GDPR & UPN use - Statement from Groupcall

[GrumbleDook]

Except that it is down to a school to consider whether it has been automatically adjunct editor to a pupil's name or if it has added as part of a reasoned requirement... so it is still the school's decision.

 

The problem is that many schools have little experience of performing risk-management on suppliers to cover areas like this.

[GREED]

@EdWhittaker - you mean if you ignore:

 

"The UPN must be a ‘blind number’ not an automatic adjunct to a pupil’s name. It must be held electronically and only output when required to provide information to the LA, central government or another school/academy to which the pupil is transferring. Under the Data Protection Act 1998, the UPN is designated as a ‘general identifier’ making its use for any purpose unrelated to education illegal. A pupil’s admission number, rather than the UPN, should be used as the general pupil reference number on the admission register or paper files."

 

and....

 

"The data protection restrictions associated with UPNs mean that it is only possible for UPN data to be shared by CTF between schools/academies, LAs, DfE and other prescribed government

departments (OGDs)."

 

Yes if you compteley ignore the statements made in writing by the DfE in their guidance document then it would be the case that they have not said no. Apart from where they did actually say no in writing.

So the guidance they sent this month... Is wrong? We ignore that?

[Primus]

The guidance they sent doesn't help much since:

 

a. they're not amending or republishing the guidance - guidance which is approved at the highest level - we have no way of knowing from where the more recent email guidance came from or who approved it

 

b. they're still saying the onus and responsibility falls on schools

 

c. none of you actually need it - you can fulfil your roles and systems without the UPN by substituting an alternative - it's just it comes down to a business decision on implementation costs.

 

Absent of proper updated guidance properly published by the DfE I would not be happy sharing the UPN with a company and to safeguard myself would require the most senior member of staff within the school/academy to sanction transfer of the UPN.

[GREED]

The guidance they sent doesn't help much since:

 

a. they're not amending or republishing the guidance - guidance which is approved at the highest level - we have no way of knowing from where the more recent email guidance came from or who approved it

 

b. they're still saying the onus and responsibility falls on schools

 

c. none of you actually need it - you can fulfil your roles and systems without the UPN by substituting an alternative - it's just it comes down to a business decision on implementation costs.

 

Absent of proper updated guidance properly published by the DfE I would not be happy sharing the UPN with a company and to safeguard myself would require the most senior member of staff within the school/academy to sanction transfer of the UPN.

Sorry... 'You'?

[Primus]

You meaning companies such as GroupCall.

[EdWhittaker]

Well, it's not actually as simple as you make out. When there is a commonly agreed alternative with a consistent format across all MISs then we'll use it. And... er, you effectively have a UPN by another name so, as Grumbledook noted earlier, doesn't that put you back to square one?

Anyway, not being rude or anything, but sounds like you don't want the responsibility of making a decision. Not everything in life is cut and dried; sometimes we have to use our skill, training and judgement.

[Primus]

I'm quite happy to have the responsibility of making a decision such as this, however when the formally published written guidance from the governmental organisation that provides all our funding and regulates us says to not share something then it's wise to pay heed. To be fair you might say not to be rude but that doesn't diminish how something may come across as rude.

 

Using an alternative ID does not put as back at square one since it is the UPN that itself is the issue, not having a unique ID or key. The DfE guidance isn't about anything other than the UPN itself.

 

I agree not everything in life is cut and dried but weighing up this situation I have formally published advice saying do NOT use the UPN and I have companies copying and pasting advice from someone at the DfE saying it MAY be used under certain circumstances but I have no idea whether this person at the DfE is in such a position as to effectively modify the existing written guidance.

 

What we all really need is for the DfE to formally clarify the guidance, absent of this it is very much a judgement call and it's clear why schools will opt to judge it either way, I'm simply giving my interpretation and judgement on the matter.

 

Out of interest what would you do with independent schools who are not required to have UPNs so may not have them. What about students who have parents who refuse consent for sharing of their UPN or children who for a variety of sensitive reasons have a change in UPN?

Edited July 27, 2017 by Primus

[GREED]

You meaning companies such as GroupCall.

 

I see. Groupcall have never used the UPN in any of their products.

 

In providing a service as a data processor, under guidance or agreement from the data controller in each case, we have provided the UPN - but that is all.

[Primus]

Then I apologise if the "you" came across in the wrong manner, what I meant was companies who operate in the education space and use the UPN.

