GDPR Query

[enjay]

Not really odd, It's so kids can get homework by teacher without having the excuse I forgot my login!

 

Steve

 

So, if a school uses SMH, anyone anywhere can see all the details of the homework which has been set? I still think that's a bit odd, but I do see your point about "forgotten" logins.

[Steve21]

So, if a school uses SMH, anyone anywhere can see all the details of the homework which has been set? I still think that's a bit odd, but I do see your point about "forgotten" logins.

 

Yep Random example from top of google search:

 

https://suttongrammar.showmyhomework.co.uk/school/homeworks/calendar?all=true

 

With a document downloadable example:

 

https://suttongrammar.showmyhomework.co.uk/school/homeworks/26256033

 

Steve

[enjay]

With a document downloadable example:

 

https://suttongrammar.showmyhomework.co.uk/school/homeworks/26256033

 

That's even more worrying, because teachers might include homework attachments from paid-for services, which they're not allowed to publish online.

[Steve21]

That's even more worrying, because teachers might include homework attachments from paid-for services, which they're not allowed to publish online.

 

Yep whatever they host is viewable even if it's a public gdrive for example here: https://suttongrammar.showmyhomework.co.uk/school/homeworks/25448873

 

https://drive.google.com/drive/folders/17LQUE3Db-fR6mrDQOO3AVLYE-gkezVOs

 

You'd be amazed at the amount of homework some teachers set that isn't' their own (aka nabbed off another schools SMHW!) (and I mean that I've noticed within ours not Sutton's school )

 

Steve

[enjay]

Wow, I think that settles it for me that we don't ever want to get SMHW.

[Sir]

UPDATE FROM SHOW MY HOMEWORK- SATCHEL

Greg, Operations Manager happy for me to share the conversation that i have just had regarding their position and the changing of advise they are giving to schools. It seems that the majority of the online services industry for public authorities is going for public interest on this one and so it makes sense to be in the majority for the time being until proper advise and clarity is provided from the forthcoming Bill or the ICO itself. This knee-jerk reaction to my comments regarding their previous position of cancelling contracts and slating companies that are trying to follow guidelines on various sources of advice is unhelpful to the extreme. We are all going through this and i think it is fair to say that none of us has the definitive answer. The fact that representatives cannot speak for their product on these forums makes it all the harder to remove the distaste that visitors past these fora may experience. Thanks for all the helpful advice and the great discussion however.

[Sir]

So many school websites list their teachers names. So much homework is available online.

[markberry]

Thanks @GrumbleDook. I also have a case with the ICO directly about this and will report their answer as it is further reaching than for just this i guess. . I'm guessing that you are getting the info for GDPRis also.

 

Also, with larger companies @markberry, do you think they will all sign thousands of contracts coming from all of these schools (and other organisations)? I have all of mine printing now but am not very hopefull of being returned....

 

And wondering about getting a signed (data Sharing contract?) copy back from the DfE ;-)

 

You should already have a contract in place with any company that is processing your data. You shouldn't need to take out new ones. If you have purchased SIMS you will have taken out a legally binding contract for example.

 

A data sharing agreement doesn't need to be signed, but your data processor should be able to provide you with a copy of it. These would probably be exactly the same for every school they deal with. The agreements should outline things like the purpose, or purposes, of the sharing; potential recipients and the circumstances in which they will have access; the data to be shared; data quality – accuracy, relevance, usability etc; data security; retention; individuals’ rights; review of effectiveness/termination of the sharing agreement; sanctions for failure to comply with the agreement or breaches by individual staff.

[mthomas08]

What an odd (and pointless!) feature. Here, we publish a list of all teachers and some key support staff (house admins, exams manager, IT manager, etc.) to all parents, so we could probably justify this. That said, we publish it via the handbook, not publicly on the website.

 

If it's covered by the school policies and/or consent e.g. School website/learning platforms. You 'should' be fine.

 

One thing the audit didn't bother with was the names on our school website but we are about to ask the question.

 

The generic response we tend to get is "why we do it". If it's not a viable reason and we don't have consent.. I WILL CHASE THIS ONE!

