Submission to UN on Child Rights in Spain Submitted

We write in advance of the 94th pre-session of the Committee on Rights of the Child and its adoption of a list of issues prior to reporting regarding Spain's compliance with the Convention on the Rights of the Child. This submission covers articles 16, 17, and 28 of the Convention, and addresses access to education during Covid-19 school closures and children's rights abuses by government-endorsed online learning during the Covid-19 pandemic.

Access to Education During Covid-19 School Closures (article 28)

From March 2020 to March 2022, in response to the Covid-19 pandemic, Spanish schools were fully closed for 10 weeks and partially open for 5 weeks.[1] Spain has an enrollment of 7.7 million students from pre-primary to secondary school, demonstrating the magnitude of students affected by school closures at the time.[2] Most autonomous communities reopened schools in September 2020, after Covid-19 closures left schools partially open through June 2020 and the July and August academic break.[3]

The abrupt, mass shift to online learning exposed wide gaps in digital literacy among students, parents, and teachers.[4] Those unfamiliar with using technology, or with creating content with it, found the transition challenging. One teacher Human Rights Watch interviewed in June 2020 said many teachers and families were not accustomed to working online, and that from school, "they have had to provide assistance to teachers, families, and students."[5] Unfamiliar and uncomfortable with technology, some teachers did not make the transition to distance learning platforms. One parent in Bilbao described how one of her daughter's teachers "refused to make video calls … she said 'no.' That she was not going to get in front of a camera."[6] As a result of these gaps, some students missed out on learning.[7]

Barriers to access distance learning opportunities tended to be particularly high for students from groups who were more likely to face exclusion from education even before the pandemic, including children from vulnerable and low-income groups and children with disabilities. In June 2020, Human Rights Watch interviewed a mother of an 11-year-old with dyslexia and attention deficit, who said that her child's academic work had been very limited during school closures.[8] Her child had an individualized education plan, but during the school closure "there was no different treatment, they simply made her do fewer exercises," said the mother.[9] On the other hand, one parent remarked how he thought his child, who had a mild developmental or learning disability, was doing better at home than in school. "Obviously he has someone [two parents] exclusively for him and not someone [a teacher] who has to be there for 25 other children," he said.[10]

Children's right to education includes education during early childhood.[11] Parents we interviewed in Spain described some attempts to continue early childhood education during Covid-19-related school closures or restart education, in one example with emails on recommended activities parents could complete with their children for the day.[12] However, one of the parents we interviewed said that the nursery director would send activities for the parents to do with the children at home, but that "the fact my son couldn't go to daycare … has worried me…. Because in the nursery they do psychomotor development … but here [at home] we have neither the capacity nor the knowledge."[13]

Human Rights Watch recommends that the committee ask the government of Spain:

• What resources or support has the government or education ministries provided to improve digital literacy among students, teachers, and parents?
• What specific measures has the government taken or plan to take to remedy lost learning time of all children, including children with disabilities and children who lost out on in-person learning during early childhood?
• How has the government and education ministries assessed students' level of learning following Covid-19 school closures, and how has it planned to provide support?

Human Rights Watch recommends that the committee call on the government of Spain to:

• Strengthen digital literacy in school curricula, and in-service digital literacy trainings for teachers.
• Explicitly allocate educational resources strategically to vulnerable and low-income groups, children traditionally at risk of exclusion from education, and those shown to have been particularly affected in their education during the pandemic, including children with disabilities and children who missed out on early childhood education.

Children's Rights Abuses by Government-Endorsed Online Learning during the Covid-19 Pandemic (articles 16, 17, and 28)

In a global investigation of education technology (EdTech) products endorsed by the world's most populous countries for children's education during the pandemic, Human Rights Watch found that the Spanish government directly violated children's right to privacy and other rights.[14]

Human Rights Watch analyzed seven EdTech websites and apps that were authorized by the national education ministry and the education authorities of Andalusia and Catalonia.[15] All seven products surveilled or had the capacity to surveil children online, outside school hours, and deep into their private lives.[16] They could or did harvest personal data from children, including information about who they were, where they were, who their family and friends were, and what kind of device their families could afford for them to use.

Of these, four EdTech products were directly built and used by Spain's education authorities as their primary means of delivering online education to children during the pandemic. These were Aprendo en Casa (federal), eAprendizaje (Andalusia), EDU365.cat (Catalonia), and Super3 (Catalonia).

Case study: eAprendizaje

On March 19, 2020, the regional government of Andalusia launched eAprendizaje to provide "resources, services, and recommendations developed to facilitate the continuation of online teaching and learning."[17]

eAprendizaje was found surveilling children not only within its online learning platform, but also tracking them across the internet, outside of school hours and deep into their personal lives. Human Rights Watch detected eAprendizaje collecting and sending this data to Google and Oracle using advertising-specific tracking technologies built by these two companies, which enabled both eAprendizaje and these third-party companies to track and target children across the internet for advertising purposes.[18]

For example, one ad tracker found embedded on eAprendizaje sent children's data to Google's advertising platform via the domain doubleclick.net. eAprendizaje also transmitted children's data to Google through its use of Google Analytics' 'remarketing audiences', an advertising technology (AdTech) tool that allows eAprendizaje to target its users with ads across the internet.

eAprendizaje also installed tracking technologies that engage in particularly deceptive practices. Human Rights Watch detected eAprendizaje collecting and sending children's data to AddThis, a marketing company acquired by Oracle in 2016.[19] AddThis offers a set of social media share buttons that allows website users to easily share interesting content on social media.