[GREED]

I agree not everything in life is cut and dried but weighing up this situation I have formally published advice saying do NOT use the UPN and I have companies copying and pasting advice from someone at the DfE saying it MAY be used under certain circumstances but I have no idea whether this person at the DfE is in such a position as to effectively modify the existing written guidance.

 

This was an offical response from the DfE - not some bod on the phone but official guidance on the matter published by via their official enquiry channels. I am sure if you were to do the same the guidance would be the same from them.

 

The fact that the guidance is contradictory or not is another matter, but this is not 'some company trying to justify the need for the UPN', Groupcall have no use of the UPN nor real opinion on the matter, we act under guidance from data controllers - here we have acted on behalf of a large portion of the market, third parties and schools alike, to publish guidance for all to see.

 

To be honest, this conversation has really run its course now, the end result being there is no real answer (just opinions) - it is very much down to each school to decide if they want to have the UPN just inside one system (the MIS) or more than one system - and up to them to make a judgement on the advice from the DfE both before and now.

[Primus]

This was an offical response from the DfE - not some bod on the phone but official guidance on the matter published by via their official enquiry channels. I am sure if you were to do the same the guidance would be the same from them.

 

That's fine and obviously a school should not take your word for it and would seek to verify this if they chose to rely upon it. However as I said previously, published written guidance can be relied upon without question whereas conflicting guidance from someone within DfE who may not have the appropriate level of authority or have consulted with the required people is never going to be as easy to trust or rely upon than the published written guidance.

 

It's interesting the DfE chose to publish guidance on this particular subject in 2013, there must have been a reason for this and for the document being quite specific about who the data is intended for/should be shared with.

 

I agree that without the DfE republishing the guidance with the clarifications then there is no real answer, however I do feel that companies should be able to accommodate schools who no longer wish to share the UPN - as someone who has come into a school that has been sharing the UPN for some time I have found many suppliers accommodating when it came to light they were using the UPN and I asked them to change. Sadly some have not been so accommodating and rather than accepting the school's well founded concerns seek to argue and justify to save them from having to provide an alternative.

[enjay]

So the guidance they sent this month... Is wrong? We ignore that?

 

As any history student would tell you, validity of source is important. I have two conflicting pieces of information - one is on the DfE's website, and the other is on EduGeek. If we're being brutally honest (and I don't mean this rudely), I don't actually know that what you posted came from someone at DfE via official channels, nor do I even know you work for Groupcall. So, if my school were to get in trouble for sharing UPNs contrary to published guidance from the DfE, I don't think my HT would accept "some bloke on a forum told me it was okay".

 

For the record, I believe you do work for Groupcall and the information you kindly requested and posted is genuine, but until DfE alter their published guidance, I think we have to follow that.

[jenatddm]

Don't forget that the UPN has been designated as a General Identifier (as in the DfE 2013 guidance) so it's See Para 4 (1) Data Protection Act 1998

 

While that “general identifier” might be a bit woolly, however the UPN guidance suggests the only bodies it may be shared with, would exclude third party developers: "it is only possible for UPN data to be shared by CTF between schools/academies, LAs, DfE and other prescribed government departments (OGDs).”

 

Let's get the ICO opinion. Should be befotre the holidays.

 

Out of curiosity, how many UPNs does Groupcall currently have stored / interface with? (Can chat offline if you prefer - @theabb DMs open)

 

All fair points. What is being said here is that the UPN is an attribute of a student (record), not an identifier - unless the DfE or LA, or another school is involved, and then they have legislative power to use that attribute as an identifier.

 

With my professional hat on, I care little which schools want to share, or what third parties want/ask for - Groupcall (and I am sure the other data integrator) can provide UPN, MISID, 'Graham's made up ID' just as easily.

 

School switching MIS - now there is a fun time, with all the local IDs changing!

[pcstru]

For the record, I believe you do work for Groupcall and the information you kindly requested and posted is genuine, but until DfE alter their published guidance, I think we have to follow that.

The DfE response to Groupcall (we have the response, we do not have the question that was asked to get that response) critically does not override the guidance issued in 2013, it simply says that UPN is controlled by the School. When the school is making the call on whether it would be fair processing to use UPN in a particular way, they should as the data controller, look at the guidance.

 

The mistake here is to see the DfE response to group call as being anything new. We already knew we were the data controller - doh! Part of the problem is we have data processors who's systems are processing data in ways we do not expect or are particularly aware of (can anyone find (say) information from PiXEL that says their edge product might transfer data to another data controller?) Hopefully that stops with GDPR where they cannot play fast and loose in that way.

