GDPR and iCloud, Google Backup, onedrive/windows backup

[Network_Boy]

Hi All,

 

I've been doing some thinking lately about data protection and the use of auto-backup solutions such as iCloud, google backup, onedrive etc.

 

Our staff members all have iPads. If their iCloud backup and photo backup is turned on, and they have any photos of our students on their iPad, those photos will be getting backed up to Apple's servers. The same goes for android/windows devices if their respective photo backup solutions are turned on ('on' seems to be the default setting).

 

We also use a piece of safeguarding software which is accessed through any browser. Included in this software is the ability to upload files, such as case referrals etc. Obviously this is highly sensitive data. To view these uploads whilst logged in through a browser, you have to download them. I'm concerned that if users log in and do this on a mobiole device, their download folder may be getting backed up to an Apple/Google/Microsoft server without them even knowing it.

 

I'm assuming in both of these situations, the GDPR guidelines for data protection would be broken. Does anyone have any further clarification on this?

 

At the moment, I'm telling staff to turn off iCloud/photo backup. I'm also instructing them to only view the Safeguarding uploads on a school PC.

 

Any advice would be greatly appreciated. Many thanks!

[GrumbleDook]

Google and Microsoft are doing a lot of work on GDPR. At the moment there is limited news from Apple as all press and contacts are dealing with the Special Event this evening.

 

Once that is out the way we can crack on with getting stuff through to them. There are several people asking questions of Apple and I will be picking this up with Defend Digital Me shortly.

[enjay]

Since the iDevice is encrypted when locked and the backup is password-protected, I'd be more concerned about staff downloading those documents on their home PCs...

 

As for the GDPR implications of this potential auto-backup, I think it would be okay as long as you are aware it is happening and are satisfied with the compliance of the backup solution, i.e. if you're happy for the data to be in Google Drive, you're presumably also okay with it being in an Android device backup.

 

One note on this - be careful not to confuse photo backups with full device backups, as you seem to be doing. If your device is set to sync photos (Apple Photo Stream, Google Photos, etc.) but not perform a full device backup, then downloaded documents won't be backed up.

[Network_Boy]

Thanks enjay. I've instructed staff only to download the safeguarding documents if absolutely necessary, and only on school PCs, so hopefully they'll stick to that.

 

It's the compliance of the Apple/Google/Microsoft servers that I'm mostly wondering about. I know there are laws about data safeharbours and servers only being located in Europe etc - however I don't remotely know the ins and outs and whether these server location laws will be part of UK GDPR law.

 

Apologies if my ramblings about Photos and full backups was confusing. I'm aware of the difference. My concerns are more about any sort of backup - full device or otherwise - and their being turned on by default in the main OS ecosystems. My go-to position on this is just to turn everything off until we have clarification about what is and isn't acceptable under GDPR.

[enjay]

Apologies if my ramblings about Photos and full backups was confusing. I'm aware of the difference. My concerns are more about any sort of backup - full device or otherwise - and their being turned on by default in the main OS ecosystems. My go-to position on this is just to turn everything off until we have clarification about what is and isn't acceptable under GDPR.

 

Do you have MDM for your school devices? You could set a lot of this by default for people. Alternatively, include it in their induction session when you give them the iPad, or better yet follow up with them a week later and give the device a quick "MOT".

 

Personally-owned devices are harder (although you could potentially still enable some policies via the email config), but a policy saying "The safeguarding app is only to be used on school-owned computers, laptops or iPads" might cover that too.