What to do in the case of parental refusal to process data

[Ditto]

Just had an interesting scenario. Office sends out a Google Form to collect minimal parent/pupil details to allow ordering of tickets to a school production. Parent does not trust in anyway trust Google so does not want to submit his/her details and wants to order on site with pen and paper. Leaving aside all the discussions about pen/paper vs. Google cloud data storage, security and risks, where do we stand now and post May 25th. In particular, if we collect the data via paper then type it in to the google form, apart from being potentially inflammatory, what are the schools rights to do so versus the parents right to say we can't store their on a particular platform. This also stimulates though around when we take steps to seek more permission from parents/pupils data, what do we do with the refusers. I'm aware other educational legal requirements will override certain aspects of what parents/pupils can refuse, but for this scenario, there isn't going to be one. It also makes me think more about 'notification' of data processing over trying to get explicit permission.

[mjk]

If the parent refuses to let you store the data, don't sell them a ticket.

Put it in the T+C's of your paper and google forms.

[Ditto]

Yeah, we are considering that as an option, but the concern is it is likely to lead to a further round of communication, so we are also considering just letting the parent in to submit a paper order - a compromise I guess. I think it's a 1 in 1000 scenario so we're not worried about it becoming a precedent. However, all options at present are on the table and no decision made yet.

[mjk]

Problem is that you'll likely have to collate the paper information into a different system, like a google sheet !

Where does it end though? You might get another parent who has an aversion to mysql databases, or msofficephobia !

[synaesthesia]

Does the school use anything else Google, such as GAFE? If they have issues with Google and you use that, you are likely to be unable to teach their child which gives you a point of comeback and more to the point it means that any further processing is likely to be done with a Google based product. As long as your clear to the parent "Yes, by all means send us a paper copy or pop in to sign a physical copy but please bear in mind that all data is collated via Google products".

If not, don't worry about it; accept a hard copy and process it however it's needed.

[Ditto]

Yes, we are fully subscribed to GSuite for Education with Chromebooks and we use Progresso which is entirely hosted on Amazon Web Servers. We're significant users of Google Classroom, so yes, not using Google would block educating the child. The office staff you Google Forms massively. We use it for all data collection for admissions. Actually on reflection, we do extremely well with so little paper. Our school reports and all electronic (except primary but I'm working on them). I think the school promotional material emphasises the school's modern approach so I think we'd have no problem referring to that. Currently my recommendation is likely to be as you suggest, we are happy to take the paper but it will be processed using Google technology stack. In this scenario, all we are collecting is the pupils name, the parents name, how many tickets are wanted and a parent contact number in case of the need to follow up. I guess we could remove the request for the phone number, we could look that up.

 

What fascinates me with this, is as GDPR becomes ever present in the media as we near GDPR-Day, how many parents are going be triggered in to bizarre FOI requests, SARs, non-consent to process, right to be forgotten and retention period queries. I'm sure after a few months it will all blow over, but I'm expecting some uplift.

[enjay]

Don't sell them a ticket. Simple.

 

If you agree to take the order on paper, then 200 other parents could also ask to do that because its easier than going online, and quickly chaos ensues.

[elsiegee40]

Don't sell them a ticket. Simple.

 

If you agree to take the order on paper, then 200 other parents could also ask to do that because its easier than going online, and quickly chaos ensues.

So don't schools have to make allowances for families that don't have access to the internet or plastic payment cards? Some of our poorest families operate a cash only existence.

[synaesthesia]

So don't schools have to make allowances for families that don't have access to the internet or plastic payment cards? Some of our poorest families operate a cash only existence.

 

This and this again; you can single anyone out for not wishing or being able to do something electronically. So in the original case, I'd say it's a clear case. "Not a problem, please fill out the papework but please bear in mind that it will be processed using Google applications as per the norm for this and many other schools". You're helping them out and you are remaining transparent to them; it's most likely they have a personal issue with Google and don't care if you use it behind the scenes or to educate their child in school.

[enjay]

So don't schools have to make allowances for families that don't have access to the internet or plastic payment cards? Some of our poorest families operate a cash only existence.

 

In this instance, they're simply reserving the ticket not paying for it. Tell them to reserve online and pay in person.

 

As for online payment for cash-only families, you can point them towards PayPoint or suggest they buy those pre-paid Visa cards so they can shop online.

[enjay]

So in the original case, I'd say it's a clear case. "Not a problem, please fill out the papework but please bear in mind that it will be processed using Google applications as per the norm for this and many other schools".

 

If they are happy for you to enter their details from the paper form into Google, I imagine they'd be happy entering them themselves. What you have here sounds like someone who doesn't want their details in Google at all.

 

I suppose you could fill in the form for them but don't put their name, just say "AN Other, speak to Fred for details"

Edited April 23, 2018 by enjay

[synaesthesia]

They may not want to use anything Google from their personal devices (which are probably Android).

[jmak]

This seems like an area where I am still unclear on what happens when you hold a subject's data because you have a legal basis for processing it, but you also want to use it for "non-mandatory" services. If you're heavily invested in GSuite, it seems likely that you're using Google's services to process his data which you can do without his permission if it's to allow you to fulfil your public duty (to provide an education and the administration/MIS required to support that activity). However, despite the fact you are already using Google to process his data for that, tickets for a school production probably doesn't count as part of the requirement to provide an education. Does anyone think you have a valid claim that school events count as part of our public duty?

 

I've read this: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/#ib3 but I'm still not sure...

 

You should be notifying parents that you're using (insert name of supplier) service to process their data and you could then point to that and say you're not giving any extra information (other than their attendance at an event) - although that might prove even more inflammatory....

