Amended terms for GDPR

[enjay]

One of our suppliers / data processors has sent us an appendix which they intend to add to their Terms of Service on 25th May, and there are some new clauses I'd appreciate your thoughts on:

 

"Subject to paragraph 1.9, at the option and cost of the Customer, delete or return to the Customer after the end of the provision of services relating to processing all the Customer's personal data and delete existing copies unless English, EU or EU Member State law requires storage"

Paragraph 1.9 basically says they think the content may continue to be useful to staff members later on in their career (it is a CPD-tracking tool) so they will keep it indefinitely - even after the teacher has left this school and indeed even after we stop paying them. So this clause appears to say 'we will keep your personal data for ever unless you ask us to delete it, at which point we will charge you for the deletion'. Since GDPR talks about not keeping data longer than relevant, this seems a bit odd and charging us for the deletion seems even more odd.

 

Then two linked clauses, which are:

"taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of the varying likelihood and severity of rights and freedoms and natural persons, in relation to the Customer's personal data, implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk including considering those measures referred to in Article 32 of the GDPR"

and

"at the Customer's cost make available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR"

So... the first of those clauses sort of says they will be compliant with the GDPR, but has so many caveats it is possibly meaningless. The second clause says if we want them to prove compliance, they will charge us.

 

Finally, this one:

"The Customer shall (at its own cost) provide assistance requested by %supplier% in relation to the fulfilment of %supplier%'s obligation to cooperate with the relevant supervisory authority under Article 31 of the GDPR"

Anyone else think it odd we might be expected to pay if they are required to submit information to ICO or other authority?

 

Aside any grammatical concerns with these clauses, which strike a bit of being deliberately wordy to either make them sound important or to confuse, does anyone else share our concerns about accepting these amendments or are we over-reacting?

[Seb1780]

Bluesky?

 

I saw this yesterday and thought they were being a bit OTT but they are in a strange position where they act for both the school and the user. I was satisfied that they are trying to be compliant and given that we're not going to stop using it I suggested that this was OK.

 

Regarding charging for SAR or deletion requests, I'd tell the user making those requests to approach Bluesky directly rather than doing it through the school, after all it is the user who adds the data in the first place.

[Edutech98]

These are my thoughts...

 

I don't think Paragraph 1.9 is right, they shouldn't be able to charge you for deleting data if they no longer have a lawful bases for processing it. If they didn't delete it, it would be a breach of data protection laws.

 

Of the linked clauses, this one;

 

"taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of the varying likelihood and severity of rights and freedoms and natural persons, in relation to the Customer's personal data, implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk including considering those measures referred to in Article 32 of the GDPR"

Is just a direct copy and paste from Article 32 of the GDPR.

 

Article 28 says the controller shall use only processor providing sufficient guarantees to them that the data will be processed securely. It doesn't say anything about the processor can or cannot charge you to prove this.

 

I think this will be decided in your data processor contract. If in your data processor contract it states they can charge you for proving they will look after your data, then you would need to pay the agreed amount. Of course the school can say they refuse to pay, then the processor can decide if they want to give it away for free or loose the customer to a data controller that is willing to prove their compliance for free.

[enjay]

Bluesky?

 

Yes!

 

Regarding charging for SAR or deletion requests, I'd tell the user making those requests to approach Bluesky directly rather than doing it through the school, after all it is the user who adds the data in the first place.

 

The clause isn't about charging for RTBF deletion requests though, it is about deleting the data when our contract ends.

[Seb1780]

The clause isn't about charging for RTBF deletion requests though, it is about deleting the data when our contract ends.

 

Yes, I see that now. But what needs to be deleted at the end of the contract? Isn't the idea that all the personal data would stay in place because the teachers want access to it when they move to another school still using Bluesky? Isn't that one of their selling points? And if a teacher didn't want it kept then they, the teacher, can make a RTBF request.

[enjay]

Yes, I see that now. But what needs to be deleted at the end of the contract? Isn't the idea that all the personal data would stay in place because the teachers want access to it when they move to another school still using Bluesky? Isn't that one of their selling points? And if a teacher didn't want it kept then they, the teacher, can make a RTBF request.

 

I would have thought once my school stops paying for Bluesky, Bluesky should delete any data they were given while we were paying them. I don't think Bluesky should keep all School A's data indefinitely just in case School B might want one record from it and School C might want a different record.

 

If a teacher leaves us and wants to keep their Bluesky data at a new school, then they or their new school should pay for it.

[GrumbleDook]

Three things to consider.

1 - if the teacher wants to continue to have the record, that is between Bluesky and that teacher. This would need consent from the teacher or a contract to be in place. Legitimate Interests would still require the teachers need to be informed and that is the responsible of Bluesky, not the school dropping the contract.

2 - if the school instructs the deletion at the end of the contract then it happens, unless the above criteria are sorted

3 - erasure has no chargeable element. Data minimisation means it should go!

[enjay]

Three things to consider.

1 - if the teacher wants to continue to have the record, that is between Bluesky and that teacher. This would need consent from the teacher or a contract to be in place. Legitimate Interests would still require the teachers need to be informed and that is the responsible of Bluesky, not the school dropping the contract.

2 - if the school instructs the deletion at the end of the contract then it happens, unless the above criteria are sorted

3 - erasure has no chargeable element. Data minimisation means it should go!

 

That was my thinking too. So, Bluesky should delete all data at the end of our contract, unless one of our staff chooses to engage in a direct contract with them. In which case, we should refuse to sign the amended terms - where does that leave us though? I need to see the original contract to know what those terms were, but I didn't sign up for it (another product where IT are the last to know about the purchase!)