability). The value of case law moving forward: relevant examples for schools

Goal Setting - Final Conference Report Take 5 minutes to consider how this session relates to your school. Are there issues that you would like to collaborate on, or need support with?

Session 2: Data Processing in Schools Leena Kuusniemi, Fipra Facilitator: Lee Fertig, Director International School of Brussels Lawful Basis (Article 6): Grounds for processing within schools: The trouble with Legitimate Interests What Consents should you be seeking as a school?

Goal Setting - Final Conference Report Take 5 minutes to consider how this session relates to your school. Are there issues that you would like to collaborate on, or need support with?

Session 3: To DPO or not to DPO? Facilitator: John Mikton, International School of Luxembourg Panel: Leena Kuusniemi Irene Duranti, Scuola Ambrit, Rome Chris Vincent, International School of Zug and Luzern Garland Green, International School of Brussels

Goal Setting - Final Conference Report Take 5 minutes to consider how this session relates to your school. Are there issues that you would like to collaborate on, or need support with?

Session 4: Data Mapping and Data Subject Rights Tash Whitaker, Whitaker Solutions Ltd Facilitator: Sylvia Gillpatrick, CEESA Table leaders/ Panel: Cosimo Monda, ECPC Mark Orchison, 9ine John Mikton, Luxembourg Chris Vincent, ISZL Peter Murphy, International School of Vienna Jenny-Lee Moore, ISB

Goal Setting - Final Conference Report Take 5 minutes to consider how this session relates to your school. Are there issues that you would like to collaborate on, or need support with?

Session 5: Accountability: DPIAs, DPAs, Data Transfers Tash Whitaker, Whitaker Solutions Ltd Facilitator: Neven Soric, American International School of Zagreb Panel: Sandro Pace Bonello, ISL Sylvia Gillpatrick, CEESA Mark Dilworth, ZIS

Goal Setting - Final Conference Report Take 5 minutes to consider how this session relates to your school. Are there issues that you would like to collaborate on, or need support with?

Session 6: Data Breach and Subject Access Requests Leena Kuusniemi, Fipra Facilitator: Mark Dilworth, Zurich International School Panel: International School of Vienna Bavarian International School International School of Brussels 9ine Consulting

Goal Setting - Final Conference Report Take 5 minutes to consider how this session relates to your school. Are there issues that you would like to collaborate on, or need support with?

Facilitator: Cosimo Monda Session 7: Challenges and Change Management: Building a successful culture for Privacy by Design. Facilitator: Cosimo Monda GDPR-PR(!) Risk Management and the culture of change: key messages and practices IT Security: Best practice, levels of security appropriate to the risk, BYOD Communications, Marketing and Alumni Awareness raising in the workforce: Challenges and Success from the frontline Table Leaders: 9ine, ISB, Helsinki, Bavaria, AISZ, CEESA

Goal Setting - Final Conference Report Take 5 minutes to consider how this session relates to your school. Are there issues that you would like to collaborate on, or need support with?

Session 8: Closing Session “The Belgian Data protection authority supports the idea that in bringing together a GDPR- informed critical mass of international schools, one can place expectations on the edtech industry to ensure that the products and services they offer are indeed GDPR compliant. As you can see, the Belgian data protection authority is well aware of the importance of data protection in school environment. We sincerely hope that the event can be concluded with a signed declaration from the attending organisations committing to a Privacy by Design Culture within their schools.” Willem DeBeuckelaere, President of the Belgian Data Protection Authority Vice President, European Data Protection Board

Leonardo Cervera Navas Director European Data Protection Supervisor