bencellis Posted March 5, 2013 Posted March 5, 2013 I am looking for a pointer to BECTA or DfEE guidance on the issue of the ownership of school data that is being stored in MIS/Administrative/VLE systems. I seem to remember it came about when one of the MIS suppliers claimed that the data stored in their system was theirs. Anyone have any ideas, please.
elsiegee40 Posted March 5, 2013 Posted March 5, 2013 I am looking for a pointer to BECTA or DfEE guidance on the issue of the ownership of school data that is being stored in MIS/Administrative/VLE systems. I seem to remember it came about when one of the MIS suppliers claimed that the data stored in their system was theirs. Anyone have any ideas, please. You need @GrumbleDook for chapter and verse on this
TheScarfedOne Posted March 5, 2013 Posted March 5, 2013 (edited) Where's the tiger, or @Dos_Box... Edited March 7, 2013 by witch
matt40k Posted March 5, 2013 Posted March 5, 2013 I would love a MIS/Administrative/VLE supplier to public state that they own your school (MIS) data. They wouldn't be trading by the end of the week. I've heard of companies providing the data in very unhelpful CSV format as a data dump prior to them destoring any copies they have.
scholarpack Posted March 5, 2013 Posted March 5, 2013 MIS companies should not own the schools data. The data belongs to the school, it's merely 'processed' by the MIS company. If you change MIS, as per the IMLS Framework, the MIS company has an obligation to help you export your data in a meaningful fashion.
bencellis Posted March 5, 2013 Author Posted March 5, 2013 IMLS Framework??? MIS companies should not own the schools data. The data belongs to the school, it's merely 'processed' by the MIS company. If you change MIS, as per the IMLS Framework, the MIS company has an obligation to help you export your data in a meaningful fashion.
GrumbleDook Posted March 5, 2013 Posted March 5, 2013 This goes back to data protection principles, so it is not school specific and so the ICO has chapter and verse on it. If you have a look through the "your obligations" section Data Protection Act - Guidance For Organisations - ICO it covers off most of the things you are likely to need to know. IIRC the clarification about use / processing of data was around a vendor wanted to use 'live' data (including pictures) without agreement with the data owner / data subjects (ie parents / children (both 13+ and under 13) / staff / other data subjects). The Data Owner (person granting authorisation to process the data) and Data Subject (the individual the data is about) are usually the same person in most walks of life. The DPA doesn't actually mention the Data Owner though ... it mentions the subject, personal data, the Data Controller and the Data Processor. Data is held in care by someone (the Data Controller) and rather than being an assigned individual it is usually the legal body (eg the school). It has to be dealt with as specified by the Data Controller in their Notification. Within that Notification they might say they will share it with others, allow them to process it, and even allow others to do what they want with it too ... but the person who has ownership of that data is the data subject (and their legal guardian - under 13 it is covered under EU law that the minor is not the owner but the parent and 13+ it is covered as Duty of Care by the parent / guardian but open to challenge by the minor). Simple terms. The Data Controller (the school) processes the data. They control how this is done, what other parties have access and how *they* process it, put in place the safeguards that no others can access / process it, and are responsible for ensuring that the requirements of the DPA are met. The MIS provider might say that they own it (which they don't) but they are still required to meet the criteria set out in the original Notification. If the school gives them access and the MIS provider then use it for marketing / training, and this was not one of the requirements then they are complicit in the school breaching the DPA. The other conversations around the issues were not on public forums so I can't dig out an archive or share, but I will see what FoI stuff was around from the questions if you need any more. The ICO is your friend in this though ... if you have an issue and you believe that a vendor is being difficult, or plain wrong in their approach, then the ICO helpline is a wonderful resource. Failing that, if you know the vendor has a copy of the data then you draft a template letter to all your parents so they can make DP requests for what data is held on them, how it is used and follow up with instructions to delete / remove. If the vendor fails to do this then you report each failure to the ICO and they risk being fined for each, individual failure. 4
GrumbleDook Posted March 5, 2013 Posted March 5, 2013 IMLS Framework??? IMLS framework: advice and guidance - Schools for more information.
vikpaw Posted March 5, 2013 Posted March 5, 2013 IMLS Framework??? More info here: http://www.edugeek.net/forums/mis-systems/76154-something-keep-eye-dfe.html
GREED Posted March 5, 2013 Posted March 5, 2013 Would you say Microsoft owns your Word documents? An MIS is just a piece of software (or for me... a way of life!), should be treated as such. Schools own the data.