 

Again for people who think they should be able to shunt UPN about and use it as an automatic adjunct to a student name (i.e. a unique identifier), are these external systems dealing properly with former UPN and the repudiation required in cases of adoption etc? If not, then how can you say you are processing this data as required by the guidance?

[GREED]

As any history student would tell you, validity of source is important. I have two conflicting pieces of information - one is on the DfE's website, and the other is on EduGeek. If we're being brutally honest (and I don't mean this rudely), I don't actually know that what you posted came from someone at DfE via official channels, nor do I even know you work for Groupcall. So, if my school were to get in trouble for sharing UPNs contrary to published guidance from the DfE, I don't think my HT would accept "some bloke on a forum told me it was okay".

 

For the record, I believe you do work for Groupcall and the information you kindly requested and posted is genuine, but until DfE alter their published guidance, I think we have to follow that.

 

Very fair points. Cannot argue.

 

It does beg the question why did we bother asking for the clarification if the first place?

[enjay]

Very fair points. Cannot argue.

 

It does beg the question why did we bother asking for the clarification if the first place?

 

Perhaps in the hope they would respond in a more formal, publicly-visible way? Kind of like how when you ask a seller a question on eBay, their response can be made available on the item listing....

[GrumbleDook]

Perhaps in the hope they would respond in a more formal, publicly-visible way? Kind of like how when you ask a seller a question on eBay, their response can be made available on the item listing....

 

And this is what groups like Defend Digital Me raise questions through FOI requests, to some extent.

[jmak]

Despite all the above, my instinct is still that I could share the UPN with a supplier if they're the data processor acting on the school's behalf. Otherwise hosted SIMS and all other cloud based MIS would be illegal. While the MIS could function day to day without using the UPN, you wouldn't be able to use it to produce a CTF.

 

Would the supplier be permitted to aggregate UPNs from multiple schools and use them for their own purposes? No, absolutely not. But none of the data should be being used for the supplier's purposes, only processed on our behalf to provide a service to us.

 

I don't see why they can't hold the information in a database being operated on our behalf. It shouldn't be possible for the supplier to link data being processed on behalf of different schools anyway. They then wouldn't be processing the data on our behalf anyway.

 

For the record, I haven't shared (or had the need to share) UPNs with any suppliers - it just seems like it could be a useful unique identifier.

[pcstru]

Despite all the above, my instinct is still that I could share the UPN with a supplier if they're the data processor acting on the school's behalf. Otherwise hosted SIMS and all other cloud based MIS would be illegal.

No, they would not. They would simply be processing UPN in ways that are described by the 2013 guidance and can therefore be considered to be fair processing of a general identifier (it must be processed as described by Sec State in order for it to be considered to be fair processing as defined by the DPA).

[EdWhittaker]

@GREED and everyone:

 

Further clarification from DFE has been received by a colleague as Follows:

 

"I do not believe the advice above contradicts the currently published guidance but do accept that specifics about sharing UPNs with software suppliers is something which is not explicitly covered within the current guidance. The Department have already planned during the coming months to review the current UPN guidance in collaboration with sector representatives (particularly concerning the advice about adopted and looked after children) and therefore we will feed your concerns into that process to provide a coordinated single update to the overall guidance.

 

From a legal perspective, it should be noted that currently there is nothing specifically set out in data protection legislation which specifies how the UPN should be used other than the usual provisions of the Data Protection Act 1998 that apply to all personal information and therefore the UPN guidance provided by DfE is driven by policy for which I am the owner. I therefore have the authority to confirm that, from a DfE perspective, it would be permitted to make UPNs available to a third party who are processing data on your behalf for the purpose of providing your school with an education service / system in accordance with the usual transfer controls. However DfE have no involvement in the particulars of agreements between individual schools and third party software suppliers and therefore, ultimately, it would be a matter for you as data controller to make an informed judgement as to the appropriateness of sharing in this circumstance.

 

So, in summary, as owner of DfE UPN guidance I can confirm that there is nothing in there that would prevent sharing UPN with a third party software supplier who are processing data on your behalf for the purpose of providing your school with an education service / system. However, ultimately, it would be a matter for your school as data controller to make an informed judgement as to the appropriateness of sharing in this manner."

 

Gary Connell

Head of Operations

Education Data Division (EDD)

Department for Education

 

So, now we know.

