Visitor Books

[Gongalong]

Hi folks,

 

I've been passed the following quote. Not sure of the source currently, but perhaps from someone who provides a sign-in system!

 

"If you are using Visitor, Staff, Contractor signing in sheets/book or tear out passes and you can see the data, it needs replacing with a system where an un-authorised person cannot see any of this data, whether they are a staff member, public, parent or governor. If they can see the entries, this is classed as a data breach."

 

Thoughts?

 

To me it seems excessive to class seeing someone else's name as a breach, even if coupled with company and car numberplate.

 

Thanks

[elsiegee40]

Yup, it’s true. It’s nobody else’s business who is on site, who they are there to see and what their car registration is.

 

What’s not true is that only electronic sign in is acceptable. There are plenty of confidential paper based alternatives around.

[pete]

I bet you a hobnob that quote comes from someone who also happens to sell such a system.

 

Check out this thread: http://www.edugeek.net/forums/data-protection-information-handling/187764-gdpr-primary-schools.html

[Gongalong]

My thoughts exactly!

[DJ-1701]

I was asked to look into signin systems because of this (ref: http://www.edugeek.net/forums/hardware/194197-visitor-entry-system-link-sims-registers.html).

 

There are paper based systems you can use like this one - Visitor Management System I took a few pictures of it when someone came to visit us, as you can see the carbon sheet is meant to cover up the details... though someone could grab and flip the carbon page over, so I would recommend reception keeping it out of reach and providing it only for people signing in at the time, then removing it.

 

[Gongalong]

We used to have that type of hardcopy system, but have apparently switched to a system which shows 10-15 lines of previous visitors.

 

And yes, it transpires the source for the quote was a company selling visitor sign-in systems.

[Gongalong]

I rang the ICO helpline, and the person I spoke to (Sarah) said there was no need to have to cover previous names, or use a special system. Bemusingly, she says the ICO have a visitors book that shows previous names!

[Edutech98]

I think this will come down to risk management and what the GDRP describes as what would be the severity for the rights and freedoms of the person if the data was breached.

 

As an example, if you worked for your local social services you probably wouldn't want to display names, car registrations etc on your signing in sheet given that you may have foster parents attending at the same time as the parents, sensitive court cases involving parents/children, restrained parents etc. The severity could be quite high if this data was breached.

 

If you worked for a private company and it was literally just someone's random name and car reg of a sales person then the severity of a data breach would be very low, so the risk mitigation can be low. It may even be an accepted risk.

 

I think schools fit somewhere in the middle of this spectrum.

[Mayki5]

Being able to see "The Data" is being deliberatly vague. There are plenty of paper entry systems where the info on display doesn't show the actual PII and only show the number of the issued badge for instance. As far as I am aware, they tend to be ok.

 

EDIT: Forgot to add, the above would typically only be true as long as the ID badges are destroyed at the end of the visit. If the visitor's off site, there's no need to keep the badge with their details. In that way, it them becomes impossible to tie a specific ID badge to a individual, unless they are actually still visiting.

Edited April 25, 2018 by Mayki5

[GrumbleDook]

I rang the ICO helpline, and the person I spoke to (Sarah) said there was no need to have to cover previous names, or use a special system. Bemusingly, she says the ICO have a visitors book that shows previous names!

 

It is risk management.

The ICO doesn’t have a book saying parents of X (easily known because of surname) are in to see a certain member of staff (known to be SENCO).

 

They don’t have a book showing the the PCSO and a parent are both visiting the Head at the same time.

 

Whilst some firms may use it as a sales tactic, there are concerns on existing sign-in books for valid reasons.

 

In some places I will not use a sign-in book if it is completely open.

[Gongalong]

I agree it's a case of risk management, but equally it's possible to overanalyse these things and blow the risk out of all proportion.

[Edu-IT]

I was asked to look into signin systems because of this (ref: http://www.edugeek.net/forums/hardware/194197-visitor-entry-system-link-sims-registers.html).

 

There are paper based systems you can use like this one - Visitor Management System I took a few pictures of it when someone came to visit us, as you can see the carbon sheet is meant to cover up the details... though someone could grab and flip the carbon page over, so I would recommend reception keeping it out of reach and providing it only for people signing in at the time, then removing it.

 

[ATTACH=CONFIG]48655[/ATTACH]

[ATTACH=CONFIG]48656[/ATTACH]

[ATTACH=CONFIG]48658[/ATTACH]

That book could become more expensive than some electronic sign in systems.

[jmak]

We've just bought something similar from ESPO. £7.98 for a book of 100, so it will add up. It won't be anything like the cost of Inventry, but might put my suggestion of a device at reception running a Google Form back on the table...

[NotSoFast]

I just made ours with App Inventor and Fusion Tables. It's not as swish (no badge printing, for example) as a commercial one but you can't beat the price.

[Katy]

I was going to knock something up in PHP, run it on an ipad within Kiosk Pro Lite on single app mode, in some sort of theft-proof stand. Instead the bursar said she's just going to find a paper book that's compliant (we currently have the paper book where you can see everyone who has come in and out etc).

[NotSoFast]

I used Inventry when I visited a school the other day. I was surprised at how similar it was to mine!

[Jamman960]

I've been looking at Signinapp - its not as fully functional as inventory etc but it covers most bases on the visitor and staff side of things, its app based so saves the extra costs involved in inventory's hardware(I also like the fact that the data is in the cloud rather than on a unit in reception) it hasn't got anything to deal with pupils by default but I've played around with creating an additional visitor type similar to staff for pupils but it never quite fit in properly, I had to use guided access to prevent access to the student portion from reception iPads etc

 

James

[Edu-IT]

I just made ours with App Inventor and Fusion Tables. It's not as swish (no badge printing, for example) as a commercial one but you can't beat the price.

Any pictures? Is it something that could be shared?

[NotSoFast]

It would be a bit of a pain to share. The setting up of fusion tables, service user account, hard coding these into the AI file... The office staff view who is in school via a Google sheet, which pulls data (using Apps Script)from the fusion table and formats it nicely. Easy to print, but also viewable on any device if they don't have time. I've had to fix things a couple of times (for example an Android update changed the format the current time was reported in!). I accept that for my own school, but couldn't undertake to support others. Touch wood it's just been sitting there for several months now with no issues, but you never know! If there is anyone who is fairly competent with App Inventor and Apps Script I'd be happy to share, but you'd be on your own!