Popular Post GrumbleDook Posted September 14, 2017 Popular Post Posted September 14, 2017 As with all things, you can guarantee that when someone says to you, "I wonder if supplier x is doing anything on GDPR?" then someone, somewhere sets up a list. And this is no different. After having had a good chat with a few EdTech consultants, it is obvious that there are still a lot of suppliers / data processors out there that don't know that they are going to have some difficult conversations with schools when it comes to asking what are they doing with data you have passed to them to process. Mark Anderson ( ) has even looked at his Periodic Tables of Apps and started cross checking which are doing things in prep for GDPR, as one example. @jenatddm has already started the process of gathering a list of suppliers together and there are still lots of other things to be raised on there. We at GDPR in Schools want to keep that going and go further. But we are only touching the tip of the iceberg right now .. Below is a link to a Google spreadsheet that we are asking you to add additional details to. https://docs.google.com/spreadsheets/d/1w0ObwB5jdg2NVKnxvTEqXP4GwHk5qyBJqQFnuj4TGRo/edit?usp=sharing We are looking for a supplier name, URL, product name and we will fill in the rest from public information. We will then send our standard question to them of whether they will have a data map available (the response to the questions, "What are you processing on our behalf, what are the common legal reasons for processing it, how long will you keep it for and how will you get rid of it?" There are more things we can ask, but this is a start. The idea is to have pretty much every EdTech supplier that is handling data contacted and with a response by the end of December. And there are *a lot* of folk out there. Yes, we are already chatting with systems integrators. Yes, we are already chatting with RBCs. Yes, we are already chatting with DfE, stakeholder organisations, groups like BESA, and pretty much everyone is saying the only way we will capture it all is we have a strong grass-roots push too. We are grateful for the large number of EdTech firms who are already coming to us and working with us (we can't pre-fill their details in until we have been asked to "ask the question" … ) and also very grateful for those resellers who are also raising the profile of what must be done around GDPR. There are many suppliers and data processors out there that have been working on this for some time already, and anyone with ISO27001:2013 will already be doing a chunk of what is needed … but sometimes it take a bit of time to pull everything together. Some are holding back a little as there is still some advice and clarifications to come out, so we do need to be patient at times. Some already have their data maps out there, but they are only partial (i.e. they cover a lot of items under the DP act as it stands) and we are working with them to update them for GDPR. 11
Meldrew Posted September 19, 2017 Posted September 19, 2017 I've added an entry, just to get the ball rolling. Do let me know if there's anything wrong with what I've done. Meldrew 1
nathan Posted September 19, 2017 Posted September 19, 2017 Just started to add some services, will keep adding. 1
TechMonkey Posted September 19, 2017 Posted September 19, 2017 Added a few I can think of. Hope they are OK. 1
GrumbleDook Posted September 19, 2017 Author Posted September 19, 2017 Looking good. Really appreciate you getting the ball rolling.
enjay Posted September 20, 2017 Posted September 20, 2017 (edited) I've added quite a few (I pulled up our list of third parties from our data protection statement, and added them all). Can I suggest we keep the list sorted alphabetically, otherwise a company is going to get added multiple times. Do you want the likes of Google and Microsoft on there? Also, what about awarding bodies? Edited September 20, 2017 by enjay 1
GrumbleDook Posted October 6, 2017 Author Posted October 6, 2017 I've added quite a few (I pulled up our list of third parties from our data protection statement, and added them all). Can I suggest we keep the list sorted alphabetically, otherwise a company is going to get added multiple times. Do you want the likes of Google and Microsoft on there? Also, what about awarding bodies? If they process personal data, or they provide you a solution that allows you to process data (think about in-house filters and tools).
