New! DfE Guidance: Cloud software services and the Data Protection Act

[elsiegee40]

Released today by the DfE, so I haven't read it yet, a new document

https://www.gov.uk/government/publications/cloud-software-services-and-the-data-protection-act

[elsiegee40]

Section 6 isn't great

 

6. Supplier checklists

The current supplier’s checklist statements can be found here. Please click on the

relevant supplier hyperlink:

• Google

• Microsoft

• Other suppliers will be added as they complete responses

In addition to completing the supplier framework in relation to the DPA implications of

using their service, suppliers have also undertaken to provide additional clarity in respect

of:

• The technical configuration of their service – available via supplier specific link

above

• The support infrastructure they have in place to assist UK schools in the event of

some serious and unforeseen issue in relation to the use of their cloud service –

available via supplier specific link above

 

The Microsoft one takes you to the Microsoft UK Schools Blog and I have failed to find the checklist

The Google link doesn't work

[Arthur]

The Microsoft one takes you to the Microsoft UK Schools Blog and I have failed to find the checklist

I think the Microsoft link should go to the Office 365 Trust Center instead.

 

See also: Privacy authorities across Europe approve Microsoft’s cloud commitments « The Official Microsoft Blog (& Office 365 Blog)

[Cache]

the Microsoft document is now available here https://cloudguidelinesforschools.sharepoint.com/Microsoft%20Response/_layouts/15/WopiFrame.aspx?guestaccesstoken=3TAOMS3ZZrnQDW2nL5h22VpjgibWTjM6mAtoJrc8BYk%3d&docid=0911e58c030a942bcbd44ebc26f3aa12e&action=view - linked form this blog post: Microsoft works with Department for Education to deliver secure cloud services to schools and students. Microsoft Office Pro Plus benefit, currently free for pupils at participating schools, will now also be free for staff in the UK from later this y

[GREED]

Read it... read it again... then laughed at how little actual advice there is for schools. I'm not surprised at all. It is a cheap cheap micro framework for the government to put a rubber stamp on a long standing issue without spending anything.

 

Someone tell me that this puts to bed all the issues that circulate around cloud, data, privacy, security, procurement...

 

That said, wait and see all the providers of any sort of cloud services scramble to complete their certification!

[LosOjos]

Yeah I've been passed this too, having to do quite a bit of digging before I draft up a statement for staff (at the moment I'm tempted to simply say "Don't use cloud storage!")

 

The Google link is here: https://drive.google.com/folderview?id=0B4froD7RGVqtaFlKc3VnTHF0THc&usp=sharing#

 

Now, while that document makes it seem as if Google Drive is perfectly safe, I suspect it only applies if you've signed up through Google Apps for Education, so staff members' personal Drive accounts are not necessarily compliant.

 

Likewise, Office365 looks to be secure but staff should not confuse this with SkyDrive/OneDrive, which I can't find documentation for therefore must assume it's not compliant.

 

Dropbox I still think is best just avoided in school.

 

I think it really comes down to advising staff to only use services we as a school have bought in to and distributed and to absolutely never use their personal accounts. It's the only way I can see to ensure compliance with DPA.

 

What do you think; would you agree with me or do you have other ideas about it?

[andy-integrale]

Yeah I've been passed this too, having to do quite a bit of digging before I draft up a statement for staff (at the moment I'm tempted to simply say "Don't use cloud storage!")

 

The Google link is here: https://drive.google.com/folderview?id=0B4froD7RGVqtaFlKc3VnTHF0THc&usp=sharing#

 

Now, while that document makes it seem as if Google Drive is perfectly safe, I suspect it only applies if you've signed up through Google Apps for Education, so staff members' personal Drive accounts are not necessarily compliant.

 

Likewise, Office365 looks to be secure but staff should not confuse this with SkyDrive/OneDrive, which I can't find documentation for therefore must assume it's not compliant.

 

Dropbox I still think is best just avoided in school.

 

I think it really comes down to advising staff to only use services we as a school have bought in to and distributed and to absolutely never use their personal accounts. It's the only way I can see to ensure compliance with DPA.

 

What do you think; would you agree with me or do you have other ideas about it?

 

I think thats a decent approach. We have Google Apps for Education at school and I have put in place the recorded settings but wouldn't want staff saving stuff to removable drives or personal cloud storage.