Smokebomb Posted February 21, 2018 Posted February 21, 2018 In preparation for GDPR we are about to make USB pens read only for staff (bar the odd exception). Some feedback we have received is "what about when we send X materials to the exam board on USB pen?" I can't believe Pearson, AQA et al haven't started to think about this to ensure they are GDPR compliant. You would think they would have a secure method of digitally uploading materials to them rather than requesting things be sent in the post. Yes, we can encrypt the content on USB before it goes, but I would be interested to hear if anyone has had any communications from the Exam bodies on how they expect data to be transferred to them securely with the new GDPR rules? 1
3s-gtech Posted February 21, 2018 Posted February 21, 2018 I brought this up last year, and told a member of staff to send their files encrypted. Unfortunately, the receiving moderator/examiner was quarter-witted, as was their IT support, and they were unable to decrypt it despite the instructions sent. When our exams officer found out about all this, I got rinsed. Since then, I've left it up to them to support, life is far too short to get involved with the politics of this. You may just have to remove the restriction ad-hoc, until the boards get their act together.
Smokebomb Posted February 21, 2018 Author Posted February 21, 2018 Unfortunately, the receiving moderator/examiner was quarter-witted, as was their IT support Yes, I think this statement sums the situation up nicely
mavhc Posted February 21, 2018 Posted February 21, 2018 It's rather confusing, when analog exam papers are scanned and distributed via the internet, but digital files are written to cd/usb and posted
enjay Posted February 22, 2018 Posted February 22, 2018 It's rather confusing, when analog exam papers are scanned and distributed via the internet, but digital files are written to cd/usb and posted Plus paper exams are sent back by post/courier. I guess like anything else you need to do a risk assessment, likelihood of post being intercepted/loss against impact of it happening. It is an odd one though - we wouldn't send information of that nature by post/unsecured digital media to anyone else...
Linfit Posted February 22, 2018 Posted February 22, 2018 Videos for moderating the spoken endorsment of the new English Language GCSE caused us issues last year. There is no secure portal for uploading them - they wanted them sent unencrypted on a memory stick in the post. The pupils have to identify themselves at the start of the video. When I queried this (I was the exams officer until last summer) the response was pathetic - no, we have no secure portal plans, no, you can't encrypt them its too complicated for our moderators, whats the problem, all the other schools are cooperating and no-one else has queried things (I didn't believe the last one). In the end, did as I was told as the HOD of English was paranoid about unpsetting them, but made sure the Head knew it was under protest. It will come up again this year. As I am no longer the Exams Officer I will refuse to have anything to do with it if they take the same attitude. I think OCR have a secure web portal for uploading work but the other boards seem to be just hoping people won't question things and are in denial about their DP issues.
MrWrighty Posted February 22, 2018 Posted February 22, 2018 I brought this up last year, and told a member of staff to send their files encrypted. Unfortunately, the receiving moderator/examiner was quarter-witted, as was their IT support, and they were unable to decrypt it despite the instructions sent. When our exams officer found out about all this, I got rinsed. Since then, I've left it up to them to support, life is far too short to get involved with the politics of this. You may just have to remove the restriction ad-hoc, until the boards get their act together. Until receipt of said USB sticks by the relevant board, you will remain responsible for their whereabouts. Removing the restriction to appease a body that hasn't prepared themselves for this is not your problem, data protection is. If they cannot decrypt the files you send them then that is their issue to resolve not yours. 1
3s-gtech Posted February 22, 2018 Posted February 22, 2018 By 'your problem', that will mean 'your school's problem' unless you sent them yourself. Answer being, don't get involved. Even under protest you cannot be required to break the law, funnily enough. If you posted it and it got lost or leaked, guess who they'd throw the book at (hint - check out the thread about the school who showed an inappropriate video to children)! 2
MrWrighty Posted February 22, 2018 Posted February 22, 2018 By 'your problem', that will mean 'your school's problem' unless you sent them yourself. Answer being, don't get involved. Even under protest you cannot be required to break the law, funnily enough. If you posted it and it got lost or leaked, guess who they'd throw the book at (hint - check out the thread about the school who showed an inappropriate video to children)! Yes I should have qualified that, it is the schools problem, but surely everyone is involved in data protection irrespective of the responsibilities. You may not have a choice but to get involved if data protection is not being applied correctly or there is a risk of data being compromised.
free780 Posted February 22, 2018 Posted February 22, 2018 Maybe the exam boards are hoping for schools to setup a share point site with content. Then share to the exam board eliminating any expense for them.
markwilfan Posted February 22, 2018 Posted February 22, 2018 Had this last week. Got told by our dpo she was happy as the videos that are being sent via a courier and if it is good enough for example papers it's good enough for a DVD with videos. In the end we used Google drive to share the visa with the examiner
jenatddm Posted February 23, 2018 Posted February 23, 2018 Videos for moderating the spoken endorsment of the new English Language GCSE caused us issues last year. There is no secure portal for uploading them - they wanted them sent unencrypted on a memory stick in the post. The pupils have to identify themselves at the start of the video. When I queried this (I was the exams officer until last summer) the response was pathetic - no, we have no secure portal plans, no, you can't encrypt them its too complicated for our moderators, whats the problem, all the other schools are cooperating and no-one else has queried things (I didn't believe the last one). In the end, did as I was told as the HOD of English was paranoid about unpsetting them, but made sure the Head knew it was under protest. It will come up again this year. As I am no longer the Exams Officer I will refuse to have anything to do with it if they take the same attitude. I think OCR have a secure web portal for uploading work but the other boards seem to be just hoping people won't question things and are in denial about their DP issues. Now I understand why not a single exam board has replied to my query on their policy and practice and GDPR readiness for report. It's all so **** there is hilarity in waiting to read each new example of bad practice you all have to put up with. Would like to include this as case-study (anonymised) please, unless you have any objection?
