Latest Guidance on UPN

[EdWhittaker]

Following on from a thread started some time ago by GREED regarding the use of UPN by third party providers, DFE have finally come up some explicit advice on the subject. I'm afraid I'm a bit late coming to this, the new guidance was published middle of December. Anyways, if you've not seen it it's here. The relevant section is 2.2, which opens with

"Where a school (or local authority) has entered into an agreement with a third party for the provision of an education related service or system then it will be permissible for the UPN to be used within those systems in accordance with the usual transfer controls."

Hopefully this now puts the issue to bed.

Edited January 18, 2018 by EdWhittaker

[GrumbleDook]

Thanks for the reminder on this.

 

Members need to note that this is in respect to use within English schools.

 

Separate questions will need to be put to the other relevant home countries.

 

(Ed? Would you help?)

[EdWhittaker]

 

Members need to note that this is in respect to use within English schools.

 

Separate questions will need to be put to the other relevant home countries.

 

 

Good point! We have a few schools in Wales. Can't see the advice being much different though?

 

(help? How?)

[GREED]

Hopefully this now puts the issue to bed.

 

I doubt it, someone in particular will now still want to argue the toss...

 

Good find and thanks for sharing

[GrumbleDook]

Good point! We have a few schools in Wales. Can't see the advice being much different though?

 

(help? How?)

 

Ask the relevant department in each country?

[jenatddm]

Following on from a thread started some time ago by GREED regarding the use of UPN by third party providers, DFE have finally come up some explicit advice on the subject. I'm afraid I'm a bit late coming to this, the new guidance was published middle of December. Anyways, if you've not seen it it's here. The relevant section is 2.2, which opens with

"Where a school (or local authority) has entered into an agreement with a third party for the provision of an education related service or system then it will be permissible for the UPN to be used within those systems in accordance with the usual transfer controls."

Hopefully this now puts the issue to bed.

 

Do you know what "the usual transfer controls" are? If so, I'd be pleased to see a copy. As the 2017-18 census guidance states, "subject to Data Protection restrictions". Of course that means that any third-party supplier that uses the UPN must be able to provide a SAR to pupil (and/or parent) on request, and school needs to be able to facillitate telling pupil/parent excatly which third parties have got it and retention periods, purposes of use, etc.

[GREED]

any third-party supplier that uses the UPN must be able to provide a SAR to pupil (and/or parent) on request, and school needs to be able to facillitate telling pupil/parent excatly which third parties have got it and retention periods, purposes of use, etc.[/i]

 

So, just like any other piece of information about them then

[jenatddm]

So, just like any other piece of information about them then

No, not all personal information are equal. Ethnicity like nationality, for example, can only be distributed on consent basis. UPN has restrictions.

 

If your school does enable SAR and distribution tracking, we'd love to see it and champion it as good practice. Yet to see a school or SIMS that can with a decent pupil/parent report.

[GREED]

No, not all personal information are equal. Ethnicity like nationality, for example, can only be distributed on consent basis. UPN has restrictions.

 

I did not comment on information the restrictions of individual items of data - what I said was any third party that contains personal information on a data subject will have to product a SAR on request - not just limited to UPN. This is not a process that suppliers need to wake up for specifically for UPN, but all personal data items.

 

If your school does enable SAR and distribution tracking, we'd love to see it and champion it as good practice. Yet to see a school or SIMS that can with a decent pupil/parent report.

 

Not a school, but our SAR's will be on show at BETT next week for our school facing and infrastructure platforms.

[jenatddm]

I did not comment on information the restrictions of individual items of data - what I said was any third party that contains personal information on a data subject will have to product a SAR on request - not just limited to UPN. This is not a process that suppliers need to wake up for specifically for UPN, but all personal data items.

 

 

 

Not a school, but our SAR's will be on show at BETT next week for our school facing and infrastructure platforms.

Great. Sounds really exciting! Will pop by.