Accelerated Reader - Data residency

[ozydave]

Just been asked to upload student data to Accelerated Reader.

Just reading their privacy policy, Seems the data i upload will be held in the US.

 

Is there anything in GDPR that the data MUST be within the EU?

 

 

 

 

Cheers

[GrumbleDook]

Just been asked to upload student data to Accelerated Reader.

Just reading their privacy policy, Seems the data i upload will be held in the US.

 

Is there anything in GDPR that the data MUST be within the EU?

 

Cheers

 

It is a Risk-Management thing, to be honest. UK data controllers have Privacy Shield in place for US residency, but for some they want more ... which is why folk like Google and Microsoft use the EU Model Contract Clauses.

 

If you email [email protected] and ask if they are considering using the EU Model Contract Clauses, and then ask for a copy of the Data Sharing Agreement they will respond in due course.

[clangstaffnhts]

Did you hear anything back about this from Accelerated Reader?

 

This is a system we are also using and we are desperately trying to avoid the data outside of the EU situation as there are lots of hoops to jump through!

[ozydave]

nope not heard anyhting back as yet, It had slipped my mind to be honest. I will chase this up Monday

[djrscally]

I hope they never respond so I can have an excuse to get rid of AR...

[clangstaffnhts]

Any updates on this would be greatly appreciated - I'll send them an email too. Hopefully they'll consider using the EU model!

[clangstaffnhts]

I have received the following from the DPO at Renaissance Learning.

 

---

 

Thanks for reaching out. I am the Data Protection Officer for Renaissance and am spearheading our GDPR compliance issues. You are correct that right now data is transferred to our US data centres. While that may change later this year, that is the current state of things. Renaissance is certified under the EU-US Privacy Shield for such transfers. We will be rolling out a data processing addendum in April related to GDPR compliance and anticipate that it will address any data-transfer issues not already address by our contracts.

If you have any other questions, please feel free to reach out.

Best regards,

Eric

Eric Barber | CORPORATE COUNSEL AND DATA PROTECTION OFFICER

[ozydave]

thanks @clangstaffnhts. I was just in the process of tapping away at my keyboard to email them, saved my a job.

 

To my mind we should stop using them - Maybe like @djrscally i'm looking for an excure too :-)

[ozydave]

Having just spoken to the ICO, currently, as we are still under the DPA ,we are OK to transfer data to US (Accelerated Reader) if there is a data shield in place, which there is.

 

The ICO were quiet clear, when the GDPR comes into force we may well not be compliant if we continue to use Accelerate Reader.

 

The ICO said the law around EU-US privacy and GDPR is still being refined but we the (The School) may well have to draw up an “Approved code of Conduct” clause (under article 40 I think it was) to continue to use them. They will need to agree and sign the contract. ICO suggest keeping an eye on their site for updates and clarifications.

 

As the response from Accelerated reader above says, they are looking at their own compliance with regards to GDPR and they move the data to the UK

[PaulBedford1]

Here is the reply I was sent back.

 

GDPR Compliance Overview - Renaissance Learning

 

Thank you for reaching out. If you haven’t already, please start with our GDPR informational page (GDPR Compliance Overview - Renaissance Learning), which should answer a number of your questions. We do not send out a detailed sheet of our security measures, but I will see what we can put together for you. I’m copying in REDACTED, who can get you a copy of your current Terms and Conditions with Renaissance Learning. You’ll also want to talk the individual at your school who oversees the relationship with Renaissance Learning, as he or she will also know exactly what data elements we collect. The list can vary slightly from school to school. Additionally, you should be receiving a copy of our GDPR-ready contract addendum. If you have not received that, our main contact at your school likely already has.