+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 16
Cloud Services Thread, cloud services in Technical; can anyone clear cloud storage legal bits up for me school is looking at icloud with ipads and also maybe ...
  1. #1

    Join Date
    Jan 2013
    Location
    Manchester
    Posts
    17
    Thank Post
    7
    Thanked 2 Times in 2 Posts
    Rep Power
    4

    cloud services

    can anyone clear cloud storage legal bits up for me school is looking at icloud with ipads and also maybe dropbox (staff storage) and some chromebooks with google drive (replacements for school netbooks)

    Are schools legally allowed to use cloud storage ive spoken to a few people and its seems very split and noone was 100% a couple didnt actually care and was using it anyway.

  2. #2
    free780's Avatar
    Join Date
    Sep 2012
    Posts
    1,086
    Thank Post
    46
    Thanked 88 Times in 83 Posts
    Rep Power
    23
    Well it comes down to who holds the encryption keys. Spideroak don't have your private key so it is a bit safer. Also child protection and if your data falls under us jurisdiction as its in a us data centre. Its quite a grey area as some schools are just going with google as its easier but are in a lot of trouble when the internet goes down or google drive does.

  3. #3

    Join Date
    Jan 2013
    Location
    Manchester
    Posts
    17
    Thank Post
    7
    Thanked 2 Times in 2 Posts
    Rep Power
    4
    yeah the grey area is when the data store in not in UK and not under our laws I think i will have more of a read on this ive disabled icloud as this is for personal use as per apples really small print

  4. #4

    Join Date
    Apr 2010
    Posts
    2,168
    Thank Post
    111
    Thanked 192 Times in 159 Posts
    Rep Power
    85
    Just tell the ICO Data Protection and Freedom of Information advice | ICO.org.uk and they will update the school details to show that data might be held off site.

    Over the course of this year all UK schools will automatically be added but until they have done that I would contact them just to be on the safe side.

  5. #5


    Join Date
    May 2009
    Posts
    3,384
    Thank Post
    301
    Thanked 914 Times in 682 Posts
    Rep Power
    346
    Quote Originally Posted by macboy81 View Post
    Are schools legally allowed to use cloud storage ive spoken to a few people and its seems very split and noone was 100% a couple didnt actually care and was using it anyway.
    I don't think it's as simple as yes or no. The ICO provides some guidance. The guidance suggests you need to look at what you will use the cloud for and how that might impact your existing registration. If your users store everything in the cloud, including (say) spreadsheets containing personal data, how will you be able to respond to DP requests? Same for FOI requests - how do you access accounts that (may) belong to individuals? With someone like Google, how do you know what processing they do with data and how does that sit with your DP registration?

  6. #6

    jinnantonnixx's Avatar
    Join Date
    Mar 2011
    Location
    In the Calamatorium.
    Posts
    2,079
    Thank Post
    123
    Thanked 531 Times in 356 Posts
    Blog Entries
    2
    Rep Power
    336
    Google is covered by the 'Safe Harbor' which means that using it is acceptable under the UK's DPA. I don't know about iCloud.


    We're looking at a self-hosting cloud with Owncloud. The concerns you mention go away if you do this.

    ownCloud.org | Your Cloud, Your Data, Your Way!


    Install a Centos server then do this:
    software.opensuse.org: Install package isvwnCloud:devel / owncloud-client
    Last edited by jinnantonnixx; 3rd December 2013 at 10:01 AM.

  7. #7

    dhicks's Avatar
    Join Date
    Aug 2005
    Location
    Knightsbridge
    Posts
    5,767
    Thank Post
    1,306
    Thanked 804 Times in 698 Posts
    Rep Power
    245
    Quote Originally Posted by jinnantonnixx View Post
    We're looking at a self-hosting cloud with Owncloud.
    Me, too. What are you thinking of using as a backing store? OwnCloud seems to provide a way to access and sync files, it doesn't actually handle the backend storage itself, the actual "cloud" part. I'm considering using Ceph - if I understand correctly, I can create a sparsly-populated block device the size of a filesystem's maximum limit and expand a file system inside that to fit.

    Ooh, just cheked the OwnCloud feature list - you can integrate with DropBox, so if there are users who absolutly have to use their DropBox account they can do so.

  8. #8
    jamesbmarshall's Avatar
    Join Date
    Feb 2010
    Location
    Reading, UK
    Posts
    557
    Thank Post
    27
    Thanked 240 Times in 166 Posts
    Rep Power
    88
    Pretty sure @GrumbleDook would have something to add here!

    Storing your data in the cloud, no matter who it is with, should be thought about carefully and it's a topic that's shrouded by a large amount of FUD.

    If you're interested in finding out more about how Microsoft secures your data in the cloud, the best place to go is the trust center: Office 365 Trust Center.

  9. #9

    jinnantonnixx's Avatar
    Join Date
    Mar 2011
    Location
    In the Calamatorium.
    Posts
    2,079
    Thank Post
    123
    Thanked 531 Times in 356 Posts
    Blog Entries
    2
    Rep Power
    336
    Quote Originally Posted by dhicks View Post
    Me, too. What are you thinking of using as a backing store? OwnCloud seems to provide a way to access and sync files, it doesn't actually handle the backend storage itself, the actual "cloud" part. I'm considering using Ceph - if I understand correctly, I can create a sparsly-populated block device the size of a filesystem's maximum limit and expand a file system inside that to fit.
    Don't know yet, still on the POC stage.

    Quote Originally Posted by dhicks View Post
    Ooh, just cheked the OwnCloud feature list - you can integrate with DropBox, so if there are users who absolutly have to use their DropBox account they can do so.
    Very interesting. As is the beta they're testing - Owncloud Documents! Features | ownCloud.org It's still very basic, but promising stuff.

