UPN - Show my Homework

[pcstru]

Doe anyone know why "show my homework" slurp UPN from the MIS system and what processing is done with it?

[synaesthesia]

Unique identifier that stays with the child, so should the child move to another SMH school the data/account goes with them.

[TechMonkey]

Unique identifier that stays with the child, so should the child move to another SMH school the data/account goes with them.

 

The DoE specifically state the UPN should not be shared.

 

If a person requests a UPN but has no clear parental responsibility for the child whose UPN they wish to access, this should be refused immediately.

 

The data protection restrictions associated with UPNs mean that it is only possible for UPN data to be shared by CTF between schools/academies, LAs, DfE and other prescribed government departments (OGDs).

Pages 16 & 17 UPN Guidance - gov.uk

Edited July 4, 2017 by TechMonkey

[Disease]

Show my homework should not need the UPN, I am pretty sure that according to the DfE you should not give out the UPN to 3rd party companies.

[CAM]

But is there really any other way for SMHW to identify a child after a school move? MIS unique ID will only work on a per site basis.

[pcstru]

But is there really any other way for SMHW to identify a child after a school move? MIS unique ID will only work on a per site basis.

It is very handy having a unique national identifier that private companies can use to build functionality that to help sell their systems. It is just a shame that, as far as I can see, they really should not be doing that.

[synaesthesia]

Was going to say; would therefore every MIS system be falling foul of this?

[TechMonkey]

They could very easily create a system that allows schools to transfer a pupil between schools, Tapestry does it in their Early Years software. It's just laziness.

 

It is very handy for private companies to identify pupils across platforms to target and market to schools, or parents, better, but that is why we have Data protection laws.

[synaesthesia]

Still, neither I or our NM have ever heard of this. I assume this isn't new? I could probably shout 4 or 5 systems that I know use the UPN and up until now wouldn't have given it a second thought!

[pcstru]

Was going to say; would therefore every MIS system be falling foul of this?

In that context, it is being used as it should be; it will be stored as data with the student and processed with CTF and ASC functions. A data subject might reasonably expect that because that is what the guidance says.

 

The issue is that SMH are processing UPN to create a unique national identifier for their own purposes. A data subject will not reasonably expect this to be happening if they are familiar with the guidance on UPN's; after all the guidance is even reluctant to hand UPN over to the data subject. If it isn't reasonable for a data subject to assume their data will be processed in this way, then it cannot be fair processing.

 

There is a question then as to what actual data transfers to the other school (data that is not within CTF or ASC so data that is being processed to be transferred). The homework itself might constitute sensitive personal data (an essay on personal health etc) but what about marking and teacher comments? Exactly what is being passed on and do we know about it so we can inform our data subjects so that the processing is fair (as required by the DPA).

Edited July 4, 2017 by pcstru

[TechMonkey]

Still, neither I or our NM have ever heard of this. I assume this isn't new? I could probably shout 4 or 5 systems that I know use the UPN and up until now wouldn't have given it a second thought!

Sorry can't help you there, the current guidelines have been published since 2013.

[pcstru]

Still, neither I or our NM have ever heard of this. I assume this isn't new? I could probably shout 4 or 5 systems that I know use the UPN and up until now wouldn't have given it a second thought!

Please do. It will be useful for anyone doing a GDPR audit and hopefully the work we all need to do to comply with GDPR will put an end to these abuses.

[synaesthesia]

I'll go through all the systems we have here and at primaries and double check before naming names. Indeed it will be useful for GDPR audits and compliance!

[synaesthesia]

Definite:

MLS - Junior Librarian/Eclipse

Classroom Monitor

MyConcern

ShowMyHomework

Everything that uses Wonde.

[denzal2k4]

Purplemash / 2Simple (Primary)

 

I've raised a query from SMHW, I'll update if I get an answer.

 

Thanks

[pcstru]

I contacted SMHW. They said they are removing UPN from the data extracts and will remove the data from their systems in August. I'm waiting to get that response in writing.

[synaesthesia]

I've fired requests off to MLS and Wonde this evening, hopefully will get some response.

[Edu-IT]

I believe Tucasi uses UPN.

[GrumbleDook]

The problem is trying to get a unique identifier that will track across a student's life in a school, or even between schools (conversations about that become quite interesting when dealing with national projects)

[enjay]

The problem is trying to get a unique identifier that will track across a student's life in a school, or even between schools (conversations about that become quite interesting when dealing with national projects)

 

Why is that necessary though? I can see why some organisations need this data, Fischer Family Trust come to mind immediately, but unless I'm missing something, there's little benefit to the child of SMH making the link between their schools.

[enjay]

Other companies using UPNs:

GCSEPod

Access-It

[synaesthesia]

The only solid reason anything should need to track UPN through school life is examination/regulatory board data, which is already done via secure methods anyway and perfectly legal. And whilst it could be useful for homework systems to track from one school to another, I don't know how that would work with schools differing sign-in systems etc. The guidance says admission number should be used instead which seems fair enough.

 

Edit: MLS have stated they have an option in their software to disable the requirement of the UPN however, and I copy and paste from their email:

"However, the GroupCall MLS Connect product appears to be ignoring this option."

Considering Groupcall merely installs & runs a report from SIMS I'm not sure how that's the case. They have asked me to confirm my preference to remove this data though and remove that requirement which they will do.

Edited July 5, 2017 by synaesthesia

[GrumbleDook]

Why is that necessary though? I can see why some organisations need this data, Fischer Family Trust come to mind immediately, but unless I'm missing something, there's little benefit to the child of SMH making the link between their schools.

 

There is when it is purchased by LAs, Academy groups or MATs that look at progression.

[Lonix]

Why is that necessary though? I can see why some organisations need this data, Fischer Family Trust come to mind immediately, but unless I'm missing something, there's little benefit to the child of SMH making the link between their schools.

 

Parent Pay too.

 

It's a unique identity for students who change schools and don't lose everything. We've had it here with a few things especially Parent Pay. Students/parents have transferred over and didn't lose anything in fact was a much smoother process for them.

 

It's not 'necessary' but it's a convenience. It can also help to avoid problems. If you have a unique identifier which we used to use for Parent Pay, come August that number will change because it was only unique to us. That altered and caused endless of problems for those products that automatically took SIMs uploads. So again we use the UPN because it's a number that doesn't change. If a child leaves us and their 00101092 number generated by the school is sent to another school that already has another student with that number ERROR won't import. The link between schools exists - it's called the UPN for the MIS systems. It means no matter what a student can't be mistaken for another one even with the same names and even same parent names.

 

Don't know about other schools but in my experience we can have anything from 20 to 60 student changes a year coming/going to/from other schools. That UPN is a must have for the data system let alone tied to external providers.

 

Same as our NI number it's our unique identifier which ties to us.

[synaesthesia]

Maybe, however we also need to comply with the rules, especially with everyone's favourite buzzword/acronym flying round at the moment. As it stands, the government tell us it's illegal to do what most of us have been doing for years; at least it has been for the last 4 years certainly. Is it something that needs raising with DfE? Or do we need to continue to ensure noone else holds UPNs? Until something else is clarified or verified I see no option other than the latter regardless of how convenient it may be.