Advice needed asap. LA advising us to stop using Google

[edutech4schools]

One of my schools has accidentally emailed all parents an email that has everyone else's email address in the header. The head decided to contact the LA and the following is the reply.

 

We don’t advice schools to use Gmail as it does not appear to be a robust system, e.g. you couldn’t recall the message you sent. Another issue is that Gmail servers may be located outside the EU; if that is the case, you may be in breach of principle 8 of the Data Protection Act (data must not be transferred outside the EU). I feel you need to reconsider your email service. You might want to contact Schools ICT for advice on an appropriate email service (Phone: xxxxxx, xxxxxxx).

Another issue the school needs to consider is whether it is necessary to inform the Information Commissioner’s Office about the breach. You need to consider what the risks are. Please contact xxxxxx (I have copied her this email) to discuss this tomorrow.

 

When the school wanted to use Google I contacted the ICO and signed the school up. We had a long chat and they were completely happy for the school to use this service.

 

Can any email system actually log into a private email account to delete an email if its been recalled?

 

I thought other LA were using Google services? Can anyone name some.

 

Going to send a reply but wanted to post this for advice.

Edited October 14, 2014 by edutech4schools

[Marshall_IT]

If using GAPPS for education then i believe Google store all the days within the EU which then complies to the DPA.

 

I have seen, once, email recall work. It was worth 2 accounts on the same exchange server and the message hadn't been opened yet.

 

I'm not sure how widely the protocols are supported though.

 

E-mailing all parents email addresses out to all parents is a break of the DPA so i imagine you should contact the ICO, although i have no idea what the consequences would be. Probably a data and procedures audit at best.

[jamesb]

Some e-mail systems (Exchange for example) can send a recall notice for e-mails. Of course, the actual recall of the e-mail is up to the user and the natural instinct of anyone seeing a recall notice is to pay a lot more attention to the e-mail being recalled. In other words the feature is about as useful as a chocolate saucepan (a working chocolate teapot has been demonstrated).

 

However an argument could be made that many commercial e-mail systems do allow you to restrict what users can do, such as preventing emails sent to (for example) more than 20 people. I'm not sure whether or not google provide this sort of functionality, but they do seem to have some sending limits and restrictions you can implement. Looking into these and having the details on-hand for your reply might help you here.

 

It's definitely a breach, so your information manager should contact the ICO and report it.

[simpsonj]

With Office 365/Exchange you can technically recall an email, as long as it remains unread and it's to either another exchange account or your own internal exchange account (I can't remember which) but definitely not if it's to another type of email account (Gmail, virginmedia etc). I remember looking this up when the someone high up sent the wrong message to a parent...

[localzuk]

A few points:

 

Google does not guarantee the location of their services. They are, however, signed up to the Safe Harbor agreement, which the EU has deemed to comply with the requirements set under Data Protection laws. Whoever sent you that email simply doesn't know what they are talking about when it comes to Google Apps for Education. There are hundreds, if not thousands of schools and LAs using Google services in the UK.

 

No email system offers a reliable "recall" method. It just isn't how email works. Once an email is in someone's inbox it is out of your control. Sure, some services have a recall function which asks for an email to be deleted but there's no guarantee that it'll do that.

 

I would agree that you should report the breach to the ICO (and send an apology email to all the parents).

[Marshall_IT]

Just looking about this email recovery in office 365 and i've found this response.

 

NeoZhu MSFT Support

Posted by NeoZhu MSFT Support

on 3/23/2012 1:36 AM

Verified Answer Verified by NeoZhu MSFT Support

Hi Lshar,

 

Additional information, there is some limitation about the recall service. For outside email , the email can't retract back. For the inside email, if the email has been read. also can't retracted.

 

For email recall , it's a client side feature. It requires the sender and recipient are using Outlook client during the recall service.

 

Thanks, Neo Zhu

 

Hi Lshar,

 

Additional information, there is some limitation about the recall service. For outside email , the email can't retract back. For the inside email, if the email has been read. also can't retracted.

 

For email recall , it's a client side feature. It requires the sender and recipient are using Outlook client during the recall service.

