GDPR - Capita Sims (Secondary school) and compliance

[WorksOnMyPC]

Afternoon guys,

 

Apologies if this has already been brought up. At our school were beginning our road to GDPR compliance and ive come across a sticking point.

 

Like 86% of schools in England we use Capitas Sims as our MIS and central data store. All data is keyed into it and all third parties (Groupcall, etc.) extract from it on scheduled tasks.

 

To become fully compliant with GDPR we must be able to not only prevent data breaches but also track them. After preliminary speaking to Capita it appears there's no inbuilt data auditing in Sims. It only logs when a user logs on, not what they look for or view. I appreciate there's third party ways of using database triggers etc. but they are not supported by Capita.

 

To be honest this scares me, we cant even start to be GDPR compliant if our central data solution doesn't do any auditing.

 

Has anyone already dealt with this? I am aware that Capita are pushing a new web based platform called "Sims Primary" that has full auditing, surely they cant expect all schools to move over to a new solution instead of fixing the current one?

 

Sorry for the long post,

Chris

[harry]

It's as if they have an online product to sell so you're compliant. And then once they've hooked you, raise the price.

[TechMonkey]

This has been brought up numerous times, even before GDPR was a thing. We raised it with Capita at a previous workplace and the response wasn't very helpful. So sorry, no help and I doubt Capita will help beyond sell you the new product.

[TwistedHelixis]

I remember years and years ago asking Capita why they do not track users within Sims. Same old same old

[WorksOnMyPC]

Cheers for the responses, Im not surprised to be honest.

 

Its saddening that all sys admins and data officers are going to be in the same place next May. Id be very surprised if Capita manage to launch a new solution and get all schools on board before the deadline. I've had experience with Capita based cloud solutions, its not a a day I look forward to.

[PhilNeal]

I can assure you that Capita will ensure that you can comply with GDPR once it becomes clear what that means! You will not be expected to move to SIMS 8 to comply. We have a very close relationship with the ICO.

[mikemcsharry]

I'm not sure that reponse about Capita is anywhere near timely enough.

In the same week that JD Wetherspoons took the corporate decision to delete their entire customer email list. They said 'as emails can sometimes be intrusive' Marketing consultants said 'The breech they had last year will cost them millions next year - risk vs cost'

Question for Capita - if users don't have to move will Sims still have the need for BDE (which, I'm sure was deprecated about 10 years ago) and if so how does this fit with GDPR suggesting most appropriate technology?

[PhilNeal]

The BDE isn't involved in the working of SIMS.

[pcstru]

This isn't just a problem for SIMS, I don't know of any MIS that tracks access to data in a meaningful way, nor technically do I know of a database schema which would survive every read operation demanding corresponding write operations (which is essentially what auditing read access would entail). But as @PhilNeal implies, it is not obvious that the GDPR demands such a solution.

 

I'd also query the solution. Tracking access should give you no particularly meaningful information if access controls are granular enough. If you have granted permissions for someone to access information and you then track some access to that information, the presumption is that access is legitimate. There is no way to differentiate legitimate access from something else. If you are tracking access to things someone should not have access to, then the problem is with access controls. Tracking may provide you with evidence of the scope of a data breach after the fact, but it will not tip you off to one unless your access control is insufficient in the first place. So if I was asking an MIS provider to invest their finite resources into helping us with GDPR compliance, I think I'm much more likely to be looking at access controls rather than being able to audit database reads at a very detailed level. Even that is a difficult thing to do since we are generally passing from table level access controls to protection in which access may need to be sensitive to the actual data (you can see data on this person, not this one). That is both difficult to build as software but it is even worse to administer and maintain properly (so be careful what you wish for!)

Edited July 6, 2017 by pcstru

[enjay]

Maybe I'm missing something here, but we can't track every access to data. Even if our MIS could do it, we couldn't track every time someone opens a Word doc or an email or looks at a piece of paper...

[PhilNeal]

We have a statement on GDPR on MyAccount. (https://myaccount.capita-cs.co.uk/hot-topics/sims-gdpr/)

 

The ICO is to publish guidelines on what they would expect of schools shortly. Until they do I think it is far from clear what the implications of GDPR are for all of us.

[Geoff]

From a technical point of view we had a similar issue with our own database based product here (non-edu). I retro fitted auditing to it using SQL Triggers. It took me about a week.

