Poland's personal data protection watchdog supports a proposal for a free, state-run electronic school register to replace costly commercial platforms. However, the agency warns that consolidating the data of millions of students into a single database poses severe cybersecurity risks. The situation pits family finances against student privacy.
What Happened
In late August 2026, Polish President Karol Nawrocki vetoed a bill that would have launched a free, centralized digital school register integrated with the nation's Education Information System. The president argued that the draft law lacked sufficient safeguards against data leaks and digital threats. Just days later, Mirosław Wr3blewski, the president of Poland’s Office for Personal Data Protection (UODO), publicly backed the concept of a public electronic register. Wr3blewski warned, however, that the system's centralized design introduces a systemic digital risk by creating a single point of failure for cyberattacks.
The Bigger Picture
Currently, Polish schools rely on private, commercial electronic diaries like Vulcan and Librus to track grades and attendance. While basic web access to these platforms is free, companies often charge annual subscription fees to unlock mobile app features like push notifications and direct messaging. For example, Vulcan charges PLN 32.99 to PLN 42.49 for full mobile access.
Beyond the financial burden on families, UODO reports that these commercial registers frequently fail to protect student data. The watchdog has received numerous citizen complaints regarding GDPR non-compliance. A recent UODO audit of a prominent commercial operator confirmed irregularities in how family data is processed. Wr3blewski maintains that a free, secure public alternative is necessary, but only if the government conducts a thorough Data Protection Impact Assessment and implements strict "privacy by design" principles before launching.
What This Means for Families
For parents and educators, the debate forces a choice between cost and digital security. On one hand, private EdTech companies monetize daily school communication, turning real-time grade tracking into a paid subscription service. This model commercializes basic communication, so parents who do not pay must wait longer for updates.
On the other hand, a centralized government register consolidates the grades and personal information of millions of minors into one target. If hackers breach a single school's private register, the damage is localized. If they breach a centralized state database, the identity and school records of nearly every student in the country could be compromised at once.
What You Can Do
While policymakers debate the future of the state register, parents and teachers can protect student privacy on existing platforms in several ways. First, they can review the settings on commercial school apps like Vulcan or Librus to limit access to device locations, contacts, and cameras. Second, parents can access the register through a secure desktop web browser rather than downloading the mobile app, which avoids mobile subscription fees entirely. Finally, families should avoid writing sensitive personal details, medical notes, or family disputes in open-text communication fields, opting for direct phone calls or in-person meetings instead.