Data Protection Issues

[adamjoseph7]

Hi All

 

After implementing HAP+ the head asked about data protection in terms of pupil data once someone has downloaded a document to their home computer.

 

Is it a case of user responsibility? Agreeing to delete any documents that contain sensitive information after working on them and maybe incorporate into the AUP or staff handbook?

 

Thanks

[nickbro]

Yep, that's the rule. If you know javascript you can write a clause into the myfiles page that if it's a certain directory, disabled the download abilities.

[pcstru]

Is it a case of user responsibility? Agreeing to delete any documents that contain sensitive information after working on them and maybe incorporate into the AUP or staff handbook?

Yes and no :-)! Yes you should have a policy in place and at a certain point, it is incumbent on staff to follow that policy and if they don't, they may be 'liable' (in that it is they as an individual who is not exercising their duty of care). No, in that having a policy is not enough - the policy needs to be fit for purpose, you need to ensure it is promulgated and you need to do some assurance that it is being followed.

 

UK DPA also suggests that data taken/stored off site should be encrypted, so if staff are using their own machines, the machine should probably conform to a minimum security standard (virus protection, strong password, disc encryption etc).

[jallsop]

, so if staff are using their own machines, the machine should probably conform to a minimum security standard (virus protection, strong password, disc encryption etc).

 

Lets face it, most home users simply will not conform to this, which is why they demand a school provided laptop, which we then make sure meets the standards we prescribe.

If we don't provide the equipment, then we cannot demand that their equipment meets those standards, since it is, by definition, their property. All we can do is stop the downloading of data or transference offsite. We use a VPN into our network to overcome this.