+ Post New Thread
Results 1 to 7 of 7
MIS Systems Thread, Use of UPN by third party sites in Technical; I'm trying to figure out what the rules on use of the UPN as a unique identifier are within the ...
  1. #1

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,826
    Thank Post
    517
    Thanked 2,475 Times in 1,918 Posts
    Blog Entries
    24
    Rep Power
    836

    Use of UPN by third party sites

    I'm trying to figure out what the rules on use of the UPN as a unique identifier are within the context of third party sites (eg. hosted services such as I Am Learning, Sam Learning etc...).

    As far as I can see, the rules/guidance classifies the UPN as a sensitive piece of information and also states that it should simply not be routinely used, except in the cases of transferring pupils to new schools and for passing information up to LEAs and central departments.

    So, it all leads me to believe that we should not be using the UPN if sending information to sites such as those mentioned? Thoughts?

  2. #2

    Join Date
    Mar 2007
    Location
    Heywood, Lancs
    Posts
    211
    Thank Post
    7
    Thanked 50 Times in 45 Posts
    Rep Power
    28
    There is a policy document about UPN's here:
    UPN policy and practice guidance - The Department for Education
    which gives detail about what it can and can't be used for.

  3. #3

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,826
    Thank Post
    517
    Thanked 2,475 Times in 1,918 Posts
    Blog Entries
    24
    Rep Power
    836
    I've read that, it isn't clear on this situation. It only specifies how a school should use it internally, and how it should use it for communicating with researchers, third parties who are not parents and the LA/DfE.

    Service providers don't fall within any of those situations really!

  4. #4

    X-13's Avatar
    Join Date
    Jan 2011
    Location
    /dev/null
    Posts
    9,146
    Thank Post
    596
    Thanked 1,968 Times in 1,360 Posts
    Blog Entries
    19
    Rep Power
    833
    I had a quick look at the guidelines, and it isn't that clear to be honest. But that just may be the lack of coffee talking.

    You could contact the DSG helpdesk and see what the official stance is on it.

    Depending on whether it's possible to accurately identify the pupil from the UPN I would say no. It it's impssible, then check with your Child Potection officer to see what they think from a CP standpoint.


    DSG Helpdesk:

    Data and Statistics Division (DSD) Helpdesk
    1st Floor Mowden Hall
    Staindrop Road
    Darlington
    DL3 9BG
    Telephone: 01325 392626
    Email: dsd.helpdesk@education.gsi.gov.uk
    Website
    Last edited by X-13; 25th November 2011 at 08:38 AM.

  5. #5

    Join Date
    Mar 2007
    Location
    Heywood, Lancs
    Posts
    211
    Thank Post
    7
    Thanked 50 Times in 45 Posts
    Rep Power
    28
    We have always taken the view that this line from the guidance is pretty clear:

    "The Information Commissioner advises that the UPN should only be output to other schools, LAs, the DCSF and other central agencies".

    so it shouldn't go to hosted services etc.
    We had quite a debate about this with our intended Managed service provider when they wanted the UPN as an identifier on our proposed new VLE and we would not
    provide it. I also remember dicussing with QCDA officers at intial meetings about the Diploma (I am also our Exams Officer) why ULN's were introduced for Diploma learners
    when UPN's already existed, and the reason given was that UPN's could only be used for tracking learners through the school system and could not be used for anything else, so thats
    the line we have taken ever since.

  6. #6

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,826
    Thank Post
    517
    Thanked 2,475 Times in 1,918 Posts
    Blog Entries
    24
    Rep Power
    836
    See, that sentence uses the somewhat weak 'should' though. It is therefore a guide and not a rule. If it said 'must', then that would be different.

  7. #7
    rpwillis's Avatar
    Join Date
    Aug 2007
    Location
    SalamanderSoft Ltd
    Posts
    178
    Thank Post
    43
    Thanked 61 Times in 49 Posts
    Rep Power
    26
    Best response I've seen to this question, which comes up again and again, is from @GrumbleDook at http://www.edugeek.net/forums/securi...tml#post264887.

  8. 3 Thanks to rpwillis:

    David_Grashoff (25th November 2011), GrumbleDook (25th November 2011), vikpaw (28th November 2011)

SHARE:
+ Post New Thread

Similar Threads

  1. Couple Of Free Third Party Templates
    By SYSMAN_MK in forum EduGeek Joomla 1.0 Package
    Replies: 10
    Last Post: 31st January 2008, 10:32 AM
  2. use of pupil images on website
    By adamyoung in forum School ICT Policies
    Replies: 4
    Last Post: 17th October 2005, 11:08 AM
  3. Restricting the use of removeable storage - do you?
    By tarquel in forum School ICT Policies
    Replies: 16
    Last Post: 10th July 2005, 04:13 PM
  4. Use of domain password (& staff AUP, etc.) ;)
    By mark in forum School ICT Policies
    Replies: 22
    Last Post: 29th June 2005, 02:36 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •