Current data protection and blogs

[TwistedHelixis]

I have just been informed that a teacher has started setting up a blog using Wordpress for all the primary school kids to use online.

 

The school has never used a Wordpress site before, so this is something the teacher has done on their own.

I am wondering about data protection implications, children's names, data leaving the UK. Wordpress security etc.

 

Could someone give me a bit of advice before I go and see the teacher.

 

Thanks

[GrumbleDook]

Get them to answer the standard questions ...

Where is it hosted? (Location and company)

Do students have accounts?

What personal data was used to create those accounts?

Who has access to that data?

 

And then go into the safeguarding questions ...

Audience, contributors, moderation, etc.

 

Blogging on Wordpress is generally fine when done right.

 

Have a look at @deputymitchell on twitter for good examples.

[Hedgehog13]

might be worth noting this section of the Wordpress 'terms of service' as a starting point...

 

'Our Services are not directed to children younger than 13, and access and use of our Services is only offered to users 13 years of age or older. If you are under 13 years old, please do not register to use our Services. Any person who registers as a user or provides their personal information to our Services represents that they are 13 years of age or older'

[GrumbleDook]

might be worth noting this section of the Wordpress 'terms of service' as a starting point...

 

'Our Services are not directed to children younger than 13, and access and use of our Services is only offered to users 13 years of age or older. If you are under 13 years old, please do not register to use our Services. Any person who registers as a user or provides their personal information to our Services represents that they are 13 years of age or older'

 

That is for Wordpress.com

 

If you self-host or host it elsewhere then you are running the service and so set the terms yourself.

 

One reason why most school Wordpress blogs are not on Wordpress.com

[TwistedHelixis]

One reason why most school Wordpress blogs are not on Wordpress.com

 

I am not at the school until tomorrow but I very much doubt the teacher has used a self hosted system.

 

The last email I got back simply said another school is using it, whats the issue.

 

The teacher might have created a generic account but will find out.

 

So I can get all the correct info together,

All the pupils are primary school age, so that's a no go as far as Wordpress is concerned.

I assume the data is going to leave the UK but will find out - What are the implications if it does?

I assume the pupils will have some personal info, at least their names will be on the blogs they create - What are the implications?

[Hedgehog13]

The school should have a privacy notice that explains what data they store, process etc. and where it is used. If the teacher has set this blog up themselves, I doubt it has been included in the current notice...

[GrumbleDook]

Or, if like many existing Privacy Notices, they categorise the recipients and they have online learning systems in there.

[Hedgehog13]

Given that the ICO use Wordpress for their own blog....

[TwistedHelixis]

Just had an email back

 

They have setup one single account and will be using Wordpress.com (US) which would fall under data transit laws.

 

Am I correct in saying so long as we make sure none of the children can be identified (no names or locations) we are good to blog?

[GrumbleDook]

I would suggest 2 accounts, one as an author (work is moderated) and one as an admin. Now we are talking safeguarding rather than data protection .... follow your existing safeguarding guidance.

[mikemcsharry]

Also - I was at a meeting last night about GDPR and an intersting thought struck me. When someone posts a comment on Wordpress, they (the commenter) plus other viewers don't see this, but their IP number is recorded. If you admin a worpress.org (self hosted) sit and you allow comments, have a look.

This falls a wee bit foul of GDPR.

 

Just found this which may be helpful - http://www.wpbeginner.com/wp-tutorials/how-to-stop-storing-ip-address-in-wordpress-comments/

Edited July 13, 2017 by mikemcsharry

[GrumbleDook]

If you declare it in the privacy notice and can justify it (reviewing the approx location of posters as part of showing audience reach to learners) then it could be acceptable.

[bossman]

Hi All,

 

On the back of this and not wanting to hijack the thread, one of our teachers wants to move forward with this site:

 

What is PrimaryBlogger? ? PrimaryBlogger

 

I feel it is not to be used as it is not a secure site and have told the Staff member not to use it as it could lead the school into certain DP and SG issues.

 

I have sent the owners of the site a FOI email to which they have answered but before I post those I want to see what other people on here think?

 

Its associated with this company: https://primaryt.co.uk/ but they just said that the web services are run by another team which seems a little strange in that they didn't know why the other site was not secure?

 

Appreciated

Edited July 13, 2017 by bossman

[GrumbleDook]

Primary Technology are a good bunch of folk and a number of staff are members on here IIRC.

 

I'm sure if there are any issues they will rectify them quickly.

[jmak]

Or you could look at blogger which you can access as part of Google Suite (it's a consumer app but you can control access through the admin console and is compliant with all of the data protection requirements).

 

Edit:Or if MS 365 is your poison, look at Delve

 

Both free solutions...

Edited July 13, 2017 by jmak

[bossman]

Primary Technology are a good bunch of folk and a number of staff are members on here IIRC.

 

I'm sure if there are any issues they will rectify them quickly.

 

I'm in no way talking them down @GrumbleDook and the other site looks very professional and it functions very well, just the fact that it is not a secure site rings alarm bells and when I have asked the question the reply is that they run it as a free service which costs money, surely though when dealing with data from schools the site should be secured?

 

Not being a jobs worth but you yourself have instilled this security process in me from our meetings and posts on here, this is the way I look at things ever since we met.

[TwistedHelixis]

Also - I was at a meeting last night about GDPR and an intersting thought struck me. When someone posts a comment on Wordpress, they (the commenter) plus other viewers don't see this, but their IP number is recorded. If you admin a worpress.org (self hosted) sit and you allow comments, have a look.

This falls a wee bit foul of GDPR.

 

If you declare it in the privacy notice and can justify it (reviewing the approx location of posters as part of showing audience reach to learners) then it could be acceptable.

 

I was under the assumption, but probably completely wrong, that if a school was sending personal data outside the EU the company storing the data will have needed to signup to specific EU regulations. No?

 

EDIT - just seen the bit self hosted, ​which changes everything I put

Edited July 13, 2017 by TwistedHelixis

[mikemcsharry]

Just a thought if they are using wordpress.com - they DO know about the adverts? Thought so.

 

This, on my own website, may help - I don't think wordpress.com is a good idea for a school...

https://funtorun.co.uk/teaching-resources/websites/wordpress-users-some-cautionary-notes-part-2/

 

The school can pay automattic (wordpress.com) to go add free..