But AddThis does much more than encourage social media traffic. Whether or not a person clicks on the "share" button, AddThis instantly loads dozens of cookies and tracking pixels on website visitors' browsers, like nesting dolls, each collecting and sending user data to Oracle and to dozens of other AdTech companies to profile and target a person or a child with behavioral advertising that follows them across the internet.[20]

AddThis' privacy policy states:

The AddThis Tools also incorporate Cookies and Pixels from Oracle partners to enable the synchronization of unique identifiers between Oracle and our third-party partners to facilitate online behavioral advertising across the online advertising ecosystem.[21]

AddThis' button is not visible on any of eAprendizaje's webpages, indicating that AddThis and its nested cookies were harvesting children's data without providing its purported social media functionality, as well as denying children knowledge of these tracking practices.

Human Rights Watch finds that these tracking techniques, designed solely for advertising and commercial purposes, are neither proportionate nor necessary for eAprendizaje to function or to deliver educational content. Their use on children in an educational setting arbitrarily interferes with children's right to privacy.

Children who relied on eAprendizaje as their primary source of education during school closures could not reasonably object to such surveillance without opting out of compulsory education and giving up on formal learning during the pandemic. eAprendizaje did not disclose its use of ad trackers, advertising-specific third-party cookies, Google Analytics' 'remarketing audiences', or AddThis' tools.[22] As these tracking technologies were invisible to the user, children had no reasonably practical way of knowing the existence and extent of these data practices, much less the impacts on their rights. By withholding critical information, the government impeded children's access to justice and remedy.

In response to our request for comment, Oracle stated that any receipt of children's data through its AddThis tools is a violation of Oracle's policies, which prohibit advertising partners and website publishers from sending personal information from sites directed to children under 16 years old, or from consumers these companies know to be under 16 years old.[23] Oracle did not address whether it had received children's data from eAprendizaje. Andalusia's education ministry and Google did not respond to our request for comment.

Case study: Super3

On March 19, 2020, the regional government of Catalonia announced its partnership with the Corporació Catalana de Mitjans Audiovisuals, the public broadcaster, to provide remote learning to children through the broadcaster's Super3 channel.[24]

Human Rights Watch detected Super3 surveilling children inside and outside of its platform, tracking children across the internet and deep into their personal lives. Super3 collected and sent this data to Adobe's advertising-specific platforms: adobedtm.com, demdex.net, dpm.demdex.net, everesttech.net, and omtrdc.net.[25]

In doing so, Super3 permitted Adobe the opportunity to stitch together and analyze the data it received to guess at a child's personal characteristics and interests ("profiling"), and to predict what a child might do next and how they might be influenced.[26] Access to these insights could then be sold to anyone-advertisers, data brokers, and others-who sought to target a defined group of people with similar characteristics online.

Profiling and targeting children on the basis of their actual or inferred characteristics not only infringes on their privacy, but also risks abusing or violating their other rights, particularly when this information is used to anticipate and guide them towards outcomes that are harmful or not in their best interests. The United Nations Committee on the Rights of the Child has warned that such processing and use of children's data "may result in violations or abuses of children's rights," and has called on states to "prohibit by law the profiling or targeting of children of any age for commercial purposes on the basis of a digital record of their actual or inferred characteristics, including group or collective data, targeting by association or affinity profiling."[27]

On its site, Super3 disclosed that:

"We and our partners carry out the following data processing based on your consent and/or our legitimate interests: Personalized ads and content, measurement of ads and content, audience insights and product development, precise geolocation data and identification through device scanning."[28]

Human Rights Watch finds that these data practices, designed solely for advertising and commercial purposes, are neither proportionate nor necessary for Super3 to function or to deliver educational content. Their use on children in an educational setting arbitrarily interferes with children's right to privacy.

When reached for comment, Adobe did not acknowledge that they received data from Super3, and said it was its customers' responsibility to comply with its policies and applicable laws that prohibit the collection of children's data.[29] Catalonia's education ministry did not respond to our request for comment.

Government Failure to Protect

Human Rights Watch did not find evidence that the national education ministry and the education authorities of Andalusia and Catalonia took measures to prevent or mitigate children's rights abuses through the data practices of their authorized EdTech products, or checked whether these products were safe for children to use.

By failing to carry out children's rights due diligence on these products, these governments passed onto children the risks and harms associated with the misuse and exploitation of their personal data, which include security breaches, commercial exploitation, and the use of children's data by governments, law enforcement, and other actors for purposes that are not directly relevant, necessary, or proportionate to children's education or their best interests.

