Another GDPR Question - BSF - Managed Service

[david_1152]

So does anyone know anything about GDPR with managed BSF service?

 

 

 

A company runs our network, supplies the technicians, provides all hardware, software and backups. I'm not naming names here, but I keep asking them (our managed service provider) for information on GDPR and have yet to receive anything.

 

So, as this company runs our systems would they be financially responsible for any breaches?

 

They after all run everything for us - take the backup, only they have access to it or even know what their procedures are. If we receive a delete request, I will have to depend on staff not working for the school to perform this duty and then will only have their word that it's been completed.

 

They have supplied all of the main systems into the school, such as library, door entry, school dinners and VLE - all from different companies yet all suppled by them to us. Do we still have to check out all the suppliers even though we are not their customers?

 

Any help ladies and gents would be fantastic.. Oh and see you all at BETT.

 

 

Dave

[Sylv3r]

I am guessing if your paying the third party for these particular services - your still responsible for the data therefore the fines etc that 'may' follow.

[enjay]

I suspect it depends on what actually happens. You selected the company you would outsource too so should have vetted them appropriately, therefore if the company doesn't have any policies, I think that's on you. If however they have policies but fail to adhere to them, that's on them. I think.

[david_1152]

Well being totally unsure where we stand I contacted the ICO directly. Head up here everyone - the ico's help line number is 0303 1231113. So, basically I went to the top for this, not a company with an axe to grind or services to sell.

 

After a 45 minute wait on hold I managed to talk to them, explain the situation and get answers. I would recommend this help line to anyone, yes there's a wait - but it's worth it.

 

SO here's the news for BSF schools - or certainly BSF schools in out situation.

 

Our network was designed by our BSF providers, the way it functions, where the data sits, on which drives, how it's backed up, where those backup sit, the AD, the actual network forest, all of the administrators all work for our BSF partner.

 

Because of this, they are data controllers and so are liable to fines.

 

But - and here's where some confusion can occur, they are also data processors for us, where they manipulate data as we ask. We will need a contract to ensure we know how this data is handled.

 

That's what the ICO have informed me, but I'd recommend unless your situation is exactly the same as ours, ring the ICO and have the conversation.

 

David

[jimmy_2k]

I wonder how many managed services there are left out there.

[FN-GM]

I wonder how many managed services there are left out there.

 

Many manages services for schools that are outside of BSF.

[david_1152]

Well, there's our group in Birmingham.

 

Hmm, so BSF was scrapped in 2010. It ran for 10 years for ICT (or did in our group). It's pretty impossible to get out of, so lots coming to an end over the next few years. Lots of companies still offer versions of it, RM springs to mind. Lots of schools feel it's the only real way to provide fast and reliable IT support - their words not mine!

 

D

[GrumbleDook]

Whenever possible use the ICO chat service as you get the chat transcript with it.

 

I’ve had the same chat as part of questions on liabilities.

 

The school is *always* the Data Controller and there are times this is shared with a supplier. This is a judgement decision of the school.

 

You may decide that they are just a Data Processor or that the design, decisions and requirements on data and how it is processed is *completely* controlled by the supplier, and that means they have to be considered as a joint Data Controller ... BSF is one of the few examples of this and it will depend on the implementation. You *will* needs this to be agreed by the Service Provider, and contracts updated.

 

If they do not then don’t panic. They are still a Data Processor and under GDPR they now have liabilities too. There is no escaping it!

[PotNoodleTech]

Sounds like an ideal opportunity to bring your IT services back in house, and therefore back under your control to me!

[david_1152]

Sounds like an ideal opportunity to bring your IT services back in house, and therefore back under your control to me!

 

Contract still runs for another two years yet... Then? Well who knows. Down to the boss as always.

 

D