Sending Exam Audio to board.

[rob_coles]

Each student’s recording must be saved as an mp3 file.

• All recordings must be transferred either to a memory stick or to a CD.

• The filename must contain the component code, centre number and

candidate number, eg. 8698SF_55217_0041.mp3.

• In addition, the centre number and component code should be written on a

CD with an indelible pen. Do not use a sticky label. Similarly a memory

stick must have a tag attached.

• As soon as all the tests are completed for the centre, the memory

sticks/CDs must be sent to the AQA examiner together with the Attendance

List. This must be done within one working day of the last date of the fiveweek

period at the latest.

• You are advised to keep a copy of the recording in case of loss in the post

or damage to memory stick/CD in transit. Ensure the memory stick/CD is

packaged carefully, using bubble wrap or padding.

 

How would you tackle this? I've emailed to see if they have secure upload area or if they will be able to handle it encrypted. Thoughts?

[ShellfishClive]

Get them to send the CD or USB and the postage back, that's what we do with our exams. It's then there responibility.

[3s-gtech]

....no, that won't make it their responsibility. It's your data, so it's your responsibility. Query the exam board by all means, but very few of them have sensed this approaching juggernaut and responded appropriately. Really, you can prescribe that you will be sending the data encrypted, and it's up to them to ensure that they follow the decryption procedure - however, many boards will throw a strop if you do this.

[ShellfishClive]

We've had a contract stating that it would be there responibility if they handled the postage? I'm guessing it's just for that particular exam board, my mistake.

[FN-GM]

Is there any personal data on these disks? Looking from what they have said there isn't as they are using candidates number. Audio on its own isn't personal data.

[3s-gtech]

If they say their names when doing the recording, that would count (I'm pretty sure anyway). If they just say their candidate number, then no.

[rob_coles]

Is there any personal data on these disks? Looking from what they have said there isn't as they are using candidates number. Audio on its own isn't personal data.

 

I must admit I just assumed the candidate would introduce themselves which I assume would make it personal.

 

Thanks for the replies so far. I'm waiting on a reply.

[DannyG555]

Just a thought... but doesn't a recording of someones voice make them personally identifiable in the same way an image would? In which case you could argue that its personal data...

[rob_coles]

Got the following reply.

 

Hello Rob

 

“”Thank you for your reply.

 

We cannot accept encrypted USB drives. The examiners are trained under the latest GDPR guidelines ensuring the confidentiality of the materials they receive.

 

If you have any further questions, please let me know.””

 

So we are supposed to send these how?

[3s-gtech]

How on Earth does that answer the query though? It's not the authorised receiving party that's an issue, it's any unauthorised receiver. If you're posting them, or if it doesn't get to the right person at the other end, that's where the issues come in.

[MkII]

"We cannot accept encrypted USB drives. The examiners are trained under the latest GDPR guidelines ensuring the confidentiality of the materials they receive."

 

Obviously they (the exam board) are not trained. Hilarious.

[FN-GM]

How on Earth does that answer the query though? It's not the authorised receiving party that's an issue, it's any unauthorised receiver. If you're posting them, or if it doesn't get to the right person at the other end, that's where the issues come in.

 

To be fair though we haven't come to a consensus if it is personal data or not on the disk. If it isn't GDPR etc wouldn't apply.

[MkII]

To be fair though we haven't come to a consensus if it is personal data or not on the disk. If it isn't GDPR etc wouldn't apply.

Yes we don't know how the candidates are identified in the attached attendance list. If it's by number again, it would all be our responsibility to ensure no other identifier is included?

[3s-gtech]

To be fair though we haven't come to a consensus if it is personal data or not on the disk. If it isn't GDPR etc wouldn't apply.

 

Indeed, this is on a general assumption that they will be receiving personal information in some if not all of the submissions, across multiple subjects. Their response doesn't inspire confidence!

[rob_coles]

Students give name at the start of the audio file along with candidate number.