GrumbleDook Posted March 5, 2013 Posted March 5, 2013 To add a clarification in here ... There are circumstances where a vendor might say we 'own' the data, when they actually mean they own the process of what you do with it. It might be that this is a 3 way agreement between parties (eg school, solutions provider, VLE) and the solutions provider gets the data from A to B. The solutions provider could be contractually obliged to ensure that only relevant data is moved, that they are responsible at the end of the arrangement (contract, project, etc) for ensuring that data is removed from the VLE (ie the provider no longer has agreement to process the data so it has to be stripped out as per DPA principle 5) and so on. All this should be written into contracts (including the Notification with the ICO), backed up with data processing agreements and involves clear communication. I am sure we can all point to when one or more of the above have been a problem. Again, to put things simply, if it is not written down, a clear process and backed up by the Notification then you don't do it!
Greg Posted March 6, 2013 Posted March 6, 2013 I am looking for a pointer to BECTA or DfEE guidance on the issue of the ownership of school data that is being stored in MIS/Administrative/VLE systems. I seem to remember it came about when one of the MIS suppliers claimed that the data stored in their system was theirs. Anyone have any ideas, please. Are you able to give details on which MIS supplier claimed this? The ownership and responsibility for the data is the school's (unless they close, then it becomes the LA's)
GREED Posted March 6, 2013 Posted March 6, 2013 Are you able to give details on which MIS supplier claimed this? The ownership and responsibility for the data is the school's (unless they close, then it becomes the LA's) I think we would all be keen to know this if an MIS did indeed claim this.
PhilNeal Posted March 6, 2013 Posted March 6, 2013 So if your data is in the cloud presumably it gets deleted if you stop paying? Even though the school owns it without doubt can someone else delete it?
Roberto Posted March 6, 2013 Posted March 6, 2013 (edited) So if your data is in the cloud presumably it gets deleted if you stop paying? Even though the school owns it without doubt can someone else delete it? I'd like to think they'd be responsible about it but if your school printed all the data off, put it in a physical storage warehouse space they'd rented and stopped paying the bills for that space what would happen? Eventually the owner of the warehouse would want to reclaim the space right? Nothing magic happened here just because the warehouse is digital instead of "physical" imho. Edited March 6, 2013 by Roberto
GrumbleDook Posted March 6, 2013 Posted March 6, 2013 I think we need to understand the relationship between the data controller, the data subject and the data processor. If we take the example of a solution where data from data subjects is moved to, and stored, in the cloud by a company, contracted to do so by the data controller, then there are responsibilities on all sides. Firstly the Data Subject has to trust the Data Controller to deal with their data as per the Notification, the laws of the land (mainly DPA for the sake of this example) and the contract. The Data Controller has a responsibility to ensure that the data is held in accordance to the law, processed accordingly and available if needed. The Data Processor has a responsibility (in this example case) to move, store and make available the data for the period of time for which they are a data processor. Once they are no longer a data processor they have no right to hold or process the data. They have to delete / destroy it. They do have to give the Data Controller all reasonable notice and reasonable access to the data before they do so, and they are accountable to the Data Controller to ensure that the data is destroyed correctly. All of this is usually covered by contracts between the Data Controller and any Data Processor (including the storage facility). A company who deals with the data, moves the data around, holds it in transit or otherwise is contracted to make sure that once the contract comes to an end then any data they have held or moved is deleted, then they might say the data is theirs to destroy ... it would be very poor wording but the intention might be that they have to take appropriate action to ensure they meet their contractual and legal responsibilities. It is messy ... which is why we have to be careful about saying someone is wrong to say that data can't be deleted by someone ... without a full picture (including good knowledge of any contracts, the Notification and history) then I think we need to be careful of trying to guess who is involved in this. I don't know who is (even after having a conversation directly with the OP) and I doubt many others would know (and if they did they would probably not be able to comment).
witch Posted March 7, 2013 Posted March 7, 2013 Where's the tiger, or @Dos_Box... *fixed that for you - even though you made fun of me - but goodness knows what would happen to you if you can't spell the name of the edugod...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now