UPN - Show my Homework

[MkII]

Me neither. I just watched their video and the only control you have is to exclude individuals from data collection. There is no control over the data elements at all.

[MkII]

Just got an email from someone higher up at GCSEpod. A little concerning that this is a hidden agreement that you appear to sign your rights away to before they let you see that wait, we were only kidding...

[3s-gtech]

You're not selling this to me very well!

[MkII]

Damn straight

 

Email today...

 

"Thank you for your email.

 

The video you mention, and the process, are all made and controlled by Groupcall whom we sub-contract to do data processing on our behalf.

 

We have had numerous meetings with Groupcall over very many months, working with them to make the video and pages as clear as possible; however Groupcall are producing a process which suits ALL their partners, not just us, and as a result they have to build in an element of genericism. This genericism does somewhat work against us as, unlike many other companies, we do offer a huge amount of control for our subscribing schools.

 

The way the pages are written is deliberate so that they can apply to any Groupcall partner, and that’s why the wording they’ve chosen (despite going through iterations to try and make it as clear as possible) still does not outline explicitly the specific GCSEPod process and instead regularly refers to our data sharing agreement whichhasbeen written specifically by us.

 

I have personally spent much time with Groupcall trying to create more bespoke messages but, understandably, they are building a system for multiple partners and the level of “bespokeness” available is limited. Groupcall have been very accommodating and made some significant improvements on our request.

 

I have taken your feedback on board and I hope that the PowerPoint attached which I shared with you was useful. This was created by myself to try and guide the user through the process from a specifically “GCSEPod Perspective”.

 

We are limited by Groupcall’s system and so have had to produce additional resources, such as the attached document, for those schools that would like further guidance."

 

______________________________

 

 

If GDPR was meant to be clear and transparent, groupcall are failing miserably here.

 

It took emails to get past two people who told me to RTFM before getting to this person that knew what she was talking about and admitted that the process was misleading.

Edited May 19, 2018 by MkII

[GREED]

Dear @MkII

 

Thank you for your comments on the XoD data authorisation process. Allow me to answer some of your points:

 

Groupcall work collaboratively with all data partners including GCSEPod (as they have mentioned in this thread) to ensure GDPR compliance in the processing and sharing of schools’ data. The process that is in place now between GCSEPod and Groupcall (and all partners using XOD) is GDPR compliant, both between the two data companies and on behalf of schools using these services (specifically, the data authorisation and sharing of data).

 

The use of scoped data areas/information domains that partners request schools provide authorisation for is very similar to the methodology adopted by most of the main UK MIS providers when providing access to any API integration services such as individual products or services like Xporter on Demand. Combining the authorisation of the data scope areas and partners use of our functionality to only request specific fields from those scopes, places control over what data is being processed firmly with the school as it should be. In that regard GCSEPod is an example of a good implementation, with suppliers working together to ensure the best available data protection coverage. It’s also worth adding that some of our data scopes are for sensitive single fields only, like UPN, religion and ethnicity so that you have full granular control over them.

 

The ability for XoD to control access to individual specific fields for a given partner is functionality that is being given careful and ongoing consideration by our team and has been for the past 12 months or so – we (Groupcall) need to ensure that any implementation of this strikes a practical and technical balance between providing appropriate and straightforward controls to schools as Data Controllers without being so complex as to increase the chances of configuration accidents or impact on education delivery. As mentioned above, the combination of the balanced access to carefully constructed information domains, along with the ability for partners to select only the fields they need from those information domains, already provides a flexible and working solution to ensure technical implementation of the written Data Sharing Agreement between the Data Controller (school) and the Data Processor (partner) is accurate and correct.

 

The key thing is that GDPR does not end on May 25th, it merely starts! Past this date we will of course continue to make our services better and provide more compliance tools based on partner and school requirements and based on how case law and the ICO clarify GDPR implementations over the next few months.

 

With regards the transparency you mention, we’ve tried to be as clear and transparent as possible during the authorisation process and our platform details what you are doing, agreeing to and authorising. To support that transparency we’ve also developed our free School Portal that details not only Xporter on Demand but also Xporter usage in your school, and a further update to that portal is due this week which includes visibility of data fields that are available to be processed per partner ( @enjay I think this is what you’re waiting for).

 

Feedback is of course always welcome and is part of the continual improvement processes that make up all data protection compliance not just GDPR specifically.

 

Hope that helps.

 

Graham

Head of Products, Groupcall

[enjay]

With regards the transparency you mention, we’ve tried to be as clear and transparent as possible during the authorisation process and our platform details what you are doing, agreeing to and authorising. To support that transparency we’ve also developed our free School Portal that details not only Xporter on Demand but also Xporter usage in your school, and a further update to that portal is due this week which includes visibility of data fields that are available to be processed per partner ( @enjay I think this is what you’re waiting for).

 

Hi Graham,

 

Yes, that does sound like what I was after. I knew a portal was coming so when I got an email on 10th May saying it was live, I figured it was fully live not just partly. I look forward to this week's update.

[MkII]

Thank you Graham. I think it was clearer before

[Ashfold]

We just don't give MLS the UPN for Reading cloud and it still works

[enjay]

Me neither. I just watched their video and the only control you have is to exclude individuals from data collection. There is no control over the data elements at all.

 

@MkII GCSEPod have just sent me a link which allows me to select which data elements are extracted by XOD. This allows you to (de)select UPN, PP status and so forth. I suggest you ask them for the same so you can check what you're sending them.

[MkII]

@MkII GCSEPod have just sent me a link which allows me to select which data elements are extracted by XOD. This allows you to (de)select UPN, PP status and so forth. I suggest you ask them for the same so you can check what you're sending them.

 

Thanks enjay. Once you've past the initial agreement 3 pages you get to a screen where you're able to opt in to the sensitive data collection for GCSEPod. Everything else is mandatory, but none of us should have a problem with those.

 

GCSEPod have said that the explanation will be made clearer to new sign ups from now on. Helen, that was emailing me was very clear in explaining it.