UPN - Show my Homework

[matt40k]

There is when it is purchased by LAs, Academy groups or MATs that look at progression.

What's wrong with School System ID (with MAT \ LA) + PupilSystemNo? Then it limits it to that group rather then the whole of the UK. Unless folks have pretty lax data sharing agreements??

[enjay]

Same as our NI number it's our unique identifier which ties to us.

The difference there is my new employer has a reason to know my NI number and I have a reason to tell them - tax and NI contributions plus any benefits, tax allowances, child maintenance payments, CCJs, student loans, etc. all relate to me not the employer (indeed, the employer won't actually know about many of these) and it is therefore important for various bodies to be able to track me from one job to the next. Other than not having to re-register with Show My Homework when my child moves schools, I don't see the benefit of them knowing that Timmy Enjay in School B is the same Timmy Enjay who used to attend school A.

[matt40k]

Just FFS don't store the NI number in AD!

[TechMonkey]

Parent Pay too.

 

It's a unique identity for students who change schools and don't lose everything. We've had it here with a few things especially Parent Pay. Students/parents have transferred over and didn't lose anything in fact was a much smoother process for them.

 

It's not 'necessary' but it's a convenience. It can also help to avoid problems. If you have a unique identifier which we used to use for Parent Pay, come August that number will change because it was only unique to us. That altered and caused endless of problems for those products that automatically took SIMs uploads. So again we use the UPN because it's a number that doesn't change. If a child leaves us and their 00101092 number generated by the school is sent to another school that already has another student with that number ERROR won't import. The link between schools exists - it's called the UPN for the MIS systems. It means no matter what a student can't be mistaken for another one even with the same names and even same parent names.

 

Don't know about other schools but in my experience we can have anything from 20 to 60 student changes a year coming/going to/from other schools. That UPN is a must have for the data system let alone tied to external providers.

 

Same as our NI number it's our unique identifier which ties to us.

 

It would be convenient if the bank just left their vault open so I can go get my money when I want it, but that isn't going to happen.

 

As I mentioned before, it is possible to transfer details between schools without the UPN it is just the system creators being lazy and not making it happen, rather depending on information they should not have. There are a million and one ways to create a unique key to identify a pupil that does not need their UPN.

 

I have never been asked to use my NI number as a unique key though. My bank don't use it, the supermarket don't use it, even my work place don't use it as an identifier.

[Stutwo]

CPOMS is another I believe. It flags when students move between schools and transfers all records if both parties agree.

[enjay]

I believe Tucasi uses UPN.

 

It does, but that's installed on the server (at least, ours is) so doesn't ever leave the school. We've therefore not given Tucasi the company any UPNs.

[enjay]

(quoting DfE) "The data protection restrictions associated with UPNs mean that it is only possible for UPN data to be shared by CTF between schools/academies, LAs, DfE and other prescribed government departments (OGDs)."

 

Hang on. Doesn't that prevent schools from using hosted MIS providers???

[pcstru]

Hang on. Doesn't that prevent schools from using hosted MIS providers???

 

Page 1, post #10.

 

In that context, it is being used as it should be; it will be stored as data with the student and processed with CTF and ASC functions. A data subject might reasonably expect that because that is what the guidance says.

 

The worst response I have had on this is from PiXEL with their Edge product. They have it right in one sense, it is not actually their problem and they are doing nothing wrong as such because YOU are the data controller [*1]. Whatever they do with the data, they do it on your behalf (and if you don't realise they allow school to school transfer of YOUR data) tough! Hopefully the GDPR will bring them to heel as it imposes more responsibility on suppliers to play fair and give explicit undertakings about the processing they do.

 

Another product that uses (or certainly used to use) UPN for matching was Capita's B2B product. I wonder if that is an issue (or is it even used anymore?).

 

[*1] With UPN it can be useful to think of the Secretary of State as being the Data Controller specifically for UPN and the School is acting as a third party when processing that data. Sec State says you can only process it in very specific ways just as you (should be able to) say to suppliers what they can and cannot do with YOUR data (data for which you are the controller).

[pcstru]

I contacted SMHW. They said they are removing UPN from the data extracts and will remove the data from their systems in August. I'm waiting to get that response in writing.

 

So a little update on this. Today I spoke to the founder and CEO about this. They understand the problem and are working to address it. They have to liaise with Groupcall - who provide the MIS sync tool (which many other providers use) so that may prompt action elsewhere. So far I'm impressed with the response by SMHW to this issue; I'd describe it as mature and understanding where the temptation must be (and others have been) to be defensive and protective. The CEO indicated they would get a formal response to me next week and I will ask that they allow me to post it here.

