GDPR - DPO and External IT Provider

[IT4Edu]

Hello,

 

We use an external company who shall remain nameless - they provide IT services to our school, essentially acting as the Network Manager. They provide support and help to implement systems.

 

Could the same company act as the school's DPO - I'm thinking along the lines of a nominated contact for the IT management side and another for the DPO role? We have tried to contact the ICO but they don't seem to be coming back with anything. If anyone knows the best way to contact them please let me know!

 

Thanks in advance

Dave

[elsiegee40]

No because they would be auditing their own responsibility for processing Data. There is a conflict of interest.

 

And don't forget that the DPO is responsible for all paper data as well as electronic

[GrumbleDook]

I will disagree with @elsiegee40 and say yes ... in the same way a school can employ someone to be a DPO.

 

In large managed companies there are demarcations between departments (services, legal, finance, etc.) so you need to consider the risk of whether someone in this external company doing an audit of someone else on the same company is a risk to you ... for both conflicts of interest and for management of the contract with the external provider.

 

Those taking DPO as a service from LAs have this to consider and, all being good, this has generally been seen as low risk ... but it is up to the school to decide.

[elsiegee40]

I will disagree with @elsiegee40 and say yes ... in the same way a school can employ someone to be a DPO.

 

In large managed companies there are demarcations between departments (services, legal, finance, etc.) so you need to consider the risk of whether someone in this external company doing an audit of someone else on the same company is a risk to you ... for both conflicts of interest and for management of the contract with the external provider.

 

Those taking DPO as a service from LAs have this to consider and, all being good, this has generally been seen as low risk ... but it is up to the school to decide.

Can a business that's managing your network also be DPO @GrumbleDook?

 

That would be like getting the same firm of accountants to run your accounts department and be your auditor. It wouldn't wash with the authorities. Even a big accountancy firm like PwC wouldn't get away with doing both even though they'd be done by separate parts of the business.

 

I cannot see how you can let the same company be both DPO and your network management

Edited February 15, 2018 by elsiegee40

[GrumbleDook]

If the networks team at your LA put in your network, would you stop the legal team being DPO?

The same rules on assessing conflicts of interests apply.

[elsiegee40]

There's a difference between installing the network and running it. This company, as I read it, is running the network

[GrumbleDook]

If the networks team was running your network would you allow the legal team be DPO?

 

What would the conflict of interests be?

[elsiegee40]

If the networks team was running your network would you allow the legal team be DPO?

 

What would the conflict of interests be?

I see what you're getting at. Comparing it so literally with financial law is perhaps not appropriate. I think you would need to satisfy yourself that there was no conflict within the company that provides both services.

[enjay]

I see both sides of this, but think I'm coming down on @GrumbleDook 's. You would need assurances the DPO would act impartially and be able to independently audit the IT side, but if the company were big enough I think this might work. @elsiegee40 's analogy of accounts and financial audit isn't the same, in my view, as the DPO role is about much more than IT management.

 

That said - and I admit I can be quite a cynical person - I would be worried this could be an opportunity for the DPO to identify a need for additional products and services which the IT side of the business would then deliver.

 

Don't lose sight of the other point in @elsiegee40 's first response though - DPO is about paper too, not just IT systems.

[GrumbleDook]

I see what you're getting at. Comparing it so literally with financial law is perhaps not appropriate. I think you would need to satisfy yourself that there was no conflict within the company that provides both services.

 

I think mention of finance has been taken out of context slightly ... I mentioned the finance department to show it is a designated team with the LA that is likely to have nothing to do with the IT team installing and running networks.

 

This is a governance issue, and yes ... you do need to be 100% sure that it can work, but how about thinking about it in an environment dealing compartmentalised information where only those who need to know, actually go know. Safeguarding is an example ... and whilst there is the possibility of people talking ... job descriptions, contracts, etc. rule this out (or should do) ... and the same applies to audit and compliance services.

 

Of course, this would have to be included in any contract and carefully reviewed and checked on a regular basis.

[TwistedHelixis]

Does this not depend on the size of the external company. If it's just a one man company that is looking after the schools network as the network manager, surely they could not do gdpr for that school.

[GrumbleDook]

Does this not depend on the size of the external company. If it's just a one man company that is looking after the schools network as the network manager, surely they could not do gdpr for that school.

 

Yes, it does depend on the size of the company. In the same way it depends on the size of a school as to whether there are enough staff / resource so an in-house DPO doesn’t have a conflict of interests.

 

There does need to be clear segregation between any ‘operational’ activities by contractors / service providers and any “audit / governance”, and that is a risk management activity when you purchase services.

[andyturpie]

Remember guys and gals - GDPR wasn't brought in with schools in mind (they b*oody should have given us half a thought lol). All this is untested law we will be facing. I reckon this time next year we will still have a lot of what ifs and whataboutery flying around

[GrumbleDook]

Remember guys and gals - GDPR wasn't brought in with schools in mind (they b*oody should have given us half a thought lol). All this is untested law we will be facing. I reckon this time next year we will still have a lot of what ifs and whataboutery flying around

 

Very true, but we are also facing that fact that the existing DPA is fairly untested for schools and some of the existing guidance needs a good overhaul (it is underway). It is going to be an ongoing journey ... and even if everyone is 100% compliant come 25th May, we still have various items to be worked on over the next few years ... codes of practice for age-appropriate website design, age-verification systems, certification and accreditation schemes for DPOs and other services ... it is going to be an evolving beast.