[Sir]

On another tack, a lot of the information that we collect on students is pretty sensitive data such as LAC status, PPI, CAMHS, etc., etc. This is not explicit special category data in the legislation, yet I think the DfA has advised that we treat it as such. (can't remember where i heard/ read this but it sounds reasonable). So, would this fall into (9 (2) g) substantial public interest or (9 (2) b)- ....social protection law... as this is relating to protecting those who are poor and/ or vulnerable... such as children, etc...? Edited May 17, 2018 by Sir

[deano3693]

On another tack, a lot of the information that we collect on students is pretty sensitive data such as LAC status, PPI, CAMHS, etc., etc. This is not explicit special category data in the legislation, yet I think the DfA has advised that we treat it as such. (can't remember where i heard/ read this but it sounds reasonable). So, would this fall into (9 (2) g) substantial public interest or (9 (2) b)- ....social protection law... as this is relating to protecting those who are poor and/ or vulnerable... such as children, etc...?

 

I would still say Public Interest or Safeguarding for this one as you are collecting the information to Safeguard and protect the child during the school day but this is also in the public interest so could fall into either of these. Safeguarding trumps everything!

[markberry]

I would still say Public Interest or Safeguarding for this one as you are collecting the information to Safeguard and protect the child during the school day but this is also in the public interest so could fall into either of these. Safeguarding trumps everything!

 

Safeguarding isn't lawful base for processing. It would fall under Public Task

 

 

"The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever you process personal data:

 

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

 

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

 

© Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

 

(d) Vital interests: the processing is necessary to protect someone’s life.

 

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

 

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)"

[Sir]

Safeguarding isn't lawful base for processing. It would fall under Public Task

 

 

"The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever you process personal data:

 

Sorry; you missed the point. This was not the question. I was referring to if we classify this as spacial category data so which article 9 would it be appropriate to use. Or, if we classify these as special category, the regulation doesn't, we don't have to specify a reason under Article 9?

Edited May 18, 2018 by Sir

[markberry]

Sorry; you missed the point. This was not the question. I was referring to if we classify this as spacial category data so which article 9 would it be appropriate to use. Or, if we classify these as special category, the regulation doesn't, we don't have to specify a reason under Article 9?

 

Apologies! Yes it is classified as special category data. I would say it falls under 9(g), none of the other conditions seem to be relevant.

[ozydave]

We are still late to the party with GDPR, consent and privacy notices - Dont ask :-(

 

So for Show my homework we can say it 'publick task' so no consent from students. But as parents can / could login to Show my homework do we need to get concent from students (13 or above) to allow their parents access to their data

 

Cheers

[enjay]

So for Show my homework we can say it 'publick task' so no consent from students. But as parents can / could login to Show my homework do we need to get concent from students (13 or above) to allow their parents access to their data

 

No, because you have a public duty to facilitate the parents in supporting their children with their homework. Take SMHW out of the equation and think if you had paper planners with the kids' names on - you wouldn't ask the kids' consent for their parents to see that information on the front cover, so nor should you ask consent to use SMHW.

[maturelady]

It's about asking yourself:

 

"By processing this data am I carrying out the task set to me by the 'public' to educate kids in the best way we know how?"

 

If you say 'Yes' to this question, and your school has decided that by using Show my homework or any other system allows you to run your school in the best way you can, you may use public interest. Students are allowed to object, but you can give a reasonable and clear answer as to why you cannot meet their request of not sharing the data.

 

Schools must be united on this otherwise we'll get swathes of kids and parents objecting because they can see it happening in other schools.

 

The most important thing is you have considered the data processing, you are satisfied that it is being used for a public task, and YOU HAVE A RECORD OF THE CONSIDERATION

[maturelady]

Sorry meant to say systems which include special category data need clearer justification than 'we use this to improve the way we run our school', ie

 

finger prints - Biometric data - can the system run without using this? Yes - thus consent required

allergies - Medical data - can a kitchen feed this child without knowing this data? No - public task

 

Again you have considered the processing and have recorded your decisions and justifications

[Bigbird7]

It's about asking yourself:

 

"By processing this data am I carrying out the task set to me by the 'public' to educate kids in the best way we know how?"

