Bernie Posted May 8, 2015 Posted May 8, 2015 As I'm sure a lot of schools do we use third party web hosted systems for teaching (SAM Learning, MathsWatch, Show My Homework etc.). A parent has asked that their child's personal data are not passed to commercial third party companies. Do we have to comply with this i.e. do we need specific consent to pass pupils details on? Or is the data transfer covered by Fair Processing?
elsiegee40 Posted May 8, 2015 Posted May 8, 2015 You need to call the Professionals Online Safety Helpline It is free and offers advice on such matters to schools which will be accurate! Helpline - Safer Internet Centre http://www.edugeek.net/forums/e-safety/108799-professionals-online-safety-helpline-safer-internet-centre.html 1
Banjo Posted May 8, 2015 Posted May 8, 2015 What text do you include in your privacy notice? Suggested text below:- Privacy Notice - Data Protection Act 1998 We (Name of school / academy / establishment) are a data controller for the purposes of the Data Protection Act. We collect personal information from you and may receive information about you from your previous school and the Learning Records Service. We hold this personal data to: • Support your learning; • Monitor and report on your progress; • Provide appropriate pastoral care, and • Assess how well we are doing. Information about you that we hold includes your contact details, national curriculum assessment results, attendance information and personal characteristics such as your ethnic group, any special educational needs you may have and relevant medical information. If you are enrolling for post 14 qualifications the Learning Records Service will give us your unique learner number (ULN) and may also give us details about your learning or qualifications. In addition for Secondary and Middle deemed Secondary Schools Once you are aged 13 or over, we are required by law to pass on certain information to providers of youth support services in your area. This is the local authority support service for young people aged 13 to 19 in England. We must provide the names and addresses of you and your parent(s), and any further information relevant to the support services’ role. We may also share data with post 16 providers to secure appropriate support on entry to post 16 provision. However, parent(s) can ask that no information beyond names, addresses and your date of birth be passed to the support service. This right transfers to you on your 16th birthday. Please tell (Insert name of School Administrator) if you wish to opt out of this arrangement. For more information about young people’s services, please go to the National Careers Service page at https://nationalcareersservice.direct.gov.uk/aboutus/Pages/default.aspx We will not give information about you to anyone without your consent unless the law and our policies allow us to. 1
Bernie Posted May 8, 2015 Author Posted May 8, 2015 Our Privacy Notice is almost identical to the above. We include the text below as well. "We will not give information about you to anyone without your consent unless the law and our policies allow us to. We are required by law to pass some information about you to our Local Authority (LA) and the Department for Education."
Bernie Posted June 4, 2015 Author Posted June 4, 2015 Just an update on this. I contacted both our LA and Professionals Online Safety Helpline, both of whom were very helpful and gave detailed responses. In summary, Our LA said we were probably within our rights to pass data regardless of parental concern as it is genuine school business - providing that we have satisfied ourselves that the company hold the data properly and data sharing is covered in our fair processing notice The Professionals Online Safety Helpline said that parents are within their rights to request and prevent the further sharing of identifiable information to third parties without consent. The Dfe gave the following considered response which I quote verbatim. "I can confirm that the department would advise that you seek independent legal advice regarding the sharing of child level data with these organisations, due to the sensitivity of the data. I hope you find this information helpful." I've contacted the Information Commissioner's office in the hope of getting a definitive response as I couldn't find anything that directly addressed the issue on their website. As an aside the parent has complained that we didn't ask for specific consent for each external website, does anyone do this in their school when they introduce a new system?
matt40k Posted June 4, 2015 Posted June 4, 2015 their child's personal data are not passed to commercial third party companies What do they think is happening to the child personal data? I mean would they be happy if they know only first name \ surname \ year \ school name is past to say, MathsWatch and not all other data in the MIS?
Bernie Posted June 4, 2015 Author Posted June 4, 2015 I think they have concerns over data security generally and their details being used for marketing specifically. The parents have had the purpose of the websites explained to them and how we protect data generally. This is not cutting it! I suspect in at least one instance they are against using the website per se and are using data protection as an excuse to stop their child using it. We are hopefully going to get the parents to come in and discuss their concerns as trying to do so by email is getting us nowhere and is wasting time. Obviously we will try and be as flexible as possible in terms of meeting parental consent requests but ultimately this is about getting the best possible education for the pupils. We therefore need to know what we can insist on and where we have to give some leeway. 1
bobsmith Posted June 4, 2015 Posted June 4, 2015 It's worth finding out exactly what you are passing to these companies - SAM Learning doesn't take anything covered by the data protection act the last time i checked. I've just dug out this: https://www.samlearning.com/about-us/terms-policies/student-data-policy-statement/ while writing this post - the sensitive (to many people) info about FSM and Ethnicity is optional - the only concern would be the UPN but they cover how they deal with protecting that in the text above. From a personal point of view it sounds like you're dealing with someone who is a little over paranoid. It's a different issue if you start sharing phone numbers and addresses with companies - it'll be fun trying to run a parental communications system while avoiding this parent's complaints....
Bernie Posted June 5, 2015 Author Posted June 5, 2015 I think it would be fair to say that the parent is concerned about data sharing. I think the passing of any personal details (name, DoB) is enough. We use PARS for our external communication but that passes details to a website to send, I presume on an as and when basis when texts/ emails are sent. I'm now wondering whether I should block communications to them on that basis....... It shows that it's simply not practical to not use 3rd party systems - what if we wanted to use cloud storage for SIMS for example! That's why I'm finding the lack of response from the DfE frustrating as the potential implications of this are huge and obviously will affect nearly every school.