A secondary school science teacher in Madrid, Spain, told Human Rights Watch: "Because Spain was in a state of emergency, the Ministry of Education communicated [to teachers] that consent for privacy, or data protection, was no longer required ... Privacy and all that has gone into the background completely, but we have done it because the Ministry has said so."[30]

Some teachers told Human Rights Watch that they were not informed how the EdTech products they were told to use would protect their students' privacy or told to explain and seek consent from children or their parents. "We don't really understand what's going on with data protection," said one primary school teacher in Barcelona, Spain.[31] "Being an extraordinary situation, people have accepted it.… There have been zero clear guidelines from the government or the Department of Education."[32]

Children, parents, and teachers were largely kept in the dark about these data surveillance practices. Neither the government, regional authorities, nor the EdTech companies, informed children and their parents of the full extent of these data practices that risked or infringed on children's rights. As these tracking technologies were invisible to the user, children had no reasonably practical way of knowing the existence and extent of these data practices, much less the impacts on their rights. By withholding critical information, the government and these companies impeded children's access to justice and remedy.

Even if children, parents, and teachers had known about these data practices, Human Rights Watch found that the data surveillance took place in virtual classrooms and educational settings where children could not reasonably object to such surveillance. These EdTech companies did not allow students to decline to be tracked; this monitoring happened secretly, without the child's knowledge or consent. In most instances, it was impossible for children to opt out of such surveillance and data collection without opting out of compulsory education and giving up on formal learning during the pandemic.

Human Rights Watch recommends that the Committee ask the government of Spain:

• Does the government have plans to develop and enforce comprehensive child data protections, under the General Data Protection Regulation?
• What recourse or remedy does the government provide, or is planning to provide, to children who have experienced infringements of their rights as a result of their use of these EdTech products and whose data remain at risk of misuse and exploitation?

Human Rights Watch recommends that the committee call on the government of Spain to:

• Work with the Spanish Data Protection Agency to adopt and enforce child-specific data protections that address the significant child rights impacts of the collection, processing, and use of children's personal data, protects the best interests of the child in complex online environments, and ensure that companies respect children's rights and are held accountable if they fail to do so.
• Provide remedies for children whose data were collected through their use of EdTech products. To do so, the appropriate authorities should:
  • Conduct a data privacy audit of all EdTech websites and apps they had endorsed for children's online learning. If the products fail this audit, rescind endorsement of these products, and immediately notify and guide affected schools, teachers, parents, and children to prevent further collection and misuse of children's data.
  • Immediately remove all ad tracking technologies from government-built EdTech websites.
  • Require EdTech companies with failed data privacy audits to delete any children's data collected during the pandemic.
  • Require AdTech companies to identify and immediately delete any children's data they received from EdTech products during the pandemic.
• Ensure that any services that are endorsed or procured to deliver online education are safe for children. In coordination with data protection authorities and other relevant institutions, Spain's education authorities should:
  • Require all actors providing educational services to children to identify, prevent, and mitigate negative impacts on children's rights, including across their business relationships and global operations.
  • Require child data protection impact assessments of any educational technology provider seeking public investment, procurement, or endorsement.
  • Ensure that public and private educational institutions enter into written contracts with EdTech providers that include protections for children's data.
  • Define and provide special protections for categories of sensitive personal data that should never be collected from children in educational settings.

Protection of Education from Attack (article 28)

Spain was among the first countries to endorse the Safe Schools Declaration in May 2015,[33] and in May 2019 Spain hosted the Third International Safe Schools Conference.

As of June 30, 2022, Spain was contributing 644 troops to the United Nations Interim Force in Lebanon.[34] The 2017 Child Protection Policy of the UN Department of Peacekeeping Operations, Department of Field Support, and Department of Political Affairs notes: "United Nations peace operations should refrain from all actions that impede children's access to education, including the use of school premises. This applies particularly to uniformed personnel. Furthermore … United Nations peace operations personnel shall at no time and for no amount of time use schools for military purposes."[35]

Spain's 2007 Manual on the Law of Armed Conflict includes the obligation that "with the help of civil authorities, the proper functioning of establishments dedicated to the assistance and education of children must be provided."[36] Spain's 2020 National Defense Directive states that "in its external operations, the armed forces will pay special attention to the protection of vulnerable groups, especially … children, supporting the implementation of the … the Safe Schools initiative."[37]

Human Rights Watch recommends that the committee ask the government of Spain:

• Do any Spanish laws, policies, or trainings provide explicit protection for schools and universities from military use during armed conflict?
• Does pre-deployment training for Spanish peacekeepers include the ban on using schools in military operations?

Human Rights Watch recommends that the Committee:

• Congratulate Spain on endorsing the Safe Schools Declaration and for hosting the Third International Safe Schools Conference.
• Encourage Spain to continue to develop and share examples of its implementation of the declaration's commitments with this Committee and with other countries that have endorsed the Safe Schools Declaration.