UK Schools GDPR Survey

[Dos_Box]

This survey is being posted on behalf of defenddigitalme.com

 

This survey is to help us understand your GDPR readiness in UK schools*, and help you get more support where needed.

 

We'd like you to contribute to a picture of GDPR readiness in education in the UK, by taking part in this online survey. It should take no more than 10 minutes to complete, there are 25 required questions. There are also optional questions at the end to help support the breakdown of analytics.

This is only for state-funded educational organisations for any children age 2-19. This survey is not intended for the independent sector, except state-funded Alternative Provision and pre-school private settings.

 

The anonymous responses you provide will contribute to building:

 

• 
  
• A summary of what support the education sector still needs in order to have confidence in their GDPR readiness
  
• Aggregated feedback to give policy makers at the Department for Education and Information Commissioner’s Office
  
• Findings for a free report to be published next month, coordinated by defenddigitalme and to be launched in the House of Commons
  
• Better understanding of the breadth of technology commonly used in schools today
  
• A picture of why consistent guidance is needed on data protection and privacy to deliver clarity, consistency, and confidence to schools and developers
  

 

Please complete the survey here before 12:00 midday on February 14th >> https://www.surveymonkey.co.uk/r/GDPR_support

 

 

How the information you provide will be used

 

The survey is anonymous. If you want at the end of the survey, you can choose to provide contact details for follow up questions or clarification, or to have your explicit question answered directly to you or aggregated it may be included in the FAQs in the report.

Contact details are optional. We will not use any of the metadata from the survey, such as IP address, for any purpose. We are interested in general findings.

 

The questions and aggregated answers and percentage scores, but no identifying comments, will be published on our website for full transparency after they have been reviewed. Two volunteers on behalf of defenddigitalme will have access to the answers and any identifying information you do provide. Any contact data volunteered, will not be used for any other purposes. For any questions please ask here on the forum, or email [email protected]

 

If you have any questions or queries about the survey please address them to @jenatddm

 

*Please note question 15 on the survey is for schools in England only due to the different way pupil data is shared there compared to the rest of the UK

Edited February 9, 2018 by Dos_Box

[enjay]

q19 isn't relevant to GDPR

 

q20 doesn't have an option to select for school-managed

 

q21 no option for "none", some of the options listed are not automated decisions

 

q25 lists MyMaths twice, some options don't make sense

[jenatddm]

q19 isn't relevant to GDPR

 

q20 doesn't have an option to select for school-managed

 

q21 no option for "none", some of the options listed are not automated decisions

 

q25 lists MyMaths twice, some options don't make sense

 

Thanks Enjay some useful corrections made as a result, as none will affect any of the answers already given by contributors. (many thanks all, really interesting and great questions coming in too!!)

 

q19 is relevant to GDPR because of the significant implications for consent and software installations dependent on ownership.

 

q20 Added option for school-managed

 

q21 clarified to add additional option for "no profiling or automated decsion making", >> some of the options listed are not automated decisions<< yes but all are profiling and question pertains to either

 

q25 lists MyMaths twice, some options don't make sense -- thanks well spotted, changes made, feel free to criticise further to make clearer if needed. Thanks all help much appreciated.

[enjay]

q21 clarified to add additional option for "no profiling or automated decsion making", >> some of the options listed are not automated decisions<< yes but all are profiling and question pertains to either

 

I'm not sure on that one. We get students to sit CATs tests or whatever which don't have a simple right/wrong outcome and instead formulate something similar to an IQ score, but I thought the issue under GDPR was to do with decisions being made automatically . If we refused a child a place in the school or drew rigid lines about class groupings as a result, it may relate. If, however, the CATs score is part of the information used by a teacher to determine class sets, I don't think the right to refuse applies. Please correct me if I'm wrong (and I mean that genuinely!)

[jenatddm]

I'm not sure on that one. We get students to sit CATs tests or whatever which don't have a simple right/wrong outcome and instead formulate something similar to an IQ score, but I thought the issue under GDPR was to do with decisions being made automatically . If we refused a child a place in the school or drew rigid lines about class groupings as a result, it may relate. If, however, the CATs score is part of the information used by a teacher to determine class sets, I don't think the right to refuse applies. Please correct me if I'm wrong (and I mean that genuinely!)