 

Edit: This is the statement that makes me think we can't use legal basis

It is not enough to argue that processing is necessary because you have chosen to operate your business in a particular way. The question is whether the processing is a necessary for the stated purpose, not whether it is a necessary part of your chosen method of pursuing that purpose.[/Quote]

Edited April 23, 2018 by jmak

[enjay]

My understanding is you can have different grounds for processing the same piece of data, so you can store their email address in SIMS under public duty but in the Google Form for tickets under consent. If they withdraw consent, you must delete them from the Google Form but you can leave them in SIMS.

 

Where it gets really swirly is you can have their email address in Schoolcomms/ParentMail/etc. and send them core emails under public duty, but you need consent to email them about the summer BBQ or Christmas concert.

[MkII]

Just had an interesting scenario. Office sends out a Google Form to collect minimal parent/pupil details to allow ordering of tickets to a school production. Parent does not trust in anyway trust Google so does not want to submit his/her details and wants to order on site with pen and paper. Leaving aside all the discussions about pen/paper vs. Google cloud data storage, security and risks, where do we stand now and post May 25th. In particular, if we collect the data via paper then type it in to the google form, apart from being potentially inflammatory, what are the schools rights to do so versus the parents right to say we can't store their on a particular platform. This also stimulates though around when we take steps to seek more permission from parents/pupils data, what do we do with the refusers. I'm aware other educational legal requirements will override certain aspects of what parents/pupils can refuse, but for this scenario, there isn't going to be one. It also makes me think more about 'notification' of data processing over trying to get explicit permission.

 

I don't understand// What is the purpose of you collecting that data? Isn't all of that data already elsewhere, and therefore all you need to take is the payment?

[DrCheese]

What you have here sounds like someone who doesn't want their details in Google at all.

Isn't that just tough tho? If you has a school have done your due diligence, checked that a company is GDPR compliant, given your legal reason for processing that data & then have integrated it into your school procedures then they can just go pound sand. Else it would quickly become unwieldy if you had parents being able to state which suppliers they didn't want data to be stored on. One parent might not like Apple, another Google, another Microsoft. If they don't like it they are fully capable of sending their children to another school.

 

Sure, have a paper version for those without internet access, but you are still within your rights to then put it on your system.

[enjay]

I don't understand// What is the purpose of you collecting that data? Isn't all of that data already elsewhere, and therefore all you need to take is the payment?

 

No, they need to know who would like a ticket. So, yes, the data is already in SIMS but you need the parent to enter enough information to identify who they are so the school knows who to give tickets to.

 

I'm guessing the OP's school doesn't have an online payment system, otherwise they'd sell the tickets through that.

[enjay]

Isn't that just tough tho? If you has a school have done your due diligence, checked that a company is GDPR compliant, given your legal reason for processing that data & then have integrated it into your school procedures then they can just go pound sand.

 

Well, yes and no. The parent can't refuse you from storing their child's details in Google Apps for use within lessons (because that is being done under public duty, not consent) but they can refuse having their own details stored in your Google Form for ticket sales, because you don't have any legal basis other than consent for that - selling concert tickets doesn't come under the basis of public duty.

 

Where it would get fun is if the OP had the parent's details in Google Classroom so they can send guardian emails. Then, the details would stay in Google Classroom but not be included in this particular Google Form!

[MkII]

No, they need to know who would like a ticket. So, yes, the data is already in SIMS but you need the parent to enter enough information to identify who they are so the school knows who to give tickets to.

 

I'm guessing the OP's school doesn't have an online payment system, otherwise they'd sell the tickets through that.

 

It's the school getting in the way of the purchase system. Nothing is binding I guess until a deposit is paid.

[jmak]

No, they need to know who would like a ticket. So, yes, the data is already in SIMS but you need the parent to enter enough information to identify who they are so the school knows who to give tickets to.

 

I'm guessing the OP's school doesn't have an online payment system, otherwise they'd sell the tickets through that.

 

Even that wouldn't guarantee that the details don't end up with Google. We pay for various services and I'm sure they use MS, Google or AWS to provide the service. AFAIK as long as our contract says they process data in a GDPR compliant way, we don't need to (can't?) specify how they do it.

[enjay]

Even that wouldn't guarantee that the details don't end up with Google. We pay for various services and I'm sure they use MS, Google or AWS to provide the service. AFAIK as long as our contract says they process data in a GDPR compliant way, we don't need to (can't?) specify how they do it.

 

That's my take on it too. If Supplier A uses Google and you the school don't like Google, you are free to switch to Supplier B, but you can't tell Supplier A not to use Google.

[Edutech98]

Worth remembering as well that if the school is relying on consent to process the personal data relating to the ticket, then they need to be able to offer the person choice on how their data is processed. If you are saying you either buy the ticket and we process the data in Google Apps, or you can't have a ticket, then you can't rely on consent and you would need another lawful basis for processing the data.

[enjay]

Worth remembering as well that if the school is relying on consent to process the personal data relating to the ticket, then they need to be able to offer the person choice on how their data is processed. If you are saying you either buy the ticket and we process the data in Google Apps, or you can't have a ticket, then you can't rely on consent and you would need another lawful basis for processing the data.

 

Are you sure? That would suggest I can tell Amazon how I would like them to store my details, i.e. that I could tell them they can keep my email address and shopping history, but not store it in AWS.

[synaesthesia]

For your own sake and sanity, don't overcomplicate it.

[Ditto]

The key info we are collecting is how many tickets they want and what day for as the event runs a couple of times. We have much of the other data, but we need to collect a least some PII to know who the tickets are being ordered by. There's a limited number of tickets.