jmak Posted October 17, 2017 Posted October 17, 2017 Added another couple - only mentioning it as a way of bumping the thread. 1
jmak Posted October 18, 2017 Posted October 18, 2017 I know you want to send a standard set of questions, but wondered if there's any scope for something specific to market sectors? I think we might need to keep separate lists for emergency, school info and marketing contacts. Could we ask MIS providers of they're planning to implement a feature to allow that and parental comms/engagement providers of they'll be utilising it? 1
Andycat Posted October 18, 2017 Posted October 18, 2017 I'm starting to fill this in as I have a meeting in school next week about GDPR, after months of asking! 1
GrumbleDook Posted October 18, 2017 Author Posted October 18, 2017 I know you want to send a standard set of questions, but wondered if there's any scope for something specific to market sectors? I think we might need to keep separate lists for emergency, school info and marketing contacts. Could we ask MIS providers of they're planning to implement a feature to allow that and parental comms/engagement providers of they'll be utilising it? For marketing contacts, they are the data controller and you are the data subject, so that is a slightly separate (but interesting) conversation. For where the data processor is asking you to share parent / guardian contacts so they can have a direct relationship too (I.e. they become the data controller and the parent becomes the data subject), then that would be part of the data sharing agreement they have with you and subsequent agreement they have with the parent. The list is principally concerned with companies that are the data processor on behalf of the school, or where they provide you a system to allow you to process data yourself.
enjay Posted October 18, 2017 Posted October 18, 2017 For where the data processor is asking you to share parent / guardian contacts so they can have a direct relationship too (I.e. they become the data controller and the parent becomes the data subject), then that would be part of the data sharing agreement they have with you and subsequent agreement they have with the parent. We've always refused that in the past, as we don't want suppliers contacting students or parents directly. Guardian notifications in Google Classroom changes that, though. I'm not sure, in that instance, Google do become the Data Controller though, as they're only sending emails we've "authorised" (as in, they are in response to some activity within Classroom). What is your take on that?
GrumbleDook Posted October 18, 2017 Author Posted October 18, 2017 If they are doing it on your behalf, then they are the data processor. If they are forming a direct relationship with the parents (children at multiple schools) it is a service between parent and the company that you have shared data with.
jmak Posted October 18, 2017 Posted October 18, 2017 I am thinking about where they are the processor and we are the controller, but we hold contact records for different purposes and they're all in the same database with a single link (the child). Eg, we collect contact information for parents, grandparents, next door neighbour. All of them are emergency contacts, some will get reports and homework information, others will receive promotions about events at school or things we're selling to raise funds. Of course we will now be asking them to actively opt in, but we can't currently differentiate the permissions granted/reasons for holding data. I've now taken us off topic - not sure if there's a better thread or if we've come to an end anyway...
enjay Posted October 18, 2017 Posted October 18, 2017 If they are doing it on your behalf, then they are the data processor. If they are forming a direct relationship with the parents (children at multiple schools) it is a service between parent and the company that you have shared data with. I'm honestly not sure which you would classify it as! So, the process is this: * teacher adds parents' email addresses to Google Classroom * Google sends activation link to parents * Parents accept and choose frequency of notification * Google starts to send automated emails on a daily or weekly basis summarising activity in Classroom * Google also send reminders as homework deadlines approach or are missed * No promotional material is sent by Google, only summaries of activities with our Classrooms Is that a direct relationship between Google and the parent, or are they acting on our behalf?!
hardtailstar Posted October 18, 2017 Posted October 18, 2017 Added Show My Homework as a lot of Schools are starting to use that and they process a large amount of Student data. 1
ARMSchools Posted October 19, 2017 Posted October 19, 2017 Crowdsourcing is a great idea, thanks. I have added some Contractors to the document. 1
ARMSchools Posted October 19, 2017 Posted October 19, 2017 I'm honestly not sure which you would classify it as! So, the process is this: * teacher adds parents' email addresses to Google Classroom * Google sends activation link to parents * Parents accept and choose frequency of notification * Google starts to send automated emails on a daily or weekly basis summarising activity in Classroom * Google also send reminders as homework deadlines approach or are missed * No promotional material is sent by Google, only summaries of activities with our Classrooms Is that a direct relationship between Google and the parent, or are they acting on our behalf?! A Data Processor can still be a Processor if contacting the parents directly as they are doing so under your (the Data Controller) instruction only
nathan Posted November 10, 2017 Posted November 10, 2017 Do we have a standard set of questions that will be asked of these suppliers yet?
mwnci Posted November 14, 2017 Posted November 14, 2017 I have been through this spreadsheet and updated it with some of our suppliers. I will aim to fill in some more of the blanks when I get a moment. 1
Seb1780 Posted November 15, 2017 Posted November 15, 2017 Added a couple, most of ours are already there.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now