  10. #10


    Join Date
    May 2009
    Posts
    3,384
    Thank Post
    301
    Thanked 914 Times in 682 Posts
    Rep Power
    346
    Quote Originally Posted by jinnantonnixx View Post
    Google is covered by the 'Safe Harbor' which means that using it is acceptable under the UK's DPA. I don't know about iCloud.
    It means that it MIGHT be acceptable, not that it is acceptable in all circumstances. Google offer free services on the basis that you allow them to process data so they can target adverts. They have a DB registration which covers this use so when you sign up with them, you are accepting that.

    As a school, our data protection registration covers use of data on data subjects, basically for the business of the school. If we subcontract a service to a third party, we can provide that 3rd party with data to allow that service to operate. The third party needs to be covered by Safe Harbour (so they can be compelled to comply with equivalent of the DPA) BUT for the purposes of the data subjects, they operate under our registration. Their processing of the data must be either compatible with our DPA registration or we need to ammend the registration and notify subjects of any additional processing that will take place. So here's the problem, our registration does not cover Google's processing of data to improve their services in either a wide sense (usability) or a narrow sense (targeting adverts). Google isn't either transparent about how it processes data, particularly about how it combines data from multiple services. Just ask the Dutch.

    Google are quite clear that you are responsible for making sure that you are compliant with local law. When you accept their terms and start uploading data, if your data subjects at some point object and wish to be compensated for you spewing their data to a tax avoiding advertising giant, then it won't be Google that will be their first port of call. Schools seem to be walking into this with their eyes squeezed tightly shut - perhaps if they don't look, it won't exist. But hey, everyone is doing it, so it must be OK - right?

  11. #11

    Join Date
    Apr 2010
    Posts
    2,168
    Thank Post
    111
    Thanked 192 Times in 159 Posts
    Rep Power
    85
    With someone like Google, how do you know what processing they do with data and how does that sit with your DP registration?
    Google offer free services on the basis that you allow them to process data so they can target adverts. They have a DB registration which covers this use so when you sign up with them, you are accepting that.
    Google are quite clear that you are responsible for making sure that you are compliant with local law. When you accept their terms and start uploading data, if your data subjects at some point object and wish to be compensated for you spewing their data to a tax avoiding advertising giant, then it won't be Google that will be their first port of call. Schools seem to be walking into this with their eyes squeezed tightly shut - perhaps if they don't look, it won't exist. But hey, everyone is doing it, so it must be OK - right?
    Might be worth looking at the T&T for the edu version and not the public version as your info is completely incorrect. They even give you options to completely disable all adverts and scanning from in the admin systems, which are set no adverts by default.
    Last edited by edutech4schools; 4th December 2013 at 09:15 AM.

  12. #12

    Join Date
    Apr 2010
    Posts
    2,168
    Thank Post
    111
    Thanked 192 Times in 159 Posts
    Rep Power
    85
    Google offer free services on the basis that you allow them to process data so they can target adverts. They have a DB registration which covers this use so when you sign up with them, you are accepting that.
    Just one more point, the EDU version is not the same as the free version but is part of the business version which is not free but a payed for service used by Banks, Governments and even some local Authorities.

  13. #13


    Join Date
    May 2009
    Posts
    3,384
    Thank Post
    301
    Thanked 914 Times in 682 Posts
    Rep Power
    346
    Quote Originally Posted by edutech4schools View Post
    Might be worth looking at the T&T for the edu version and not the public version as your info is completely incorrect. They even give you options to completely disable all adverts and scanning from in the admin systems, which are set no adverts by default.
    I have read the T&C's. I see options to disable the serving of Ad's. I see no option to disable scanning of data. I see search google search functionality on school data and user content which clearly indicates that scanning and indexing is taking place. That they do not serve adverts does not mean that they do not process the data. And if you can get a clear statement from Google about the way they process and particularly combine data from different services, then you are doing better than the Dutch government.

    [ETA - in-fact the option in the control panel reads "Hide all ads in google apps for X". That's a pretty strong indication that the processing is taking place but that it is only the endpoint, the actual serving of the ad, that is disabled. ]
    Last edited by pcstru; 4th December 2013 at 09:40 AM.

  14. #14


    Join Date
    May 2009
    Posts
    3,384
    Thank Post
    301
    Thanked 914 Times in 682 Posts
    Rep Power
    346
    Quote Originally Posted by edutech4schools View Post
    Just one more point, the EDU version is not the same as the free version but is part of the business version which is not free but a payed for service used by Banks, Governments and even some local Authorities.
    Thanks for serving an example of my last point : "But Hey, everyone is doing it, so it must be allright"

  15. #15

    Join Date
    Apr 2010
    Posts
    2,168
    Thank Post
    111
    Thanked 192 Times in 159 Posts
    Rep Power
    85
    Security & Privacy ? Google Apps for Education

    All on-line services by all companies must do some form of scanning to some extent, how else would your data get sent from one person to another or checked for viruses.



SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Replies: 18
    Last Post: 26th June 2012, 01:56 PM
  2. Cloud services a no go if it's a US company
    By teejay in forum Internet Related/Filtering/Firewall
    Replies: 7
    Last Post: 5th July 2011, 11:24 AM
  3. Sub-forum: Cloud Services
    By PiqueABoo in forum Comments and Suggestions
    Replies: 1
    Last Post: 11th October 2010, 09:43 PM
  4. Local Services Vs Cloud Services
    By Skinny in forum How do you do....it?
    Replies: 0
    Last Post: 31st January 2010, 06:28 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •