Unidays & GDPR

[fiza]

Some of our older students have asked if they can sign up to Unidays website. Unidays say they only need to sign up with their School email address to verify they are students and the school have no further involvement.

 

Is this something for our GDPR audit? We are not asking the Students to sign up for anything related to School activities.

 

Their Privacy Policy contains this paragraph

 

[h=3]Disclosure of your information[/h]The information you provide to us will be held on our secure computers in the UK and Ireland may be accessed by or given to our staff working outside the UK, some of whom may be located outside the European Economic Area, who act for us for the purposes set out in this policy or for other purposes approved by you. Those parties process information and provide support services on our behalf. We may also pass aggregate information on the usage of our site to third parties, but this will not include information that can be used to identify you.

Countries outside the European Economic Area do not always have strong data protection laws. However, we will always take steps to ensure that your information is used by third parties in accordance with this policy.

Confirmation of whether you have an account registered with us - by the email address you register or verify with - will be publically available.

Unless required to do so by law, we will not otherwise share, sell or distribute any of the information you provide to us without your consent.

Finally, if our business enters into a joint venture with or is sold to or merged with another business entity, your information may be disclosed to our new business partners or owners.

Edited March 15, 2018 by fiza

[ShellfishClive]

Shouldn't be, they are a legit website.

 

Would they be able to do this without asking you?

 

You're not actually storing the information that they are inputting into the website, they are doing that themselves so it's out of your control. There are hundreds of other websites they could input their information into without anybodies knowledge. The GDPR police can't expect us to know it all, yet I think they want us to!

Edited March 15, 2018 by ShellfishClive

[fiza]

Year 11 and up are able to send and receive external emails, so no they would not have to ask us but some did.

 

As the above excerpt from their Privacy Policy states data is sent outside of the EEA.

 

As the students are using email addresses issued to them by the School do we have any responsibility in this?

[GrumbleDook]

Based on the above, the school have no responsibility in this other than confirming the mail domain used, which is freely available information and could even be considered an FoI request if it comes in.

 

The relationship is between the students (data subjects) and Unidays (data controller).

 

However, it would be worth making sure that students are aware of the Privacy Notice and what it means.

[ShellfishClive]

The responsibility is in the person in question not the controller. If you have no physical way to stop them from signing up and your school policy is to allow students to have email addresses then it's not your responsibility.

 

We let all students have email addresses at the main school I support, it's not my policy but the school have asked for it. After that, as long as they are password protected and only the student in question has access to that account then it's not breaking GDPR.

[bald_pig]

Why would you? Would you do it if a student used their email address to register for Amazon or a forum?

[fiza]

Why would you? Would you do it if a student used their email address to register for Amazon or a forum?

 

The reason for the question was that Unidays insist that students register with their School email addresses. Amazon and forums don't have that requirement. I wanted clarification as to our responsibility, if any.

[bald_pig]

The reason for the question was that Unidays insist that students register with their School email addresses. Amazon and forums don't have that requirement. I wanted clarification as to our responsibility, if any.

 

You have the same responsibility as you do when a student signs up to any other website with their email address.

[enjay]

You have the same responsibility as you do when a student signs up to any other website with their email address.

 

I'm not sure that's entirely true. If the school is promoting Unidays and encouraging students to sign up, I think there is some responsibility to check the site is handling the data appropriately, or at the very least to encourage the students to read the privacy policy, flagging any specific concerns you may have about it.

[fiza]

I'm not sure that's entirely true. If the school is promoting Unidays and encouraging students to sign up, I think there is some responsibility to check the site is handling the data appropriately, or at the very least to encourage the students to read the privacy policy, flagging any specific concerns you may have about it.

We are not promoting Unidays in any way. The students came to us asking if it was ok to join using their School email addresses.