[enjay]

I also raised this question with GCSEPod. Within 24 hours, they updated our Groupcall extract and deleted all our UPNs from their system. I got the sense they did this just for us not all their customers, so I think they missed the point slightly though.

 

Again, very professional response (especially since the error was ours in giving them the data in the first place!).

[GREED]

We (Groupcall) have a statement on this topic, which for clarity have posted separately here:

 

http://www.edugeek.net/forums/data-protection-information-handling/186289-gdpr-upn-use-statement-groupcall.html#post1595335

[enjay]

Further conversation with GCSEPod and Groupcall on this. The Groupcall script for GCSEPod does extract UPNs from SIMS, but there is a token on the job which can be used to suppress them from what is actually sent to GCSEPod. This means although the UPN is extracted from SIMS it never leaves the school. Happy days!

[MkII]

Further conversation with GCSEPod and Groupcall on this. The Groupcall script for GCSEPod does extract UPNs from SIMS, but there is a token on the job which can be used to suppress them from what is actually sent to GCSEPod. This means although the UPN is extracted from SIMS it never leaves the school. Happy days!

 

Sorry to resurrect an old thread.

 

I'm just stepping through the DP agreement with GCSEPod and the fist page of the agreement states, with no option to disagree:

 

Access to student UPN and former UPN data

 

 

As far as I can see, access to the data is sharing it. It doesn't matter if they download it. Accessing it seems to be good enough to break Data Protection.

 

I've replied to the invite email asking about this.

[enjay]

Didn't DfE relax their view on sharing UPNs?

I'd be more interested in why GCSEPod feel they need to know about additional student funding. I don't see why they need to know whether a student is FSM or PP in order to show them a revision video about Romeo and Juliet.

[SimonHooker]

If you take a look at the guidance I believe it's covered under section 2.2. There are requirements for the school to retain ownership of the data however it appears to stipulate that the UPN is usable for providers of additional packages supporting the management of a pupils education which should cover most of these third parties.

 

I am not a lawyer though, and so far the only third party I've dealt with which uses UPN is Vivo rewards. Unfortunately this means that, for the 1 school we deal with which uses Vivo, we also need to request the UPN. We do not extract UPN for any other schools though and in an ideal world for Vivo I would prefer to find another way!

[enjay]

We do not extract UPN for any other schools though and in an ideal world for Vivo I would prefer to find another way!

 

Does it have to be the UPN you extract? We have something here which extracts the UPN into a field labelled "UPN" in the XML export, but you can export any field you want and label it UPN, so we export the admission number and label it UPN. Everyone's happy!

[SimonHooker]

Does it have to be the UPN you extract? We have something here which extracts the UPN into a field labelled "UPN" in the XML export, but you can export any field you want and label it UPN, so we export the admission number and label it UPN. Everyone's happy!

 

I work for a third party, and the school in question had their Vivo account set up well before we had any involvement. It may well be that it could be changed, but it's not something that - in this instance - I can change, and so I just do the best I can and make sure to store the data securely / prevent its exposure through our system.

[MkII]

From GCSEPods Data Sharing Agreement:

 

[enjay]

From GCSEPods Data Sharing Agreement:

 

[ATTACH=CONFIG]49010[/ATTACH]

 

That's all well and good, but surely GCSEPod should only be measuring the impact by key demographics if we have asked them to. I suppose, it is data you choose to share with them when you set up the exporter, so you have the option to withold it there (which is what we've done, as we aren't interested in the ratio of PP:non-PP users of GCSEPod.

[MkII]

GCSEPod are saying that taking that data (pictured) is optional to them.

 

I believe you are referring to optional fields rather than mandatory fields. This means that we do not require this information in order for GCSEPod to work correctly and unless selected, XOD will not extract.

 

The agreement is worded very much like they are telling us what to do rather than acting under our control.

 

[MkII]

That's all well and good, but surely GCSEPod should only be measuring the impact by key demographics if we have asked them to. I suppose, it is data you choose to share with them when you set up the exporter, so you have the option to withold it there (which is what we've done, as we aren't interested in the ratio of PP:non-PP users of GCSEPod.

 

I just don't like that we are agreeing to give it to them. If we withhold it aren't we breaking that agreement. Their agreement is very much a legal document.

[enjay]

We have all students selected on that screen you put in your recent post, but a bit further on in the setup, I think you get the option to select which fields are uploaded and we haven't ticked SEN, etc.

[MkII]

We have all students selected on that screen you put in your recent post, but a bit further on in the setup, I think you get the option to select which fields are uploaded and we haven't ticked SEN, etc.

Hmm. I thought that second screen was it.

[enjay]

Hm, you could be right. I might be thinking of SAM Learning where you can select what to share with them...

[enjay]

I thought it was possible in XOD to see what data we're sharing with the processors, but I can't figure that out. Any ideas?