GDPR Query

[Steve21]

Speaking with Show My Homework, who have been in many meetings with solictors, etc. regarding this, the operations manager there advised that we could use the 'Legitimate interest' as this is the way we provide homework in our school. This is also what I am relying on for many other online resources including 365 here.

 

That sounds like a very quick "get-out" on their side. Personally I'd get your own independent advice on that rather than trust their opinion, Even more so if you read their site:

 

Students - Our legal basis for processing your data is Legitimate Interest, as this forms part of the curriculum for your education and the school has chosen our software as the primary method of communicating homework and other support services to you.

 

Teachers / Staff Members - Our legal basis for processing your data is Legitimate Interest, as this forms part of delivering your job responsibilities.

 

Saying things like it's part of your job responsibility to give homework therefore we'll take personal data etc I'm pretty sure isn't a legit answer or "valid"

 

Steve

[markberry]

"Students - Our legal basis for processing your data is Legitimate Interest, as this forms part of the curriculum for your education and the school has chosen our software as the primary method of communicating homework and other support services to you.

 

Teachers / Staff Members - Our legal basis for processing your data is Legitimate Interest, as this forms part of delivering your job responsibilities. "

 

Wow!!! That is unbelievable! That would be one contract on my list to cancel!

 

If they are processing data for you under a contract (which the school should have with a processor) then the legal basis is contractual, and the basis for the school would be Public Interest.

[Sir]

Thanks for the replies. I was in a meeting with the ASCL lawyers Browne Jacobson and seemed to agree that it could come under this also. FYI: I am a bit long in the tooth now to rely in what commercial companies tell me regarding compliance. I have asked around and been on training myself for this so it is a little more informed than simply asking them. It cannot be public interest as we can give homework in a planner or hand it to them. We decide to use an online provider to allow teachers to set homework on.

[markberry]

Thanks for the replies. I was in a meeting with the ASCL lawyers Browne Jacobson and seemed to agree that it could come under this also. FYI: I am a bit long in the tooth now to rely in what commercial companies tell me regarding compliance. I have asked around and been on training myself for this so it is a little more informed than simply asking them. It cannot be public interest as we can give homework in a planner or hand it to them. We decide to use an online provider to allow teachers to set homework on.

 

Of course it can be Public Interest regardless of the method of delivery. If you have decided to use an online method of homework delivery in addition to another method that is fine. Delivering homework to the students is in the Public Interest, the method you use to do that doesn't change what you are doing or it's legal basis.

 

Also, a lot of the advice I have read online given out by legal firms has been incorrect. You need to have a DPO who is appropriately trained to advise your school.

[enjay]

Also, a lot of the advice I have read online given out by legal firms has been incorrect. You need to have a DPO who is appropriately trained to advise your school.

 

That's our view too. We have identified what we share and with whom, our DPO (external company) can decide which legal basis is most appropriate.

[BFCIT]

Has anybody had any success with getting data sharing agreements signed? We appear to be getting generic responses with updated T&C's that claim compliance with GDPR rather than a signature for our data sharing agreement. I have asked the ICO about this and they state:

 

"If having looked at a contract you consider that the terms and conditions constitute a contract between you, and this is GDPR compliant then this may well comply. If you doubt that this is the case then you would need to go back to these organisations and get a contract in place as you will have done under the DPA"

For those schools who have emplyed a DPO to carefully review countless sets of T&C's this approach may be ok - not sure about the rest of us!

[jmak]

Are there two issues here?

 

1) Processing pupils' data to use the system to set and monitor homework is to do with providing an education and therefore arguably in the Public Interest.

 

2) Processing parents' data so that Show My Homework can communicate directly with the parents (even if it's on your behalf).

 

As others have said, it will be down to the school to justify their position whatever decision has been taken.

[Sir]

Of course it can be Public Interest regardless of the method of delivery. If you have decided to use an online method of homework delivery in addition to another method that is fine. Delivering homework to the students is in the Public Interest, the method you use to do that doesn't change what you are doing or it's legal basis.

 

Also, a lot of the advice I have read online given out by legal firms has been incorrect. You need to have a DPO who is appropriately trained to advise your school.

