A parent reported that children began showing pornography to each other in the classroom after physical books were replaced with iPads connected to the open internet. The school responded by offering trauma counseling. The reported consequence was exposure of students to pornographic material and resulting distress. This is a personal interview. Source available to SHIELD.

A parent reported that pornographic and violent video content appeared on their first grade boy's school-issued tablet, finding that the tablet had no restrictions or content filters.

A report describes pornographic content appearing on a school-issued tablet used by a child in Norway

The Norwegian Data Protection Authority (Datatilsynet) issued warnings of reprimand to three Norwegian municipalities for GDPR violations associated with their school-wide deployments of Google Chromebook and G Suite for Education. The regulator determined that the municipalities failed to perform adequate risk and privacy impact assessments, failed to establish a proper legal basis for data processing, and did not sufficiently inform students and parents about how their data would be processed and profiled.

A municipality in Agder, Norway deployed the digital mapping tool Spekter at local schools to track bullying and class environments. The tool collected non-anonymous peer-reported details identifying specific students as bullies, victims, or class disruptors, which was done without proper legal basis, transparency, or the ability for named students to access or correct the allegations. The Norwegian Data Protection Authority and the Privacy Appeals Board (Personvernnemnda) ruled the data processing unlawful, ordering the municipality to delete all collected data.

An IT professional analyzed a first-grade student's school iPad and found that approximately 20 to 24 percent of its traffic was associated with advertising networks. According to the account, the traffic appeared focused on behavioral tracking. The reported consequence was collection of children's data without their consent.

Students at two schools in a Norwegian municipality were instructed to use the fitness tracking app Strava as part of their school activities. The municipality failed to maintain control over how the students' personal data was processed within the app, violating GDPR. Consequently, the Norwegian Data Protection Authority issued a 50,000 NOK fine to the municipality.

A technical error in the Norwegian identity management system, Feide, resulted in the unauthorized transmission of national identity numbers to external service providers when users logged in. At a major Norwegian university, 15,019 students and staff had their national identity numbers shared, with 7,873 of those individuals having their data stored by third-party service providers without prior agreement. The university reported the incident to the national data protection authority.