 

You're spot on. The right to refuse is another separate point. The question could have been separated out to profiling OR automated decison making, but what we're trying to identify is either. What needs clarification I believe in guidance is where we draw that line, because although the teacher may use the CATS score - if they cannot assess that the CATS score is accurate, ie.the algorithm are not transparent and errors can be spotted by the teacher - then that is not enough. But then we get far along into the detail of DP and systems design and lots of unknowns as yet. And the next question is if the CATS scores are being passed on to govt at DfE level, and they are doing behavioural insights analysis on them at pupil level, or start joining with other data sets, where do we draw the line with a right to refuse? Thanks for asking. I *really* appreciate comment and criticisms as both help get me beyond my knowledge and we need as much 'on the ground' applied thinking in this report work as possible.

[enjay]

What needs clarification I believe in guidance is where we draw that line, because although the teacher may use the CATS score - if they cannot assess that the CATS score is accurate, ie.the algorithm are not transparent and errors can be spotted by the teacher - then that is not enough.

 

That is why I said about human intervention, and the CATs score not being the only thing used. If the algorithm was wrong, the result wouldn't match what else we knew about the student. Alternatively, we could say as long as the algorithm is equally wrong for all students, i.e. marks them all down by a similar degree, it doesn't matter.

 

And the next question is if the CATS scores are being passed on to govt at DfE level, and they are doing behavioural insights analysis on them at pupil level, or start joining with other data sets, where do we draw the line with a right to refuse?

 

I don't believe the CATs data is being shared with DfE. SATS, FFT and exam results go (direct) to Government, but not CATS.

[jenatddm]

I don't believe the CATs data is being shared with DfE. SATS, FFT and exam results go (direct) to Government, but not CATS.

 

Hmmm. The Nudge Unit requested them from DfE to match with national pupil data. I wonder if then they have them direct from GL Assessment, or perhaps it was a fishing exercise?

 

Source National pupil database third-party requests

[TD="bgcolor: #deebf7"]

DR170621.02

[TD="bgcolor: #deebf7"] Behavioural Insights Team Ltd

[TD="bgcolor: #deebf7"] The CAT4 suit of tests is used throughout England to measure a wide range of pupils’ skills, predicated around spatial reasoning. This allows teachers to identify a pupil’s various strengths and weaknesses, their true learning potential, as well as recognising whether a pupil is “underachieving” in their Key Stage, GCSE and even AS/ A Level exams and mock exams. It can also help teachers in target-setting.
The KS2, GCSE, AS/ A Level grades will be used as Indicators, that are then combined with the CAT scores, to provide schools with information that investigates the relationship between verbal, non-verbal , quantitative and spatial tests and attainment in English, mathematics and science for the above mentioned exams, in addition to searching for a correlation between backgrounds (e.g. free school meals, gender, ethnicity) and attainment.

[enjay]

Don't know. I will ask the question though, because obviously we should be aware of it if GL are sharing this data (it may well be the relevant staff here are aware)

[enjay]

Our exams manager says GL Assessment only share the results with us, so I don't think the person who requested it from DfE will have much success.

[Dos_Box]

*BUMP* @jenatddm has asked me to give any of you who have not yet taken to survey to please take 5-10 mins out to complete it.

Remember, the results if this will be made publicly available as laid out in the initial post and none of your details will be used for anything other than the completion of the survey.

She is also very grateful of the feedback you have given so far and if you see anything else in there that needs addressing please post it up here.

[jenatddm]

We've some really useful responses and will be included in report coming out on March 12th and discussed at this event, but would really like to get more contributions, so the survey is still open and extended until next Wednesday or until we get 100 replies. Thank you!

 

Please complete the survey or encourage colleagues or friends at other schools to do so, here ideally before 12:00 midday on February 21st >> https://www.surveymonkey.co.uk/r/GDPR_support

 

 

This survey is to help us understand your GDPR readiness in UK schools*, and help you get more support where needed.

