What should I ask to find out if an American company will be GDPR compliant?

[Paul_L]

As this thread started off, with SeeSaw found this and thought it might be useful.

 

https://help.seesaw.me/hc/en-us/articles/115005743186-Is-Seesaw-GDPR-compliant-

[jenatddm]

The problem there of course is many of us have already signed agreements which will still be in force in May - how many of us renewed loads of annual subscriptions on 1st Sept?! So, we're already under contract with suppliers who may not be compliant in time and/or may refuse to sign any new terms until the current subscription/agreement expires.

 

Suppliers *have a legal obligation to process in a legally compliant manner or should expect to pack up business*. End of. If they start processing data illegally on May 26 send 'em our way. They need to pull their finger out.

[jenatddm]

True, but there are also some very broken pieces of software (I'm thinking SIMS): for example if I needed to delete a students data when they became offroll because that was the policy, how would I retrospectively get an attendance report for the entire yeargroup and include that data. I'm pretty sure SIMS currently deletes it, but if it were compliant it would anonymise it.

 

Oh dear. I would love a list of what you think is broken. PM open. Then they might wish they'd taken our calls over the last 18 months when we start pointing it out. They need to get a move on and *not* pass any bills for providing a legally compliant service on to their customers. And yes Capita, I mean you and every other SIMS provider. The GDPR was passed in April 2016. Practical SAR, audit and data usage reports need to be possible. There's nothing but excuses for not having been proactive since then.

[jenatddm]

As this thread started off, with SeeSaw found this and thought it might be useful.

 

https://help.seesaw.me/hc/en-us/articles/115005743186-Is-Seesaw-GDPR-compliant-

 

US firms often have a poor grasp of what data protection by design and default" of article 25 of GDPR means and they may need to change their practice.

 

Schools must carefully consider, is the personal data the app collects necessary and proportionate and is there a less invasive way of carrying out this task without infringing on the rights and freedoms of the people whose data it processes.


 


Seesaw collects personal data including their names, email addresses, and photographs. This information may be entered by a teacher or the student or populated from the student’s account with a third party sign-in service, such as their Google account.

<< are photographs necessary (not just a nice to have)?
<< is name *necessary* could a dummy be used?
<< does the teacher and child understand what Google collects and how the personal data are used if you use ggl sign on?



 

We also collect comments on posts in your class journal which may be text, or if you allow Seesaw to access the microphone on your device, voice recordings.

<< biometrics sent to the US? Again does it pass the necessary test (not just a nice to have)?

 

Seesaw collects messages that are sent and received in Seesaw by teachers, family members, and students.
<< They all need to understand what data are collected and have a suitable privacy notice.


 

When you use Seesaw, we receive log data such as your IP address, browser type, operating system, device information, and your mobile carrier. In addition, we may receive or collect additional information such as the referring web page, referring search terms, and pages visited. If you are using Seesaw as a teacher, parent, or administrator, Seesaw may use your IP address to determine your approximate location for the purposes of sending you customized marketing and other information about our products.

<< customized marketing? Is this appropriate to send to parents? Is this excessive data collection (is IP *necessary*) and have you given parents an option of not getting this marketing?


 

To help us analyze this data, we use a small number of third party services (such as Google Analytics and Fabric). 
 << Is the Ggl data use compliant? << They all need to understand what data are collected and have a suitable privacy notice.



 

We also use third party conversion tracking services only to understand if a teacher signs up for Seesaw after seeing an ad for Seesaw on a platform like Facebook or Twitter.


 

<< Is the Facebook or Twitter data use and tracking compliant? << Data subjects all need to understand what data are collected and have a suitable privacy notice fro all processing, including by the third parties involved.

 

For one app -- this seems like an awful lot of unnecessary collection and use and might involve the family in marketing, profiling and tracking. Let's say: approach with caution.