SMART accounts and access to O365 profiles

[StevieM]

We've just bought a subscription to Smart Learning Suite at the request of our DH. Many of the features require that the users sign in to a Smart account with either a Google or Microsoft account, recommending the use of an organisational email address, so I have added all staff email addresses to the Smart portal.

 

However, when I came to test it out, I was prompted to accept giving the app certain permissions.

 

While I can accept allowing the app to access my information, I'm more concerned about giving it permission to 'read a basic set of profile properties of other users in your organization on your behalf. Includes display name, first and last name, email address and photo' considering that most of the other users are children.

 

Perhaps I'm being paranoid, but what do others think about this?

[atcoates]

https://home.smarttech.com/legal/privacy-policy

[StevieM]

https://home.smarttech.com/legal/privacy-policy

 

There are two primary ways through which information of minors can be provided to SMART: the information could be provided directly by the individual or the information could be provided by the individual’s school. ... we require that...[schools obtain]... parent’s or guardian’s express consent prior to disclosing any personal information to us and using any Services. You should also thoroughly review this Policy with your parent or guardian to ensure it is understood and accepted. No personally identifiable information of individuals under 18 years old should be submitted to or through our Services without the consent of their parent or guardian.

 

So, we need to obtain consent from every parent (after ensuring they understand the terms of Smart's privacy policy) before staff can log-in to Smart Notebook using their school email address. Am I reading that correctly?

[enjay]

I'm more concerned about giving it permission to 'read a basic set of profile properties of other users in your organization on your behalf. Includes display name, first and last name, email address and photo' considering that most of the other users are children.

 

That's nothing you don't share with your Seating Planner app. Photo is a little odd though, in the spirit of only sharing what is relevant and necessary. I suspect this is a limitation in Google profiles, that you can't help but see profile data without it (which I guess makes it "necessary").

[StevieM]

We don't use a seating planner app. I don't understand why (or even if) a Smart Account would even need to read the profiles of other people.

 

I've emailed Smart Tech to ask them to clarify:

 

•Under what circumstances (if any) would the Smart Account app need to access the Office 365 profiles of users other than that of the account holder?

•Would the information obtained from these profiles be accessible to/collected by Smart, or would it be used by the app locally and then discarded?

 

I realise I'm probably being a little over sensitive about this (or, more likely, have completely misunderstood the context) but I'd rather check to make sure.

[sted]

We don't use a seating planner app. I don't understand why (or even if) a Smart Account would even need to read the profiles of other people.

 

I've emailed Smart Tech to ask them to clarify:

•Under what circumstances (if any) would the Smart Account app need to access the Office 365 profiles of users other than that of the account holder?

•Would the information obtained from these profiles be accessible to/collected by Smart, or would it be used by the app locally and then discarded?

 

I realise I'm probably being a little over sensitive about this (or, more likely, have completely misunderstood the context) but I'd rather check to make sure.

at a guess it needs other profiles for voting systems so you can search for kids/they can search for you?

[enjay]

We don't use a seating planner app. I don't understand why (or even if) a Smart Account would even need to read the profiles of other people.

 

So it knows who is using the software. Rather than you creating and managing separate logins for SMART Suite, they are deferring the authentication to something else, in this case Google Apps (much like all those "sign in with Facebook" links you see on things)

[StevieM]

So it knows who is using the software.

 

I understand that, but why does it need to know who isn't using the software? It's the permission to allow the app to access the profiles of all other users in the organisation that concerns me.

[enjay]

Ah, I see your point. In which case, what I think is happening is that you as the owner/admin are granting this permission for all your users, rather than asking each student to grant it individually.

[StevieM]

Exactly - and Smart Tech's Privacy Policy states (as quoted above) that No personally identifiable information of individuals under 18 years old should be submitted to or through our Services without the consent of their parent or guardian.

 

I know I have a tendency to (mis)interpret things literally; that is why I have asked for clarification from Smart Tech. I'm just interested to see what others think about it.