Banjo Posted June 5, 2015 Posted June 5, 2015 I would amend the first paragraph of your privacy notice to say that you may also share pupil information with third parties for the purposes of:- • Support your learning; • Monitor and report on your progress; • Provide appropriate pastoral care, and • Assess how well we are doing. I would not name suppliers and I would also amend “However, parent(s) can ask that no information beyond names, addresses and your date of birth be passed to the support service” to include third parties. 1
PhilNeal Posted June 5, 2015 Posted June 5, 2015 There is a huge difference between allowing third parties to use the information (and say contact your parents/pupils) and holding it on your behalf. With appropriate contracts in place a company can act on your behalf and be your data processor - you remain the controller. 4
GREED Posted June 6, 2015 Posted June 6, 2015 Phil is absolutely spot on, I've been doing a lot of research into this on behalf of SIF and without repeating this is totally correct. 2
Bernie Posted June 8, 2015 Author Posted June 8, 2015 Banjo, thanks. I will add this in to our Privacy notice. Phil, GREED - very interesting, and would certainly solve our issue! I think it's an excellent argument to use - Do you have any documentation that states this and if so could you let me have it?
PhilNeal Posted June 8, 2015 Posted June 8, 2015 Sorry I don't have any documentation. I would look on the ICO web site as they have some plain text explanations.
jbunoomally Posted June 9, 2015 Posted June 9, 2015 Each xAAS third party who need our data to provision services (either through manual export/import, or through an MIS agent like Groupcall), we go through a process where we send them a list of questions which ask them to explain various details such as exactly what data they need for their system to operate, how they secure data, etc. Depending on the type of data they need we get in to more details questions such as assurances around the security of our data when they decommissioning their servers (or agreements they may have with their suppliers, i.e. Rackspace.) We also get them to sign our Data Sharing Agreement and NDA - we are also starting to push for companies to go through the new Cyber Essentials Plus (https://www.gov.uk/government/publications/cyber-essentials-scheme-overview) accreditation to make the process less onerous. JB.
Disease Posted June 9, 2015 Posted June 9, 2015 (edited) UPN should not be given out to any website, the DFE guidance is quite clear on that: The UPN must be a ‘blind number’ not an automatic adjunct to a pupil’s name. It must be held electronically and only output when required to provide information to the LA, central government or another school/academy to which the pupil is transferring. Under the Data Protection Act 1998, the UPN is designated as a ‘general identifier’ making its use for any purpose unrelated to education illegal. A pupil’s admission number, rather than the UPN, should be used as the general pupil reference number on the admission register or paper files. So I would not be outputting that to SAM Learning at all, we have just gone through removing the UPN from all our student record folders as well. Link to the UPN rules DFE UPN Doc Edited June 9, 2015 by Disease Added link to DFE Doc 1
matt40k Posted June 9, 2015 Posted June 9, 2015 @jbunoomally - that looks cool (https://www.gov.uk/government/publications/cyber-essentials-scheme-overview) - just a shame none of the main players are on it - https://www.iasme.co.uk/index.php/companies-certified 1
jbunoomally Posted June 9, 2015 Posted June 9, 2015 @matt40k - it's early days yet, but i always mention the scheme when engaging with new suppliers - in fact i did it this morning with one. We have had one supplier (Cascaid) who recently turned our paperwork around quickly and sent us a copy of their Cyber Essentials Plus certificate too. Kudos to them (pun intended ). JB. 1
Bernie Posted June 9, 2015 Author Posted June 9, 2015 (edited) Thanks for all the replies. In summary our argument to the parent will be we do not need individuals consent to authorise software companies to process data on our behalf. More detail below, can anyone see anything I’m missing / misinterpreting. I believe that this https://ico.org.uk/media/for-organisations/documents/1546/data-controllers-and-data-processors-dp-guidance.pdf makes it fairly clear that we are Data Controllers and the companies are Data Processors Looking at general principles Schedule 1 https://ico.org.uk/for-organisations/guide-to-data-protection/principle-1-fair-and-lawful/ “Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless – (a) at least one of the conditions in Schedule 2 is met” Schedule 2 - https://ico.org.uk/for-organisations/guide-to-data-protection/principle-2-purposes/ The relevant bits from here is Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. In practice, the second data protection principle means that you must: •be clear from the outset about why you are collecting personal data and what you intend to do with it; •comply with the Act’s fair processing requirements – including the duty to give privacy notices to individuals when collecting their personal data; •comply with what the Act says about notifying the Information Commissioner; and •ensure that if you wish to use or disclose the personal data for any purpose that is additional to or different from the originally specified purpose, the new use or disclosure is fair. Which we do in our Privacy Notice where we say "We hold this personal data to: - Support your learning;" (my bold) Edited June 9, 2015 by Bernie
Schoolcomms Posted June 9, 2015 Posted June 9, 2015 The other place you might want to take a look is here: Cloud Services and the data protection act - advice and supplier certification (from the DfE) 2
vikpaw Posted June 10, 2015 Posted June 10, 2015 @jbunoomally - that looks cool (https://www.gov.uk/government/publications/cyber-essentials-scheme-overview) - just a shame none of the main players are on it - https://www.iasme.co.uk/index.php/companies-certified Oh joy, why have a central list, when you can split the load and make people check in 3 different places?! 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now