 

We'd like you to contribute to a picture of GDPR readiness in education in the UK, by taking part in this online survey. It should take no more than 10 minutes to complete, there are 25 required questions. There are also optional questions at the end to help support the breakdown of analytics.

 

This is only for state-funded educational organisations for any children age 2-19. This survey is not intended for the independent sector, except state-funded Alternative Provision and pre-school private settings.

 

The anonymous responses you provide will contribute to building:

 

 

• A summary of what support the education sector still needs in order to have confidence in their GDPR readiness
  
• Aggregated feedback to give policy makers at the Department for Education and Information Commissioner’s Office
  
• Findings for a free report to be published next month, coordinated by defenddigitalme and to be launched in the House of Commons
  
• Better understanding of the breadth of technology commonly used in schools today
  
• A picture of why consistent guidance is needed on data protection and privacy to deliver clarity, consistency, and confidence to schools and developers
  

 

 

Please complete the survey here ideally before 12:00 midday on February 21st >> https://www.surveymonkey.co.uk/r/GDPR_support

 

 

How the information you provide will be used

 

The survey is anonymous. If you want at the end of the survey, you can choose to provide contact details for follow up questions or clarification, or to have your explicit question answered directly to you or aggregated it may be included in the FAQs in the report.

Contact details are optional. We will not use any of the metadata from the survey, such as IP address, for any purpose. We are interested in general findings.

 

The questions and aggregated answers and percentage scores, but no identifying comments, will be published on our website for full transparency after they have been reviewed. Two volunteers on behalf of defenddigitalme will have access to the answers and any identifying information you do provide. Any contact data volunteered, will not be used for any other purposes. For any questions please ask here on the forum, or email [email protected]

 

If you have any questions or queries about the survey please address them to @jenatddm

 

*Please note question 15 on the survey is for schools in England only due to the different way pupil data is shared there compared to the rest of the UK.

[jenatddm]

Feedback summary from the GDPR readiness in UK schools survey is ready.

 

First, thank you to everyone who took part. The 35 responses are summarised here. I am leaving the survey open, because we can still include your feedback in ongoing discussions, and highlights will be included in the broader sector report we're bringing out next month. With only 35 it's not a large enough sample to be statistically robust, but it's a helpful snapshot.

 

Staff views on GDPR readiness in schools.pdf

 

Please complete the survey here if you still want *your* views included and have not already done so >> https://www.surveymonkey.co.uk/r/GDPR_support

 

Questions?

For any questions or feedback on the summary, please ask here on the forum, or email [email protected]

If you have any questions or queries about the survey please address them to jenatddm

 

The anonymous responses you provide will contribute to building:

 

 

• A summary of what support the education sector still needs in order to have confidence in their GDPR readiness
  
• Aggregated feedback to give policy makers at the Department for Education and Information Commissioner’s Office
  
• Findings for a free report to be published next month, coordinated by defenddigitalme and to be launched at an event in the House of Commons
  
• Better understanding of the breadth of technology commonly used in schools today
  
• A picture of why consistent guidance is needed on data protection and privacy to deliver clarity, consistency, and confidence to schools and developers
  

[Steve21]

I'll be honest and say I only had a very quick glance so not sure if I'm being dumb on a morning but I'm not really sure half these figures seem to add up.

 

As an example:

 

Question 3. Has your organisation assigned a Data Protection Officer yet?

Yes 20.00 % 7

No. but we will by end of May 2018 54.29 % 19

No and no plans to do so 20.00 % 7

Don’t know 5.71 % 2

Answered 35

 

Question 24. What is missing for your school to be ready for GDPR in May 2018 and to meet the expected standard ongoing in future?

An assigned DPO role 77.14 % 27

 

How can 77~% miss a DPO if over 25% have one or don't know? (or if you assume the don't knows need one surely 80%~)

 

Another example being #2, adds up to 128%~ and those were just first two I flicked through really.

 

Either something's gone amiss in those calcs or I feel there's some explanation missing on how those figures are being worked out.