[MkII]

Students give name at the start of the audio file along with candidate number.

Is that specified by the exam board?

 

If so, you have to refuse to send the data and ask for them to suggest a compliant method.

 

Mexican standoff!

[3s-gtech]

This thread will now be a very interesting case then - keep us updated OP.

[FishCustard]

I don't understand why they'd have a problem with encrypted USB drives (obviously a secure upload area would make more sense, but that would require... *gasp* ingenuity!). Send drives, send password/key separately, put them together the other end.

[rob_coles]

Just spoken to the teacher. Who says "We have to identify them by full name & candidate number in the recording" which would make it personal data?

 

I've emailed the exam board in question to clarify this is the case.

 

Will keep you posted.

[MrWrighty]

This just goes to show there are huge gaps in GDPR. Those that have to deal with personal data and those 3rd parties on the receiving end of the personal data. I would lay the problem squarely at their door and expect them to respond accordingly. If they cannot handle encrypted data then I would say the board have failed to meet their responsibilities under GDPR. As the data belongs to your school and you are responsible for the transmission by what-ever-means, then sending unencrypted data is not an option under GDPR. I would suggest that schools adopt best practice under GDPR and send encrypted data. The boards will soon realise they are missing the point and have to do something about it.

Their response is laughable. They have taken the easy way out, or so they think.

[free780]

Is it to do with the fact the exam centre is the data controller until they get the data. So any cost in a upload portal is trying to be delayed for as long as possible. Worse still exam centres may have to set up SharePoint sites etc to share emcrypted files.

[rob_coles]

Dozen emails later I have the following.

 

Since your latest email, I've been in discussion with our Logistics team about this matter. They have confirmed that for this year, as in previous years, we expect recordings to be unencrypted and to include the candidate name and number. The accompanying insert card (CDs) or USB label/tag would also include the candidate name and number (as per our example in the Instructions '0041 John Smith'). The attendance list should likewise be sent with the recording.

 

However, our Logistics team has agreed that you may send an encrypted recording provided that BitLocker encryption is used. Should you do this, please await further guidance on how to send the password.

 

Common sense has prevailed.

 

Thanks for all your replies and comments. Appreciated.

 

Regards

 

Rob

[MrWrighty]

It is interesting that they have not acknowledged that GDPR will override their statement "As in previous years". Previous years where different although one could argue that even under DPA, exams information should have been sent in an protected format. I would have thought that GDPR will override any other excuses for receiving data in an unencrypted format and that encryption is a must in this situation. I really do not think they get it. How do you encrypt a CD label or USB tag with the candidates name and number on it which they are asking to be attached to an encrypted device.

[3s-gtech]

To be fair, I think this would actually be covered by the DPA rather than GDPR, so it has only been an issue for twenty years. This is where GDPR is kicking a lot of complacent policies and practices into touch - the press and coverage is having a positive effect in this regard.

[minimoo]

"As the data belongs to your school and you are responsible for the transmission by what-ever-means"

 

OK, i'd been resisting joining in on this thread - does it ? (belong to the school)

 

A student chooses to do a Russian GCSE with AQA (that's there choice when picking options). As part of that they have to do an oral examination to achieve their grade. Some examinations are done by internal staff, but equally at some levels (e.g. A2) the exam board will send an external examiner in. Does the data "belong to the school" if it's between a student and the exam board and the school are just 'posting' it on the behalf of the exam board / student via the method that the exam board and student have approved?

 

On that note, if we continue:

 

In the scenario that the examination board send an external examiner in to perform an oral with a student, and the "school" is recording that - should the school be asking the examination board to provide consent that they are happy for their examiner to be recorded (and the examiner also provide consent that he is happy to be record for that purpose)

 

For minority subjects e.g. Japanese etc, which very few students do, I know we have in the past acted as a centre for the oral component for the local schools (so the examination board can send one examiner and do all the local students) - should schools now 'decline' to offer that service as it's a risk to "process" the data of non-students