G Suite file sharing outside of the domain

[Sheridan]

Just out of curiosity how many of you G Suite users allow staff to share files outside of the school domain?

 

We allow it with warnings, as they want to share files with the LEA etc - who don't use G Suite (so sharing with whitelisted domains doesn't work for them)

 

With GPDR, its another way for your data to 'leak' out, but its catch 22 trying to please all people.

Edited May 10, 2018 by Sheridan

[Ditto]

We locked it down to not allow sharing outside the domain a term or two ago. We can whitelist exceptions if the need arises. I thought you could share documents to those without google accounts, but the documents effectively become public. Where that's not wanted, we'd export to something like csv, docx, pdf etc. and forward that way.

[Sheridan]

From what I understand, the whitelist only works with G Suite domains, which is a pain

[Ditto]

Yes, I think that's the case. Currently my only white-listed item is a google domain.

[Arthur]

With GPDR, it's another way for your data to 'leak' out, but its catch 22 trying to please all people.

With something like GAT+ or BetterCloud you could see exactly who was sharing Google Drive files/folders publicly.

[bossman]

@Sheridan

 

Its locked down here but that doesn't stop them from attaching files to e-mails but this has been deemed acceptable by our DPO as long as its not pupil or staff personal details or data which can determine the users identity....

 

All staff have been asked to take an exam to certify them against GDPR and this should educate them enough for them to be able to recognise what they can and cannot do with data which contains specific details about a pupil or member of staff....

 

They will become personally responsible for the data that they either process or have access to and this will be part of their AUP which they have all signed....

 

We have told them that we can trace who has sent what and where so that they should be aware the onus is on them personally....which they accept...

[Ditto]

@bossman - the GDPR exam/certification is a really good approach, something I've seen in the commercial world to ensure policies are read and understood. Can you share any more details on what you used.

[bossman]

@GrahamB

 

We used this site: https://training.ssscpd.co.uk/

 

Regards

Bossman

[Sheridan]

Yeah I think out SLT are keen for Staff to undergo a GPDR training exercise, then sign off on it. Anything after that is on their head!

[bobsmith]

I like the idea of doing the training and exams, but can the organisation legally absolve itself of responsibility in this way?

[Ditto]

No, but if a staff error led to a data leak, you'd be in a much better place with the ICO in an investigation.

[_Rob_A_]

We opened up Drive sharing outside our domain a few years ago, the pressing need at the time was to share documents needed for workshops & training for a number of staff. Up until then nobody could share documents outside domain and this was before GDPR.

One argument which was convincing was something along the lines of "someone could easily share a document by attaching it to an email so sensitive information would be lost anyway". The key point I think, is to make staff aware of the implications and their responsibility.

 

Re GAT we are begging to look into it as it seems much easier to audit what is shared with whom and also has useful tools like Google Classroom audit.

[keyboards]

We allow sharing outside a domain as we just got constant opposition, main thing is staff are mature and sensible when sharing files, at the end of the day we can only go so far, if they want to send it via another method they probably will