 

Steve

[enjay]

More attention needs given to routine profiling of children under GDPR

Almost all use software that creates automated decisions or profiling of children. (ie that track

data over time and store or present or use a cumulative picture of activity or behaviours).

Only 20 of 35 considered that Attainment and monitoring progress were measured in this

way, 37% use software for profiling behaviour and 32% for creating seating plans, 32%

perceive web monitoring software in this category, and 26% have software that profiles food

consumption, with 23% doing so using biometrics. But 23% weren’t sure.

I think it misleading to mention seating plans, and possibly some of the other tools listed, in this context. While our seating plans may display profiled and/or cumulative data (e.g. CATs scores, net total of achievement/behaviour points) there is little if any automated decision-making involved. I would be surprised if a teacher bases their seating plan solely on the results of an IQ test: smartest kid at the back, weakest at the front. Similarly, we have software which can report on a child's eating habits but we are not making automated decisions based on this - there is no compulsory additional sports activity for students who eat more than 3 cookies a week!

 

That would be my interpretation of automated decision-making and profiling, happy to have my definition challenged.

[jenatddm]

I'll be honest and say I only had a very quick glance so not sure if I'm being dumb on a morning but I'm not really sure half these figures seem to add up.

 

As an example:

 

 

 

How can 77~% miss a DPO if over 25% have one or don't know? (or if you assume the don't knows need one surely 80%~)

 

Another example being #2, adds up to 128%~ and those were just first two I flicked through really.

 

Either something's gone amiss in those calcs or I feel there's some explanation missing on how those figures are being worked out.

 

Steve

The calcs are right and you're also right that if anything's unclear we can add some explanation. What isn't possible to show is where people change their mind or give inconsistent answers, and the number is small, so the % changes by 2.86% for each one person's answers in this, which is why bigger surveys are statistically significant and this one is not -- as we say in intro, this is nothing more than a flavour of what is needed and collecton of views. But ones that are pretty consistent with what we hear across the sector.

 

Let me know please too, if you think the conclusions need different things suggesting as a result? That's what will get read (first).

 

In detail to answer you, first they're two separate questions so people can answer as they choose to and change their mind in each one.

 

In Question 24 there are 27 ot of 35 (or 77.14%) who answer "what's missing" (today for the future) is an assigned DPO role.

In Queston 3 there are 26 out of 35 who reply, either they do not yet have an assigned DPO role (54.29%) or do not have plans to have one place by May (20%)= total 26. (74.29%)

In Queston 3 two reply don't know.

 

One of the "don't know's" in Q3 answered "what's missing" is an assigned DPO role in Q24.

 

 

Second, any question that adds up to over 100% shows it was possible to have multiple answers -- ie the data protection responsibilities today are often split between multiple people on the same site -- you're right that the % total is therefeore is meaningless, but it's a useful indicator of the types of people currently assigned the duties, in each type of role of its own. I'll add a note, thanks for pointing it out. (It's why I shared here first to get these criticisms and improve it for outside readers, so genuinely, thanks for asking!)

 

[ATTACH=CONFIG]47869[/ATTACH][ATTACH=CONFIG]47870[/ATTACH]

[jenatddm]

I think it misleading to mention seating plans, and possibly some of the other tools listed, in this context. While our seating plans may display profiled and/or cumulative data (e.g. CATs scores, net total of achievement/behaviour points) there is little if any automated decision-making involved. I would be surprised if a teacher bases their seating plan solely on the results of an IQ test: smartest kid at the back, weakest at the front. Similarly, we have software which can report on a child's eating habits but we are not making automated decisions based on this - there is no compulsory additional sports activity for students who eat more than 3 cookies a week!

 

That would be my interpretation of automated decision-making and profiling, happy to have my definition challenged.

 

routine profiling "or" automated profiling in same question, and may not always be an "and". Thanks for flagging I'll make clearer.

[jenatddm]

Updated version including changes made from your feedback. Many thanks.http://defenddigitalme.com/wp-content/uploads/2018/03/Staff-views-on-GDPR-readiness-in-schoolsv5.pdf Edited March 1, 2018 by jenatddm