MIS Systems Thread, Use of UPN by third party sites in Technical; I'm trying to figure out what the rules on use of the UPN as a unique identifier are within the ...
25th November 2011, 09:17 AM #1
Use of UPN by third party sites
I'm trying to figure out what the rules on use of the UPN as a unique identifier are within the context of third party sites (eg. hosted services such as I Am Learning, Sam Learning etc...).
As far as I can see, the rules/guidance classifies the UPN as a sensitive piece of information and also states that it should simply not be routinely used, except in the cases of transferring pupils to new schools and for passing information up to LEAs and central departments.
So, it all leads me to believe that we should not be using the UPN if sending information to sites such as those mentioned? Thoughts?
IDG Tech News
25th November 2011, 09:30 AM #2
There is a policy document about UPN's here:
UPN policy and practice guidance - The Department for Education
which gives detail about what it can and can't be used for.
25th November 2011, 09:34 AM #3
I've read that, it isn't clear on this situation. It only specifies how a school should use it internally, and how it should use it for communicating with researchers, third parties who are not parents and the LA/DfE.
Service providers don't fall within any of those situations really!
25th November 2011, 09:35 AM #4
I had a quick look at the guidelines, and it isn't that clear to be honest. But that just may be the lack of coffee talking.
You could contact the DSG helpdesk and see what the official stance is on it.
Depending on whether it's possible to accurately identify the pupil from the UPN I would say no. It it's impssible, then check with your Child Potection officer to see what they think from a CP standpoint.
Data and Statistics Division (DSD) Helpdesk
1st Floor Mowden Hall
Telephone: 01325 392626
Last edited by X-13; 25th November 2011 at 09:38 AM.
25th November 2011, 09:44 AM #5
We have always taken the view that this line from the guidance is pretty clear:
"The Information Commissioner advises that the UPN should only be output to other schools, LAs, the DCSF and other central agencies".
so it shouldn't go to hosted services etc.
We had quite a debate about this with our intended Managed service provider when they wanted the UPN as an identifier on our proposed new VLE and we would not
provide it. I also remember dicussing with QCDA officers at intial meetings about the Diploma (I am also our Exams Officer) why ULN's were introduced for Diploma learners
when UPN's already existed, and the reason given was that UPN's could only be used for tracking learners through the school system and could not be used for anything else, so thats
the line we have taken ever since.
25th November 2011, 09:48 AM #6
See, that sentence uses the somewhat weak 'should' though. It is therefore a guide and not a rule. If it said 'must', then that would be different.
25th November 2011, 10:23 AM #7
Best response I've seen to this question, which comes up again and again, is from @GrumbleDook at http://www.edugeek.net/forums/securi...tml#post264887.
3 Thanks to rpwillis:
David_Grashoff (25th November 2011), GrumbleDook (25th November 2011), vikpaw (28th November 2011)
By SYSMAN_MK in forum EduGeek Joomla 1.0 Package
Last Post: 31st January 2008, 11:32 AM
By adamyoung in forum School ICT Policies
Last Post: 17th October 2005, 12:08 PM
By tarquel in forum School ICT Policies
Last Post: 10th July 2005, 05:13 PM
By mark in forum School ICT Policies
Last Post: 29th June 2005, 03:36 PM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)