 

Yes, i agree, there is a lot of conflicting advice and i have spoken with different trained DPO's with different ideas also! I understand your view and was tempted to use this LB for processing for all these school services however, the advice from the Key for School leaders based on their own legal advice is also:

 

Is there another way to fulfil the task? For example, could we still do it:

Without processing the data at all?

By processing less data?

By collecting the data in a different, less intrusive way?

If you could make any of these changes, then this basis won’t apply unless you adapt your processing. If you couldn’t, and you've answered yes to all the other questions above, then you can use the public task basis.

 

We could (and did) do this another way, and they go on to remind me that relying on Public Task removes the right for data to be removed. And we should be able to remove the data from online at parent/ student request surely? See matrix on ICO site for quick reference.

 

Thanks for all your time and views and help.

Edited May 14, 2018 by Sir

[markberry]

We could (and did) do this another way, and they go on to remind me that relying on Public Task removes the right for data to be removed. And we should be able to remove the data from online at parent/ student request surely?

 

If you have done it another way (paper based), then you should stop doing it in the other way (online). Yes Public Task removes the right for the data to be removed, that's absolutely right and is the way it should be. Can you imagine if you gave them the right to deletion? You set homework, students don't like the grades they've been given or the task given and then demand their data is deleted!

 

For parents to have access to the online homework system would be different and would probably require consent. They would have the right to remove their consent but not delete the information of the student.

[Sir]

If you have done it another way (paper based), then you should stop doing it in the other way (online). Yes Public Task removes the right for the data to be removed, that's absolutely right and is the way it should be. Can you imagine if you gave them the right to deletion? You set homework, students don't like the grades they've been given or the task given and then demand their data is deleted!

 

For parents to have access to the online homework system would be different and would probably require consent. They would have the right to remove their consent but not delete the information of the student.

 

Sorry, no idea what you mean in that first sentence.

I also wasn't offering the option to delete all grades from homework; i can imagine all sorts and do daily in this role. I was simply discussing the idea that it would be right for students and parents to have their data removed from the online homework system. Parents sign themselves up.

[localzuk]

If you have done it another way (paper based), then you should stop doing it in the other way (online).

I think that's slightly wrong - collecting data by electronic means is just the same as collecting it on paper, legally but practically it is more expensive and more difficult. Saying "you could switch to a paper way" does not mean you must - the end result is the same, the data is processed to achieve the outcome.

[markberry]

Sorry, no idea what you mean in that first sentence.

 

You've found another way of handing out homework (by using a planner or handing to them (paper based)), as an alternative to doing it online. You were arguing that you had found another way of doing it "we could (and did) do this another way". If you have found an alternate way of doing it you should stop doing it online.

[Sir]

You've found another way of handing out homework (by using a planner or handing to them (paper based)), as an alternative to doing it online. You were arguing that you had found another way of doing it "we could (and did) do this another way". If you have found an alternate way of doing it you should stop doing it online.

 

I mean by 'we could and did do this another way' that we could manage homework (and previously did) by the traditional use of planners. Sorry if this was confusing.

[enjay]

We could (and did) do this another way, and they go on to remind me that relying on Public Task removes the right for data to be removed. And we should be able to remove the data from online at parent/ student request surely? See matrix on ICO site for quick reference.

 

That's how it should be. If you're processing under public task, students CAN'T be removed from the homework system, and surely that's what you want. Imagine the headache it would be if some students consented and others didn't.

 

Arguably, parents should be able to be removed because you don't NEED them in the system in order to set homework (unless schools have a legal obligation to keep parents informed of homework - one for the HT to comment on), but students don't have a choice therefore consent isn't relevant, therefore public task and no ability to be removed is fine.

[localzuk]

You've found another way of handing out homework (by using a planner or handing to them (paper based)), as an alternative to doing it online. You were arguing that you had found another way of doing it "we could (and did) do this another way". If you have found an alternate way of doing it you should stop doing it online.

Again, that's not really right. The choice as to how to deal with homework is up to a school. If, as part of their way of teaching, online is the way to do it best, then that is covered as part of the statutory need to educate children, and process data about them.