[Michael]

What we're all forgetting (regardless of MIS), is that it'll become law from mid next year, so really the onus is on developers to update their software to comply.

 

Now hypothetically speaking, if Capita (for example), were not to comply then really they as the solutions provider could expect fines or more. As above PhilNeal has clearly said they're awaiting guidance from the ICO, so I'm sure changes would/could take place as early as the Autumn 2017, Spring 2018 or Summer 2018 would still give enough time to comply.

 

In a way this already sort of happens with the DfE - they'll change/update the criteria what information is required from schools and all MIS providers update their software to comply.

[mjk]

Maybe I'm missing something here, but we can't track every access to data. Even if our MIS could do it, we couldn't track every time someone opens a Word doc or an email or looks at a piece of paper...

 

Google suite tracks access to every document in its system just fine.

[enjay]

Google suite tracks access to every document in its system just fine.

 

It does? In a way which can be audited/viewed?

 

Still doesn't help with auditing access to paper records though.

[TwistedHelixis]

Still doesn't help with auditing access to paper records though.

 

no but Sims is a digital entity and that was what the OP was asking about

[TwistedHelixis]

It does? In a way which can be audited/viewed?

 

As a G Suite administrator, you'll want to get a list of every time your domain's users view, create, preview, print, update, delete, download, or share Drive content. You'll use the Drive audit log to collect this information. The Drive audit log includes content your users create in Google Docs, Sheets, Slides, and other G Suite applications, as well as content created elsewhere that your users upload to Drive, such as PDFs and Word files.

 

So yes it does

[enjay]

Hmm, so it does. I don't think I knew about that. Thanks.

 

Still seems a bit odd to introduce rules about auditing digital files when there's no ability to audit paper files, but there you go...

[jthompson]

Hmm, so it does. I don't think I knew about that. Thanks.

 

Still seems a bit odd to introduce rules about auditing digital files when there's no ability to audit paper files, but there you go...

 

I think it comes down to the fact that it's a lot harder for hundreds/thousands of paper documents to make their way into the wrong hands in bulk without anyone noticing, compared to their digital equivalent.

[enjay]

I think it comes down to the fact that it's a lot harder for hundreds/thousands of paper documents to make their way into the wrong hands in bulk without anyone noticing, compared to their digital equivalent.

 

Fair point. I would (probably) notice paper files going missing, plus those can be accessed more covertly.

 

We still can't audit things like our MyDocs folders though, let alone staff home computers or memory sticks. So, does that make all of us non-compliant?!

[TwistedHelixis]

We still can't audit things like our MyDocs folders though, let alone staff home computers or memory sticks. So, does that make all of us non-compliant?!

 

Sims holds childrens and parents confidential information. If your MYDocs, home computers or memory sticks also hold data covered by GDPR you should be looking at taking control of these devices. USB keys should be encrypted, Mydocs should be controlled via a server, not sure what to say about the home computers as all our staff can only use school approved devices.

[TwistedHelixis]

I always approach these things from a worst case view. what would happen if USB get lost, what would happen if laptop got stolen, what would happen if the home computer is a shared computer....... the list goes on

[localzuk]

We still can't audit things like our MyDocs folders though, let alone staff home computers or memory sticks. So, does that make all of us non-compliant?!

Why not? You can enable auditing of file access via GPO. https://technet.microsoft.com/en-us/library/cc771070%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396

[WorksOnMyPC]

As part of the bigger plan were looking into fully auditing file access on O365 and on prem using some third party tools.

 

Regarding pen drives were working towards forcing all staff pen drives to be either hardware or software encrypted.

 

Also blocking dropbox, gmail etc and only allowing authorised email accounts which we can monitor, audit and if needed shutdown

 

All these things are in our control!

[enjay]

If your MYDocs, home computers or memory sticks also hold data covered by GDPR you should be looking at taking control of these devices. USB keys should be encrypted, Mydocs should be controlled via a server, not sure what to say about the home computers as all our staff can only use school approved devices.

 

Access to all of those is controlled, and sensitive data on memory sticks/home PCs is (or rather, should be) password-protected, so access is controlled but in a non-auditable way, although we have no way of knowing/ensuring sensitive data IS password-protected, we just have the code of conduct which says it must be.

 

all our staff can only use school approved devices.

 

So teachers having school-owned laptops or VPN access is the only way to comply?