Sending Exams Data by post

[pcstru]

Schools send exam collateral to exam boards which may be written exam papers or electronic submissions on digital media. There is little doubt that the contents identify unique living individuals and so constitute personal data under both the DPA and the GDPR. Items are sent to exam boards essentially by registered mail.

 

Last year the ICO fined Greater Manchester Police £150,000 for a witness statement that went missing. The ICO said :

 

“When people talk to the police they have every right to expect that their information is handled with the utmost care and respect.

 

“Greater Manchester Police did not do this. The information it was responsible for was highly sensitive and the distress that would be caused if it was lost should have been obvious.

 

“Yet GMP was cavalier in its attitude to this data and it showed scant regard for the consequences that could arise by failing to keep the information secure.”

 

While a witness statement might have more of a detrimental impact on the data subject than the loss of an exam paper, such a loss could still be detrimental and have impacts on the data subject themselves. Someone has a duty of care to make sure there is adequate protections.

 

Here when I have raised the issue with the head, the response is basically "well, everyone is doing it so it must be OK". Are any other fellow edugeekers concerned that this is a risk in plain sight and that we should be working with exam boards to ensure that data is given appropriate protection in transit? Also, who in the case of this data is the data controller - the exam board or the school?

[3s-gtech]

Yup, and I got a right telling off last year for insisting that exam materials sent to an external moderator on USB stick should be encrypted - I got so shouted down that I just shrugged and left them to it. I won't be responsible if that one goes awry. As for paper materials, I leave that to those paid far more than I. The school would be the data controller in this case (IIRC), at least until it's received and handled, as they sent it.

[djrscally]

I would say the school is the data controller, but that I think the current arrangement (I.E. a mixture of couriers and recorded delivery) is probably sufficient. As you point out, the severity of witness statements being misplaced is some orders of magnitude worse than exams material going missing. I think the severity of a package of exams papers being lost is low enough that the current level of protection is appropriate, given the boards have methods of compensating students by using other methods to approximate their grades.

[enjay]

Unless you're either the DPO or the exams manager, I'd flag it and walk away.

[Martin48]

Flagged this up recently as something what needs looking at, currently we are insisting on password protected zip figuring that encrypts the data and is more universally readable then encrypted disk.

[enjay]

Flagged this up recently as something what needs looking at, currently we are insisting on password protected zip figuring that encrypts the data and is more universally readable then encrypted disk.

 

That's all well and good, but 99% of your exam papers are exactly that - paper.