cloud services

[macboy81]

can anyone clear cloud storage legal bits up for me school is looking at icloud with ipads and also maybe dropbox (staff storage) and some chromebooks with google drive (replacements for school netbooks)

 

Are schools legally allowed to use cloud storage ive spoken to a few people and its seems very split and noone was 100% a couple didnt actually care and was using it anyway.

[free780]

Well it comes down to who holds the encryption keys. Spideroak don't have your private key so it is a bit safer. Also child protection and if your data falls under us jurisdiction as its in a us data centre. Its quite a grey area as some schools are just going with google as its easier but are in a lot of trouble when the internet goes down or google drive does.

[macboy81]

yeah the grey area is when the data store in not in UK and not under our laws I think i will have more of a read on this ive disabled icloud as this is for personal use as per apples really small print

[edutech4schools]

Just tell the ICO Data Protection and Freedom of Information advice | ICO.org.uk and they will update the school details to show that data might be held off site.

 

Over the course of this year all UK schools will automatically be added but until they have done that I would contact them just to be on the safe side.

[pcstru]

Are schools legally allowed to use cloud storage ive spoken to a few people and its seems very split and noone was 100% a couple didnt actually care and was using it anyway.

I don't think it's as simple as yes or no. The ICO provides some guidance. The guidance suggests you need to look at what you will use the cloud for and how that might impact your existing registration. If your users store everything in the cloud, including (say) spreadsheets containing personal data, how will you be able to respond to DP requests? Same for FOI requests - how do you access accounts that (may) belong to individuals? With someone like Google, how do you know what processing they do with data and how does that sit with your DP registration?

[jinnantonnixx]

Google is covered by the 'Safe Harbor' which means that using it is acceptable under the UK's DPA. I don't know about iCloud.

 

 

We're looking at a self-hosting cloud with Owncloud. The concerns you mention go away if you do this.

 

ownCloud.org | Your Cloud, Your Data, Your Way!

 

 

Install a Centos server then do this:

software.opensuse.org: Install package isv:ownCloud:devel / owncloud-client

Edited December 3, 2013 by jinnantonnixx

[dhicks]

We're looking at a self-hosting cloud with Owncloud.

 

Me, too. What are you thinking of using as a backing store? OwnCloud seems to provide a way to access and sync files, it doesn't actually handle the backend storage itself, the actual "cloud" part. I'm considering using Ceph - if I understand correctly, I can create a sparsly-populated block device the size of a filesystem's maximum limit and expand a file system inside that to fit.

 

Ooh, just cheked the OwnCloud feature list - you can integrate with DropBox, so if there are users who absolutly have to use their DropBox account they can do so.

[jamesbmarshall]

Pretty sure @GrumbleDook would have something to add here!

 

Storing your data in the cloud, no matter who it is with, should be thought about carefully and it's a topic that's shrouded by a large amount of FUD.

 

If you're interested in finding out more about how Microsoft secures your data in the cloud, the best place to go is the trust center: Office 365 Trust Center.

[jinnantonnixx]

Me, too. What are you thinking of using as a backing store? OwnCloud seems to provide a way to access and sync files, it doesn't actually handle the backend storage itself, the actual "cloud" part. I'm considering using Ceph - if I understand correctly, I can create a sparsly-populated block device the size of a filesystem's maximum limit and expand a file system inside that to fit.

Don't know yet, still on the POC stage.

 

Ooh, just cheked the OwnCloud feature list - you can integrate with DropBox, so if there are users who absolutly have to use their DropBox account they can do so.

Very interesting. As is the beta they're testing - Owncloud Documents! Features | ownCloud.org It's still very basic, but promising stuff.

[pcstru]

Google is covered by the 'Safe Harbor' which means that using it is acceptable under the UK's DPA. I don't know about iCloud.

It means that it MIGHT be acceptable, not that it is acceptable in all circumstances. Google offer free services on the basis that you allow them to process data so they can target adverts. They have a DB registration which covers this use so when you sign up with them, you are accepting that.

 

As a school, our data protection registration covers use of data on data subjects, basically for the business of the school. If we subcontract a service to a third party, we can provide that 3rd party with data to allow that service to operate. The third party needs to be covered by Safe Harbour (so they can be compelled to comply with equivalent of the DPA) BUT for the purposes of the data subjects, they operate under our registration. Their processing of the data must be either compatible with our DPA registration or we need to ammend the registration and notify subjects of any additional processing that will take place. So here's the problem, our registration does not cover Google's processing of data to improve their services in either a wide sense (usability) or a narrow sense (targeting adverts). Google isn't either transparent about how it processes data, particularly about how it combines data from multiple services. Just ask the Dutch.

