Schools and other educational institutions may not pass on personal data to third parties in writing, electronically or verbally. If disclosure is necessary, the person concerned must give their prior written consent .