[GREED]

Thank you for this, I believe this does confirm and support the original advice given to Groupcall on the topic some time ago.

 

Does this answer the concerns of certain individuals here? Are we more happy this is official guidance from the DfE (and not a commercial organisation driving an agenda)?

[pcstru]

Does this answer the concerns of certain individuals here? Are we more happy this is official guidance from the DfE (and not a commercial organisation driving an agenda)?

 

I'm not convinced it does answer my concerns. A key portion of the letter says :

 

"From a legal perspective, it should be noted that currently there is nothing specifically set out in data protection legislation which specifies how the UPN should be used other than the usual provisions of the Data Protection Act 1998 that apply to all personal information"

 

This may be strictly true but doesn't address questions raised by the fact that UPN is designated a "general identifier". The guidance itself tells is that UPN is such a beast, so the guidance recognises that there is something about UPN that would not seem to apply to "all personal information" - otherwise why the term? It is the Data Protection Act that then defines the term "General Identifier" and that seems to say that such a thing, to be processed fairly, must be processed as instructed by the Sec State. So sure, all personal information has to be processed fairly (so what he says is strictly true), but not all information is defined a a general identifier under the act, which the guidance itself says the UPN is.

 

Personally, just looking at it from a risk management perspective there still seem to be potential liabilities that could arise from using UPN to provision arbitrary services based on using it as a unique identifier at the local level of a school. Dealing with that risk is both simple (just avoid it and use admission number, the primary key of the MIS's student entity or some a hash of it if that is unwieldy) and in theory should be 100% effective at the level of a school provisioning the service. So good risk management seems to say just avoid it because it is a risk and almost regardless of how much of a risk it is, the risk can just be simply and easily avoided. That choice seems to be supported by the guidance.

 

GDPR should at least result in some transparency to data subjects in that the data controller will have to be transparent about how they are processing that data and perhaps more importantly, transparency between service suppliers and schools about what/how/and why data is "processed" which will prompt interest from the schools themselves in why suppliers need particular items of data. The fact of that transparency should mitigate some risk with liability; "we told you we were doing this" is a reasonable thing to do even when what you are telling them you intend to do is unreasonable.

[Ditto]

Having ploughed through this lively thread - yes all 7 pages(!), it's clear there two main camps - one is it's OK to share UPNs with third parties provided you have the appropriate agreements in place, but some would say it comes with risk which to be aware of you need a deep understanding of the DPA, DfE guidance and more. The other is avoid those risks and don't use the UPN and ensure your suppliers provide their services another way.

 

I'd like to get a view on a specific scenario. I'm sure many subscribers to this thread use or have used FFT Aspire. When uploading new pupils, the UPN is mandatory. Should I be speaking to them to find another way of providing their service without requiring a UPN?

[jenatddm]

There is no 'official guidance' from DfE other than that which was published nationally in 2013. It is explicit: Quote page 7 of 19 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/270560/Unique_Pupil_Numbers_-_guidance.pdf [my underlining]

 

"The UPN must be a ‘blind number’ not an automatic adjunct to a pupil’s name. It must be held electronically and only output when required to provide information to the LA, central government or another school/academy to which the pupil is transferring."

 

What has been explained to participants on the forum differs between who you speak to at DfE, and the ICO. It seems sensible that the ICO and DfE need to agree a position in light of the questions raised, and we are recommending to them both, that the DfE guidance is updated accordingly with regard to GDPR.

 

Does this answer the concerns of certain individuals here? Are we more happy this is official guidance from the DfE (and not a commercial organisation driving an agenda)?

[jenatddm]

Added as a question to the file we will submit for review by ICO and DfE, and in preparation for our report https://docs.google.com/document/d/1...it?usp=sharing FFT is an interesting case for many reasons, not least there is no clear legal basis for linkage of the data FFT gets from schools to data they receive from the National Pupil Database, and its indefinite retention as a merged dataset.

 

Having ploughed through this lively thread - yes all 7 pages(!), it's clear there two main camps - one is it's OK to share UPNs with third parties provided you have the appropriate agreements in place, but some would say it comes with risk which to be aware of you need a deep understanding of the DPA, DfE guidance and more. The other is avoid those risks and don't use the UPN and ensure your suppliers provide their services another way.

 

I'd like to get a view on a specific scenario. I'm sure many subscribers to this thread use or have used FFT Aspire. When uploading new pupils, the UPN is mandatory. Should I be speaking to them to find another way of providing their service without requiring a UPN?