 

Thanks, Neo Zhu

 

So it looks like it is pretty useless, as someone noted above, chocolate teapot.

[pcstru]

Google are a signatory to Safe Harbour, so on that basis, there is not a particular issue with their services being based outside of the EU.

 

Email addresses are not necessarily personal data but it is highly likely that in the context some are - in that they uniquely identify a living individual. A phone call to the ICO might be wise but it is a matter for the designated data controller, which should probably be the Head (although they may delegate the action to you).

 

Recall of an email outside of the locally managed email accounts is unlikely to be successful. Many systems don't even honour delivery or read receipts.

Edited October 14, 2014 by pcstru

[IrritableTech]

The school must disclose this to the ICO, firstly. As others have said, it may trigger an audit.

 

While you are waiting for their response, start creating a new working practices document which documents the correct procedure for sending out mass emails. Having extra measures and showing the ICO rep that you are learning from mistakes will help I'm sure.

 

Google Apps for Education is covered under the Safe Harbor agreement as stated by others. Your ICO statement should reflect this though, explaining that data may be transferred to other countries. Again, this is something the ICO rep should pick up on if it hasn't been done.

 

The LA representative is overselling their (presumably preferred) option. This could have happened on any email platform, and no system is able to reliably recall 100% of messages.

 

For those that are asking, the biggest deployment of Google Apps I'm aware of is Norfolk County Council who has given access to all school staff and students. About 250,000 accounts when I discussed it with them a couple of years ago.

Edited October 14, 2014 by IrritableTech
Clarification

[edutech4schools]

Thanks for all the info. I have mailed back to the LA and await a reply.

[edutech4schools]

I have received an email that was about as useful as the first email but one point they listed was this,

 

· Data processing is still ‘opt out’ (a tick box setting) option of a standard education contract, this could easily be missed by some schools. If unticked, it may not meet the European Commission’s Data Protection Directive for transfers of data to third countries

 

I think I must be going mad as I thought Google Apps for Education (UK) had 'opt out' as default. Has this changed recently without my knowledge?

Edited October 15, 2014 by edutech4schools

[localzuk]

It depends what they mean by "data processing". Google does various automated processing on all emails on GApps for Edu. Eg. Indexing for user searching, spam filtering, malware filtering etc...

 

Google specify that they do not use GApps for Edu data for advertising purposes, which is different to their normal GApps rules (which scan and process the data to serve up those ads).

 

So, still, Google Apps for Edu is compliant with the rules as far as I can see.

[Marshall_IT]

I agree with @localzuk here.

I think they are using outdated information, in the hopes of retaining / gaining schools to use their services.

 

Some of the practices that went on from my LEA run ICT provider in years gone by were despicable.

[jinnantonnixx]

Let me guess - they're promoting their Exchange services? Close to the mark?

 

Email recall is a trick that works with certain proprietry email systems for email that remains internal, and it cannot be regarded as a get-out-of-a-booboo function.

 

In your case, the email went external so the 'recall' would have been of no use whatsoever. This is a red herring.

 

Gmail has an 'undo' feature - it's actually a buffer that waits for a defined time before really sending it.

Edited October 15, 2014 by jinnantonnixx

[edutech4schools]

Some of the practices that went on from my LEA run ICT provider in years gone by were despicable.

 

We get this sort of thing a lot. The main issue is the LA give 'dodgy' info to the headteachers who know no better and then panic. It's even worse once the LA run all the services for a school as they never get another view point and can be pushed into purchasing other LA services.

[localzuk]

I had this argument with the IT bods at the local council when I was in Bristol. We basically had a room full of Google Apps users at the network manager's meeting, and the IT guy from the council was adamant that it wasn't legal for us to be doing it, regardless of SafeHarbor or the ICO or the EU saying it was OK.

[edutech4schools]

Last year the LA got MS to come and push MS products to all the local primary schools at an event but It turned out that most of schools that did not buy IT services from the LA had already started using Google Apps for Education. This made the day very odd as the LA and MS were then basically selling to schools that were getting services only from the LA and the LA were not giving them any choice as they did not want to support Google Apps.