Disease Posted February 23, 2018 Posted February 23, 2018 (edited) By 'your problem', that will mean 'your school's problem' unless you sent them yourself. Answer being, don't get involved. Even under protest you cannot be required to break the law, funnily enough. If you posted it and it got lost or leaked, guess who they'd throw the book at (hint - check out the thread about the school who showed an inappropriate video to children)! What is the thread title, interested in a read , ahh don't worry found it Edited February 23, 2018 by Disease
3s-gtech Posted February 23, 2018 Posted February 23, 2018 What is the thread title, interested in a read http://www.edugeek.net/forums/behind-red-door/192749-thats-blame-filtering.html 1
Smokebomb Posted February 23, 2018 Author Posted February 23, 2018 Now I understand why not a single exam board has replied to my query on their policy and practice and GDPR readiness for report. It's all so **** there is hilarity in waiting to read each new example of bad practice you all have to put up with. Would like to include this as case-study (anonymised) please, unless you have any objection? Its beyond a joke really; bad enough that we have to deal with their shoddy exam clients but this is making them look even more incompetent. Tempting to shop them to the media to force their hand on GDPR compliance! 3
Linfit Posted February 23, 2018 Posted February 23, 2018 Now I understand why not a single exam board has replied to my query on their policy and practice and GDPR readiness for report. It's all so **** there is hilarity in waiting to read each new example of bad practice you all have to put up with. Would like to include this as case-study (anonymised) please, unless you have any objection? Go ahead - there must be other schools who have raised the same issue. I can understand why some do not query it though as the IT staff may not get involved in this sort of thing if the teachers and Exams Officers are the ones sending the stuff out, and they may not be aware of the issues. (Although they should be, but most exams officer training is done by Exam boards.....). I was in an unusual position as I was the IT Manager and the Exams Officer. 2
Rob_D Posted February 23, 2018 Posted February 23, 2018 Removing the restriction to appease a body that hasn't prepared themselves for this is not your problem, data protection is. If they cannot decrypt the files you send them then that is their issue to resolve not yours. I wasn't there, by my manager told me they asked about using encrypted drives for the drama exams and were told the board would accept it, but if they couldn't get to the videos they "wouldn't be able to grade" our students.
enjay Posted February 23, 2018 Posted February 23, 2018 Go ahead - there must be other schools who have raised the same issue. I can understand why some do not query it though as the IT staff may not get involved in this sort of thing if the teachers and Exams Officers are the ones sending the stuff out, and they may not be aware of the issues. (Although they should be, but most exams officer training is done by Exam boards.....). I was in an unusual position as I was the IT Manager and the Exams Officer. That could be it. I only get involved in sending electronic exam papers if the exams manager or teachers have problems, so there could be bad practice we're simply not aware of. DPO should be aware, but that's not me :-) I wasn't there, by my manager told me they asked about using encrypted drives for the drama exams and were told the board would accept it, but if they couldn't get to the videos they "wouldn't be able to grade" our students. That is the concern, and why people may be "willing" to use bad practice. We sent something to the exam board once where the student had saved the file as SURNAME_FIRSTNAME rather than FIRSTNAME_SURNAME - the examiner gave the student 0 saying they hadn't submitted any work.
Narwhal Posted March 20, 2018 Posted March 20, 2018 Slightly off the original topic, I have been pondering the relationship between schools and the exam boards.Would the exam boards be Data Controllers in their own right or are they Data Processors for us? I am thinking that they are Data Controllers but other people's views would be appreciated.
Disease Posted March 20, 2018 Posted March 20, 2018 I am pretty sure they would be both a controller and processor, every organisation would be both. They process their own data as controllers and then process the data we send them as processors as we are the original data controllers. 1
theeggmaster Posted March 21, 2018 Posted March 21, 2018 I've got the AQA requirements for sending off videos of students for moderation. They have to state their name at the beginning of the video. AQA are then asking for work to be recorded on a USB stick or a playable DVD. They will not accept any other format and it must be easily playable in VLC. Our data manager has emailed them to ask how we can send our data encrypted or securely as it doesn't comply with GDPR and there are obvious safeguarding issues. 1
mavhc Posted March 21, 2018 Posted March 21, 2018 https://vacancies.aqa.org.uk/node/1489 Something something vision, something something gdpr, something something it's March 2018, why are we will still hiring someone? 2
Love_Sausage Posted March 21, 2018 Posted March 21, 2018 The same exam boards who only just moved away from Cassette tapes, colour me surprised.
mjk Posted March 21, 2018 Posted March 21, 2018 Had this last week. Got told by our dpo she was happy as the videos that are being sent via a courier and if it is good enough for example papers it's good enough for a DVD with videos. In the end we used Google drive to share the visa with the examiner hey @markwilfan would you mind sharing the risk assessment that says it's ok to send personal info via courier, it will be really useful for our GDPR.
markwilfan Posted March 21, 2018 Posted March 21, 2018 hey @markwilfan would you mind sharing the risk assessment that says it's ok to send personal info via courier, it will be really useful for our GDPR. Cool story @mjk hahaha like our dpo has risk assessed that. I might ask the exams guys to ask her for it.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now