Work Ready Schools

[CAM]

I've been asked to upload information to this website: Home

 

Is consent required? I've asked our DPO for advice anyway.

 

But more concerning, should I be alarmed that the site has no encryption on the login, contact or register pages?!

[3s-gtech]

Hahaha, yeah no don't upload anything to them. You can be reasonably sure that if there's no encryption on their login page (of all things) that the database will be a plaintext nightmare. Don't be an ICO statistic! Most diplomatic way to start will be by contacting them asking if they are going to provide a secure logon, and what measures they use to protect data.

[PotNoodleTech]

No https, no upload!!!

[Roberto]

You can visit the site using https and it works but this really is very shoddy of them; they should as an absolute bare minimum force a redirect for login and the fact that they don't do this calls their competence into question. I would have trouble trusting them with my data too at this point.

[CAM]

It's probably an oversight as they use HTTPS on their other site for graduates. I've sent some questions to the site admin to seek clarification on how secure it is.

[enjay]

Assuming you get a decent answer to the HTTPS question, you still have the consent question. The answer there is (I think!) if use of the site is a core part of your curriculum, i.e. students are required to have a login to proceed in class, it is public duty and you don't need consent. If you're suggesting, encouraging but not forcing them to have logins, you would need consent (in which case you might as well let them create their own logins anyway!)

[CAM]

We are seeking consent now.

 

Also regarding HTTPS, not happy with the response. Not even passwords are encrypted. Don't use this site until they sort it!