GDPR Data Protection and Memory Sticks

[MkII]

Interesting thanks. Our HT has forbidden staff obvious use of phones in front of pupils if at all possible.

 

I just had our maths teacher ask again as he was using an iPad with Plickers in front of an inspector and they both thought the iPad was a bit slow. The teacher has replaced all names with numbers now so absolutely no personal data is transferred. The extremely simple QR codes held up as cards by the pupils are scanned and uploaded to the website to produce an instant vote.

[machin05]

Can you allow the readers but only let the staff use them? Students give the card to the teacher, teacher copies the files off and emails them to the student.

 

Want to avoid this, to be honest, as it's more work for the teaching staff considering they have up to 10 cameras out in use at any one time.

 

- - - Updated - - -

 

We tell staff to use their iPads. School property, and wifi-enabled so photos can be emailed or uploaded to Drive, no faffing with cables.

 

Unfortunately, not an option here!

[machin05]

Sadly staff don't have iPads here, the shared iPads we do have are always in high demand!

 

I think we should be OK, I'm going for the option of 'prompt to encrypt', which the user can cancel and still read the drive, just not write to it. Needs to be tested though.

 

How do you facilitate that?

[enjay]

School policy. I did initially argue against it, because why supply staff with cameras when every one of them already has one in their pocket? But then the very good point was raised of what happens if a teacher is ever brought to question and that's on their phone, or they lose their phone with those images on... Basically safest not to, for the liability it could place on staff as much as anything.

 

School policy here too, because personal devices might do all sorts of clever things with file streams and/or cloud backups when you take photos. My personal phone, for example, automatically backs up any photos I take to Google Photos and from there the photo goes to my laptop via Sync and Backup. So, the end result is any photo I take in school would be on my home laptop for my family members to see within minutes of being taken. Any iStuff with Photo Stream set up would do the same, of course.

[DavR]

How do you facilitate that?

 

I *think* it was these settings, it's a while since I ran testing and like a fool forgot to write it down!

 

Computer Policy | Admin Templates | Windows Components | Bitlocker Drive Encryption | Removable Data Drives

 

Deny write access to removable devices not encrypted with Bitlocker - Enabled

 

Configure use of passwords for removable devices - configured and 'Require password' ticked.

 

You'll want to go through and configure various other bits of the Bitlocker policies, but these two settings should cause the 'prompt for encryption, otherwise read only' behaviour discussed.

[DavR]

School policy here too, because personal devices might do all sorts of clever things with file streams and/or cloud backups when you take photos. My personal phone, for example, automatically backs up any photos I take to Google Photos and from there the photo goes to my laptop via Sync and Backup. So, the end result is any photo I take in school would be on my home laptop for my family members to see within minutes of being taken. Any iStuff with Photo Stream set up would do the same, of course.

 

Pheeeeeeew. Automatic uploads and sharing, another reason to not allow staff to use personal devices!

[machin05]

I *think* it was these settings, it's a while since I ran testing and like a fool forgot to write it down!

 

Computer Policy | Admin Templates | Windows Components | Bitlocker Drive Encryption | Removable Data Drives

 

Deny write access to removable devices not encrypted with Bitlocker - Enabled

 

Configure use of passwords for removable devices - configured and 'Require password' ticked.

 

You'll want to go through and configure various other bits of the Bitlocker policies, but these two settings should cause the 'prompt for encryption, otherwise read only' behaviour discussed.

 

Awesome, thank you!

[DavR]

Interesting point re Bitlocker and cameras.... I've just tested, and while it does prompt to encrypt when plugged in, Bitlocker fails to encrypt because the cameras are write protected. Cameras I tested with were Panasonics.

 

I'd rather exclude the cameras from Bitlocker policies altogether, but this doesn't look to be possible using just group policy, so the fact they fail is a handy safety net against accidental encryption I guess.