GDPR and Exam bodies

[3s-gtech]

The exam paper may well contain enough data to be classed as personal. However, it's not in the remit of IT, we can't influence or affect how they're handled. With electronic submissions, it often falls to us. It's up to the DPO to manage them both - but it's better for us if IT is up to speed at least.

[jmak]

My driving licence arrived in 2nd class post with my name, address, DoB and photo...

 

On the government's website, it explains the risk assessment and justification for doing it that way. Whether you agree with them or not, if the government is doing that, it's a tough case to argue that exam board should do anything better...

[sted]

My driving licence arrived in 2nd class post with my name, address, DoB and photo...

 

On the government's website, it explains the risk assessment and justification for doing it that way. Whether you agree with them or not, if the government is doing that, it's a tough case to argue that exam board should do anything better...

id argue that thats 1 persons info and by necessity a lot of that info has to be on the outside of the package anyway (or it cant be delivered) whereas 200 student videos (for example) is a lot more peoples info and none of that has any business to be on the envelope or in plain sight

[enjay]

My driving licence arrived in 2nd class post with my name, address, DoB and photo...

 

On the government's website, it explains the risk assessment and justification for doing it that way. Whether you agree with them or not, if the government is doing that, it's a tough case to argue that exam board should do anything better...

 

Your name and address has to be on the outside, otherwise the postie won't know where to deliver it! I take your point though, it is worrying something as important as a driving licence is sent through regular post, not Special Delivery (or at the very least, tracked).

[mjk]

Your name and address has to be on the outside, otherwise the postie won't know where to deliver it!

I wouldn't mind betting there are some GDPR 'consultants' out there trying to ban Royal Mail as we speak.

[jthompson]

Just remember when using password protected ZIP as the archive format that it only encrypts the files within, not the structure. If you have files in the .zip called year_student_name_subject this won't be good enough.

 

Indeed. A zip within an encrypted zip can address that.

[Ex-MGSTech]

AQA Encrypted media guide: http://filestore.aqa.org.uk/admin/nea/AQA-ENCRYPT-NEA-MEDIA.DOCX

 

OCR Secure Upload Portal: https://interchange.ocr.org.uk/

https://interchange.ocr.org.uk/modules/Login/New%20Interchange%20Agreement.pdf

 

WJEC Secure Portal: Secure Website - Frequently Asked Questions

Edited May 8, 2018 by Ex-MGSTech

[Arthur]

New update from AQA, stating that they are happy to use Winzip or Bitlocker. There is also a link to some guidance on how to encrypt media and a form to be emailed separately with the password on it.

 

Dear exams officer

 

The General Data Protection Regulation (GDPR) goes live on 25 May 2018 and we’ve received some questions regarding the sending of media (e.g. USBs, DVDs etc) securely. One way that some schools have chosen to send media securely in the past is by using encryption, although this is not a requirement.

 

To help us support you at this busy time, if you choose to encrypt your media, please use Winzip or Bitlocker. If we receive materials that are encrypted using other methods unfortunately we’ll not be able to unlock them and will need to return them to you.

 

If you’re unsure about how to encrypt your media we have created some guidance which is available on our website.

 

Please don’t worry if you’ve already submitted your coursework sample and it wasn't encrypted, these are guidelines and it is not an AQA requirement.

 

Kind regards

 

Philip Bridgehouse

Customer Service Manager

^ Does this mean we don't need to bother?

[Rob_D]

^ Does this mean we don't need to bother?

 

We just got passed this email. I assumed it meant that it wasn't an AQA submission requirement.

And techncially encrypting the USB drive isn't a GDPR requirement, it's just one of the most convenient ways to show best efforts. I mean, you could lock into into a briefcase and ship it cuffed to an ex-SAS operative, but that might be a tad expensive. :S

[mavhc]

You're responsible for who and what and how you give 3rd parties the personal information your business holds

[artfulmatt]

I currently have an issue with PE sending video footage to the moderator - best and most secure way I've found is to share a folder on onedrive/sharepoint 365 which emails the moderator a link who then has access to the footage. We then keep control of the permissions, (set to read only)