 

Being able to do it another way, regardless of whether it is paper based or not, does not automatically mean the school must stop doing it online. If that were the case, schools would be required to stop using all electronic systems, because they "could" do it using paper - at a massively increased cost and reduced efficiency, which directly affects their requirement to educate.

[markberry]

Being able to do it another way, regardless of whether it is paper based or not, does not automatically mean the school must stop doing it online.

 

That wasn't the point I was making, it was in response to their comment, but I completely agree with what you said regarding homework being part of providing education and therefor Public Interest.

[sarahstacey]

Hi,

 

This might be a silly question but here goes. So for all our suppliers that we share our data with, do we need to actually write to them individually for clarification on whether they are GDPR compliant, or can we take their privacy policies (some I have been sent or are on their websites) as proof. I'm confused as to which is acceptable and I can't find a definitive answer.

 

Many thanks in advance

 

Sarah

[GrumbleDook]

That wasn't the point I was making, it was in response to their comment, but I completely agree with what you said regarding homework being part of providing education and therefor Public Interest.

 

The folk at Team Satchel are aware of the discussion and reviewing.

[deano3693]

I've gone Public Interest for Show My Homework. The school have decided to use an online system and this is how we do it.

 

Also, for the comments regarding passing Parents Contact details Show My Homework no longer takes parental details from your MIS. You provide parents with a PIN and it it down to them to register at that point it is nothing to do with the school they have registered directly with Show My Homework as the Data Controller.

[markberry]

Hi,

 

This might be a silly question but here goes. So for all our suppliers that we share our data with, do we need to actually write to them individually for clarification on whether they are GDPR compliant, or can we take their privacy policies (some I have been sent or are on their websites) as proof. I'm confused as to which is acceptable and I can't find a definitive answer.

 

Many thanks in advance

 

Sarah

 

Sarah,

 

your organisation, as a Data Controller, are responsible for any processors who process data on your behalf. You have to have satisfied yourself that they are compliant and be sure that they are handling that data securely and safely. Simply relying on their privacy notice is not enough. You should ensure you have a contract in place with that company, you should have a copy of their data map including things such as reasons for processing and users rights, you should have some kind of data sharing agreement, you should know what they do to protect that data both at rest and in transit.

 

We have used GDPRiS (GDPR in Schools) as a tool to help pull all this information together. They are working with suppliers to collate much of this information centrally. http://www.gdpr.school

[Sir]

The folk at Team Satchel are aware of the discussion and reviewing.

 

Thanks @GrumbleDook. I also have a case with the ICO directly about this and will report their answer as it is further reaching than for just this i guess. . I'm guessing that you are getting the info for GDPRis also.

 

Also, with larger companies @markberry, do you think they will all sign thousands of contracts coming from all of these schools (and other organisations)? I have all of mine printing now but am not very hopefull of being returned....

 

And wondering about getting a signed (data Sharing contract?) copy back from the DfE ;-)

[Sir]

Lawful basis interactive tool- not sure how long this has been around but i have only just come accross it today... May help a few for less ambiguous discussions!

 

AVAILABLE HERE

[David44]

I've gone Public Interest for Show My Homework. The school have decided to use an online system and this is how we do it.

 

Using the system might be covered under public interest but Show My Homework also publishes the names of the teachers to the whole internet (title, first initial and surname anyway) without needing to log in. You are also sharing that persons work place (the school). The name at least must be personal data and while public interest might cover using the system for setting homework, does it cover making teachers names available to the whole internet? You can justify collecting medical details of students for example, but you couldn't justify publishing those.

 

I am not an expert on this by any means. just thinking aloud.

[enjay]

Using the system might be covered under public interest but Show My Homework also publishes the names of the teachers to the whole internet (title, first initial and surname anyway) without needing to log in. You are also sharing that persons work place (the school). The name at least must be personal data and while public interest might cover using the system for setting homework, does it cover making teachers names available to the whole internet?

 

What an odd (and pointless!) feature. Here, we publish a list of all teachers and some key support staff (house admins, exams manager, IT manager, etc.) to all parents, so we could probably justify this. That said, we publish it via the handbook, not publicly on the website.

[Steve21]

What an odd (and pointless!) feature.

 

Not really odd, It's so kids can get homework by teacher without having the excuse I forgot my login!

 

Steve