Sharing data

[CapnPugwash]

Hi,

 

There has been talk of our school sharing sensitive data with some other local schools & I've been asked to look into it.

 

We already use O365 so I think that would be the preferred method. Off the top of my head I'm thinking a sharepoint site, we could issue the other schools with usernames & passwords to access it and we use some form of file encryption so even if someone did gain access, they wouldn't be able to get at the data.

 

Has anyone had to do anything similar? Suggestions on what to do / what to avoid , much appreciated.

[jbunoomally]

Slight tangent to the technical side; but are you different Data Controllers/is this data sharing within the scope of your privacy notice? Do you have a data sharing agreement and vetting of who will access the data from where and how to maintain CIA principles?

JB.

[CyberNerd]

 

Has anyone had to do anything similar? Suggestions on what to do / what to avoid , much appreciated.

 

Yes absolutely we've been doing this for a number of years. Very simple with GAFE, just whitelist the external school:

https://support.google.com/a/answer/6160020?hl=en

 

As a Google Apps administrator, you might have users who want to work together in certain Google products with users outside your business or school. You can allow file sharing in Google Drive for organizations that you trust by whitelisting their domain. After you whitelist a domain, you then grant Drive access so that users in your organization can share files and folders with users in the trusted domain.

 

Users can view, comment on, and edit any shared files. A warning message is turned on by default that asks users to confirm before they share files with a trusted domain. By granting access, you also allow users outside of your organization to share files and folders with users in your domain.

 

In Google Apps for Education, whitelisting domains for Classroom lets you allow users in trusted domains to join classes in your domain. It also allows your users to join classes in the domains that you trust.

 

[CapnPugwash]

Hi, Thanks for your replies

 

JB : I've already flagged these issues up. *Hopefully* if they want to push ahead, there will be some kind of design process that will highlight the need to get all the non-tech stuff (policies, legal issues etc) cleared and concluded before I even start.

 

CyberNerd : We have a sharepoint site set up that allows people here to collaborate on documents with an external agency. Access is restricted / controlled - So I know it's possible, I'm interested to know how secure the data is and how can I make it more secure.

 

The documents that are currently shared are not sensitive, if someone unknown gained access to them it would not be an issue. The new project that I have been asked to think about is a different kettle of fish.

 

I know there is no perfect answers here... The project will involve a number of people and people sometimes do stupid things!

[GeekyDad]

Sharing personal data is more of a compliance issue than a technical issue.

 

There is guidance from the ICO here: https://ico.org.uk/for-organisations/guide-to-data-protection/data-sharing/

 

Sensitive data (which includes ethnicity) is subject to extra requirements: https://ico.org.uk/for-organisations/guide-to-data-protection/conditions-for-processing/#conditions-sensitive-data

 

The ICO's 12 step guide to GDPR compliance (Brexit notwithstanding) offers guidance on upcoming data protection/security obligations: https://ico.org.uk/media/for-organisations/documents/1624219/preparing-for-the-gdpr-12-steps.pdf

 

The obligations around consent are particularly relevant. Full end-to-end encryption of all shared data seems to be a minimum desirable standard.

 

Interesting debate on data abuse recently caught the eye: Jail data abusers says Culture, Media and Sport Committee report - News from Parliament - UK Parliament