Folder access - Data Protection Act - How do you do it?

[Paid_Peanuts]

Scenario:

Every member of staff has their own H: drive.

Currently there are members of staff i.e. Support Services Manager who periodically needs access to all admin H: drives in someone’s absence.

In such cases we have added them to the security settings on the folders as and when. So there is probably about half a dozen people that have or want access to other peoples H: drives as well as their own.

 

Are we in breach of any data protection acts by doing this? Do we need to gain the permission of the person whos H: drive it is the staff members are accessing? Or because they are an employee of the school are we allowed to give anyone access to their H: drive?

 

How do people do this at their schools?

 

Comments and advice greatly appreciated.

[eean]

I can't see how you'd be breaking the Data Protection act - it's not really for that kind of thing.

A similar scenario is companies scanning users' emails, which they ARE allowed to do, so long as they have a specific business purpose for doing so. (See Here). In your case you DO have a specific business purpose. However, I would say that it is polite to make people aware that, in their absence, other people would access their home drive.

I wouldn't use home drives for storing 'work' in the first place. It would probably be better placed on a shared network drive with a hierarchical access policy. That’s what networks are for – the Support services manager should be able to access the files they need without having to go to you.

Home drives are just really temporary storage or for personal things (done in lunch hour, of course).

[Paid_Peanuts]

Both you and I know what shared drives are for - however people using them in the manner they were designed is a step too far in our place. Every thing important is stored in someones H: drive somewhere. I suppose its just a case of educating the end users.

[kestrel1]

I would say, that as long as staff are made aware of the need for others to access their home areas if they are off, there shouldn't be a problem. If there was a shared area on the network though for different subjects, staff could save work into these folders instead of their own personal area.

That is the system we use. Only staff have access to these shared folders, whilst other folders are for everyone to view, but only staff have write access.

Some staff wish students to be able to save to certain folders, so write access is granted to that year group on a per folder basis. Any abuse to this & the access is withdrawn.

[enjay]

As others have said, so long as people know that others might be given access to some or all of their files, you're okay - a line in the AUP will cover that (and should be there anyway, since us NMs with domain admin rights can see them).

 

Any data held on the company network belongs to the company and can be viewed by whoever the company deems appropriate. It's the same as scanning emails, really.

 

You might get a couple of people object, but the vast majority will be cool with it if you explain why. Those really worried about privacy will buy a pen drive :-)

[iatkinson]

In our acceptable use policy there is a seperate section for staff to sign giving us permission to look in their work area, otherwise we have to go up the tree to SLT and the decision rests with them.

[Marvintpa]

I would argue that the DPA does not have any relevance to home drives and shared drives. The DPA covers personal/private information stored by companies, organisations about individuals. DOB, Addresses, NI Numbers etc. This data specific to each individual.

 

Home and Shared drives are areas that staff / students dump crap in when they cant be bothered to find a better place to store it

 

Surely the establishment's AUP should cover this.

I/we work thus

1. The school owns the equipment, pays for the electricity, heating etc.

2. The school own the interlecual property rights on all data created or stored on school machines.

3. I manage the school systems for the governors and Head/Chair of Govs.

4. They require me to carry out checks to ensure that the school (and ultimately they) are not breaching any laws.

 

Thus I and my "lad" are permitted to go anywhere .... assuming we have a sysadmin or security reason to do so.

 

My answer to staff and students when they complain is simple. (Other than "Tough $%^&"). If you have something "secret" or "personnal" store it on a pen drive away from school services.

[localzuk]

'Personal' things shouldn't be stored within school servers - that is not what they are for.

 

The home drive at our school is for storing things like lesson plans, and course material. The shared drives are for storing the same, but for those staff who share their work.

 

Therefore, anything that is personal in there is not our problem as it shouldn't be there.