 

Google are quite clear that you are responsible for making sure that you are compliant with local law. When you accept their terms and start uploading data, if your data subjects at some point object and wish to be compensated for you spewing their data to a tax avoiding advertising giant, then it won't be Google that will be their first port of call. Schools seem to be walking into this with their eyes squeezed tightly shut - perhaps if they don't look, it won't exist. But hey, everyone is doing it, so it must be OK - right?

[edutech4schools]

With someone like Google, how do you know what processing they do with data and how does that sit with your DP registration?

 

Google offer free services on the basis that you allow them to process data so they can target adverts. They have a DB registration which covers this use so when you sign up with them, you are accepting that.

 

Google are quite clear that you are responsible for making sure that you are compliant with local law. When you accept their terms and start uploading data, if your data subjects at some point object and wish to be compensated for you spewing their data to a tax avoiding advertising giant, then it won't be Google that will be their first port of call. Schools seem to be walking into this with their eyes squeezed tightly shut - perhaps if they don't look, it won't exist. But hey, everyone is doing it, so it must be OK - right?

 

Might be worth looking at the T&T for the edu version and not the public version as your info is completely incorrect. They even give you options to completely disable all adverts and scanning from in the admin systems, which are set no adverts by default.

Edited December 4, 2013 by edutech4schools

[edutech4schools]

Google offer free services on the basis that you allow them to process data so they can target adverts. They have a DB registration which covers this use so when you sign up with them, you are accepting that.

 

Just one more point, the EDU version is not the same as the free version but is part of the business version which is not free but a payed for service used by Banks, Governments and even some local Authorities.

[pcstru]

Might be worth looking at the T&T for the edu version and not the public version as your info is completely incorrect. They even give you options to completely disable all adverts and scanning from in the admin systems, which are set no adverts by default.

I have read the T&C's. I see options to disable the serving of Ad's. I see no option to disable scanning of data. I see search google search functionality on school data and user content which clearly indicates that scanning and indexing is taking place. That they do not serve adverts does not mean that they do not process the data. And if you can get a clear statement from Google about the way they process and particularly combine data from different services, then you are doing better than the Dutch government.

 

[ETA - in-fact the option in the control panel reads "Hide all ads in google apps for X". That's a pretty strong indication that the processing is taking place but that it is only the endpoint, the actual serving of the ad, that is disabled. ]

Edited December 4, 2013 by pcstru

[pcstru]

Just one more point, the EDU version is not the same as the free version but is part of the business version which is not free but a payed for service used by Banks, Governments and even some local Authorities.

Thanks for serving an example of my last point : "But Hey, everyone is doing it, so it must be allright"

[edutech4schools]

Security & Privacy ? Google Apps for Education

 

All on-line services by all companies must do some form of scanning to some extent, how else would your data get sent from one person to another or checked for viruses.

[pcstru]

All on-line services by all companies must do some form of scanning to some extent, how else would your data get sent from one person to another or checked for viruses.

The problem is not that organisations process data, but how and why they process data. You first suggested Goggle does not scan data in order to serve up Ad's. In fact, their own product suggests they do, it's just that in that context, you can turn off the actual ads. That's a little different from a company processing an email address to send an email, or scanning a file and trying to match some heuristic function against a 'threat'. If I send an email, I'm OK with ISP's processing the data to look up the MX record on the recipient domain, If I've opted in to AV, I'm OK with them processing incoming email to flag it as a virus. I'm not sure why I would be Ok with them noting from the email that I used a Bosch Planer to remove my fingertip and because they have cleverly combined data between accounts, then serving power tool ads to me on accounts where I can't opt out of ads.

 

That is the thorny issue, the combining of data. If you use Google Apps and your staff or students buy a nice sexy Nexus 7 and set it up using credentials you have issued them as part of their schooling or employment, is the data Google then collects covered under your DPR or theirs? I know that the process can collect my Wi-Fi password. If I make a request of my employer under the terms of the DPA, should I get that back? Google has it against an account that is under your schools control. Why shouldn't I?

 

The document you linked to was very big on ownership of data. *You Own Your Data*. That is nice but not the problem. I know I own content I create - that's enshrined in copyright law. The problem with Google is in your granting them rights in relation to that content, by using their services. When our students log on for the first time they have to accept Googles legal T&C's. Is it right to ask a year 7 to do that? They ain't simple nor are they even transparent and yet we encourage children to just click "I Accept".

 

It'll all be OK, everyone is doing it.

Edited December 16, 2013 by pcstru