DNM Posted February 6, 2017 Posted February 6, 2017 Hi All, This is going to be a quick question for someone out there that know alot about this. I can't find an straight forward answer to the question. Are we as Schools / Acdemies in the UK allowed to store Student / Parent Personal data outside of the EU? I'm going with No as the answer but I have been asked to try and find out the answer to the question. Is there a document that gives details of this? Kind Regards,
elsiegee40 Posted February 6, 2017 Posted February 6, 2017 Hi All, This is going to be a quick question for someone out there that know alot about this. I can't find an straight forward answer to the question. Are we as Schools / Acdemies in the UK allowed to store Student / Parent Personal data outside of the EU? I'm going with No as the answer but I have been asked to try and find out the answer to the question. Is there a document that gives details of this? Kind Regards, Short answer, no. I am sure someone can give you full chapter and verse shortly. @GrumbleDook are you about?
fiza Posted February 6, 2017 Posted February 6, 2017 (edited) Excerpt from the ICO website guidanceThe DPA requires that personal data “shall not be transferred to any country or territory outside the European Economic Area (EEA) unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.” https://ico.org.uk/for-organisations/education/ What you need is toward the bottom of that website page. Edited February 6, 2017 by fiza
robyholmes Posted February 6, 2017 Posted February 6, 2017 This should be what you looking for: https://www.gov.uk/government/publications/cloud-software-services-and-the-data-protection-act
GrumbleDook Posted February 6, 2017 Posted February 6, 2017 Hi All, This is going to be a quick question for someone out there that know alot about this. I can't find an straight forward answer to the question. Are we as Schools / Acdemies in the UK allowed to store Student / Parent Personal data outside of the EU? I'm going with No as the answer but I have been asked to try and find out the answer to the question. Is there a document that gives details of this? Kind Regards, Firstly, Principle 8 states Personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. Secondly, there are other countries outside of the EEA where it can be transferred. https://ico.org.uk/for-organisations/guide-to-data-protection/principle-8-international/ gives more details about it. Thirdly, there are several countries that data can be transferred to and https://ico.org.uk/for-organisations/guide-to-data-protection/principle-8-international/#adequate gives more details And finally ... even then, you can also use other countries if the following hoops can be jumped https://ico.org.uk/for-organisations/guide-to-data-protection/principle-8-international/#not-approved So it all boils down to risk assessment. In short, for a lot of schools ... it is a no, because they haven't done the risk assessment. It is possible to do it, and it does need consideration. The paper on cloud services from HM Gov't goes some way to doing the risk assessment for you ... but it is a self-certification for those companies on there. 1
DNM Posted February 7, 2017 Author Posted February 7, 2017 Hi Guys, Thank you very much for your answers. Would the same apply for email system generated passwords and documents home to parents that contain student data. So for example we could use a US email server to send the information out? I will be reading all of the attachments that you all have provided. Kind Regards,
GrumbleDook Posted February 7, 2017 Posted February 7, 2017 Hi Guys, Thank you very much for your answers. Would the same apply for email system generated passwords and documents home to parents that contain student data. So for example we could use a US email server to send the information out? I will be reading all of the attachments that you all have provided. Kind Regards, The US is an interesting one at the moment as Privacy Shield has had a roasting. However, if the company involved delivers the services as per the EU's Model Clauses then that is fine. If it is $random_web_host, then probably not.
elsiegee40 Posted February 7, 2017 Posted February 7, 2017 Hi Guys, Thank you very much for your answers. Would the same apply for email system generated passwords and documents home to parents that contain student data. So for example we could use a US email server to send the information out? I will be reading all of the attachments that you all have provided. Kind Regards, Yes. This affects all data including email
elsiegee40 Posted February 7, 2017 Posted February 7, 2017 I recommend that you read the Dfe document linked to in this thread http://www.edugeek.net/forums/cloud-services/159257-dfe-guidance-cloud-software-services-how-schools-should-protect-data.html You may find this useful too http://www.edugeek.net/forums/school-ict-policies/174127-data-sharing-statutory-code-practice-guidance.html
PotNoodleTech Posted February 7, 2017 Posted February 7, 2017 Whats going to happen when we leave the EU? Will we only be able to store data in the UK?
GrumbleDook Posted February 7, 2017 Posted February 7, 2017 Whats going to happen when we leave the EU? Will we only be able to store data in the UK? The ICO is reviewing this at the moment. The probability is that Model Clauses will win out until new legislation is in place.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now