 

If you say 'Yes' to this question, and your school has decided that by using Show my homework or any other system allows you to run your school in the best way you can, you may use public interest. Students are allowed to object, but you can give a reasonable and clear answer as to why you cannot meet their request of not sharing the data.

 

Schools must be united on this otherwise we'll get swathes of kids and parents objecting because they can see it happening in other schools.

 

The most important thing is you have considered the data processing, you are satisfied that it is being used for a public task, and YOU HAVE A RECORD OF THE CONSIDERATION

 

All common sense and exactly the way we should approach this. The problem I have is that many of these system suppliers have adjusted their T&Cs to say that schools must have gained parental consent.

[maturelady]

Well your system suppliers are wrong!

 

I was part of the team that helped write the DfE ToolKit. I hope we made it very clear throughout to avoid consent whenever possible as it can be withdrawn at anytime. Use another legal basis for processing and in most cases this can be Public task/interest.

 

I am happy to take this up with any supplier. Point them to our website https://www.gdpr.school or ask them to drop us an email [email protected]. We have produced free resources for suppliers to help them help you.

[Bigbird7]

I couldn’t agree more they are indeed wrong but how are schools to handle this? Do we turn a blind eye to their conditions for using the service? A couple of examples below

 

“If you are an Educator and you register an account for a student who is under the age of 13 (a “Child”), you represent and warrant that you or the educational organization you work for has proper permission to register the Child for Code.org, and that you have obtained the necessary parental consent for Code.org’s collection of the Child’s personal information for the use and benefit of the school and for no other commercial purpose. In addition, you agree to be bound by these Terms on behalf of the educational organization you work for.”

Code.org have released a new privacy policy to bring themselves inline with GDPR.

 

Times tables Rockstars https://ttrockstars.com/page/Terms_and_Conditions contains the section...

“The School warrants and represents that it has obtained all consents from individuals (including students, parents and guardians, and staff at the School) whose Data the School supplies to the Company in connection with the School’s use of the Product for the lawful Processing of the Data by the School and the Company for the purposes set out in this paragraph 2. The School shall indemnify the Company against all costs, claims, damages, expenses, losses and liabilities incurred by the Company arising out of or in connection with any failure (or alleged failure) by the School to obtain such consents.”

[maturelady]

Rockstars Ts&Cs are very good indeed.

 

Their SCHEDULE TO GENERAL CONDITIONS, DATA PROTECTION WITH SCHOOLS is very clear and easy to understand. The only issue is that which you have identified, in section 2.6. In this they are telling you, the data controller, which legal basis for processing you must use. This is wrong. As data controller it is your responsibility to ascertain which legal basis for processing you are relying on. That section should be asking you to warrant that you have identified a legal basis for processing. I will personally contact this company and share my thoughts with them.

 

I can't see enough about Educator to comment but it looks similar.

 

My belief is that these companies have correctly taken legal advice. However, as soon as these legal advisors see the word 'child' they presume consent is the only route. Lawyers such as Michelmores, who specialise in education law would not have given this advice. They understand how schools work and how the law applies in this sector.

 

I am now starting to see a lot of confusion with suppliers. Many simply do not recognise that they are data processors.

 

As we said sometime ago this is a long journey we must take together, my company GDPRiS will help wherever we can but we're not magicians!

Edited June 22, 2018 by maturelady

[Narwhal]

I think in some cases the wording exists to cover the American law that requires explicit consent from parents for the processing of data that relates to children under the age of 13. They are just being lazy as, in theory, consent would also cover GDPR.

[enjay]

“that you have obtained the necessary parental consent"

 

Strictly speaking, you have obtained all necessary consent, i.e. none. You have the necessary consent, I have the necessary number of elephants in my office.

[jmak]

Strictly speaking, you have obtained all necessary consent, i.e. none. You have the necessary consent, I have the necessary number of elephants in my office.

That's the way I read it too - quite clever on the supplier's part and fine by me. It's the approach I've taken with Google's T&C's.

 

The Rockstar ones above say "all consents" which to me is slightly less clear. I think the bottom line is that it is the school that would be held accountable rather than the supplier, so it is up to us.

Edited June 22, 2018 by jmak