Office 365 and pupil data retention/child protection

[karlr]

We are in the process of configuring Office 365 for pupil use (both the apps and Exchange Online). Something that I am concerned about is Microsoft's attitude to data retention - as far as I can tell, a pupil's data and e-mails will be immediately lost the moment the pupil's licenses are revoked. In general use I would expect that we would revoke a pupil's license on or shortly after their leaving date, which essentially means that their e-mail is wiped out on the day they leave.

 

I believe this creates a number of problems for a school. The first being general data retention - as I understand, there are guidelines that suggest keeping pupil data for 7 years. This isn't a problem for us in general as we have a robust backup/archival infrastructure. However, it appears that Office 365 simply doesn't have proper support for exporting/backing up mailboxes (I'm aware that there are a number of hacky workarounds, including some commercial solutions but it all still seems far less than ideal/practical). Following on from data retention is child protection - keeping a long-term record of a pupil's mailbox, even after they have left the school, is arguably an obligation as far as the school's duty of care goes. While there are additional tiers for Exchange Online that would allow some form of archiving/legal hold, the per pupil price point of these tiers just doesn't seem viable compared to hosting Exchange on-premise (which we already do for staff, and back up using Veeam).

 

So, I have two questions for other schools:

 

* What is your general attitude towards pupil data retention? Do you consider it important to keep pupil data for a number of years?

* If using a cloud service (especially Office 365), what happens to a pupil's data after they leave the school? If the data is wiped, what happens if a child protection issue is raised that could be related to the pupil's use of school e-mail?

[Boredguy]

With regards the e-mail retention, you can always assign the leavers the free alumni licence but disable login.

[karlr]

That seems like it could be an option.. though of course we'd still be trusting Microsoft to keep the data and it would depend on their generosity when it came to renewal each year. Presumably one can add additional licenses for this at will? I was of the understanding that Microsoft can be a little picky about the number of licenses you sign up for, and will start asking questions if the number of licenses you've asked for doesn't match the numbers you're talking about for volume licensing (e.g. I can't just sign up for 5000 alumni licenses and be done with it).

 

Edit: Another concern is how this works with their Active Directory account. We are currently syncing Office 365 with our Active Directory. When a pupil leaves, their AD account is automatically disabled and moved to an archived OU. Of course it is likely that we will eventually remove these accounts from our production domain (as it will all be on archive tapes).

Edited April 16, 2015 by karlr

[Boredguy]

You can add as many licences as you wish as the Alumni is for past school/college users and only provides access to exchange.

 

With DirSync, when I delete a user on our domain, they still exist in the 365 Cloud for a further 30 days before they are deleted. During this time you can change the assigned licence without any e-mail loss.

[karlr]

Can you also un-link it from AD when you change the license though? Obviously we'd rather have it not be deleted after the 30 days.

[Boredguy]

Yes it just becomes a cloud account.

 

You can actually try it if you like. Create an account in one of our monitored OU's and once it has replicated up to 365, you will see the user account is moved into the deleted users and listed as In Cloud as it's status.

Via Powershell you can restore the account and then assign the new licence

$DelUser = Get-MsolUser -UserPrincipalName [email protected] -ReturnDeletedUsers

Restore-MsolUser -ObjectId $DelUser.ObjectId

[harriuk]

Hi.

 

I think we need to distinguish what exactly is meant by pupil data. Are you talking about pupil personal data, which needs to be retained for varying amount of years depending on what it is (see link below) or are you talking about pupil work that they produce. If it's the latter I'm only aware of needing to keep this for one year after date of leaving.

 

Pupil emails though, I haven't come across any guidance about this. Please correct me if I am wrong as it takes a long time to get your head around some of this stuff!!

 

This document gives details on all statutory requirements for keeping data. The pupil section starts on page 38.

http://www.irms.org.uk/images/resources/infoguides/records_management_toolkit_for_schools_version_4_may_2012.pdf

[karlr]

E-mail is really the main thing we're concerned about. The best solution for us seems to be to amend our user archiving script to the following:

 

* Reset the pupil's password (Set-MsolUserPassword)

* Download all of their e-mails over IMAP (hopefully via a Powershell/.NET compatible library) and store in a location covered by backup

* Revoke Office 365 licenses

 

We would at least then have a record of the e-mails on our own storage system and thus under long term backup.

 

However the place where this (and other solutions) seem to fall flat is if a pupil has deleted e-mails. Without spending a considerable amount on Plan 2/archiving licenses it seems there is no way to prevent an e-mail being lost after 14 days when it has been deleted.

[TomHD]

Email is not explicitly mentioned in the RM Toolkit. I guess a student's email could be classed as "work", depends who you ask, but I would have no issue with not having pupil emails archived.

 

On a side note, this is scary: E-mail is disclosable under the access to information regimes. All school e-mail is disclosable under Freedom of Information and Data Protection legislation. Be aware that anything you write in an email could potentially be made public.

Edited April 24, 2015 by TomHD

[karlr]

Of course all of the guidance will change when there's a test case (a major child protection issue involving school e-mail). The challenge is making sure that you're not the test case.