Hypothetical lost data

[forkies]

Trying to put together a list of risks for DPA2018 risk register.

 

If a school were to lose coursework, saved electronically, only copies would this be a reportable to ICO? What if it were audio recordings such as language orals or music compositions?

 

My thought process would be that it could cause harm (emotional) and by potential loss of exam grades which may result in loss of finance in future for the individual.

 

What are your thoughts on this, am I reading too much into this? What do you think the ICO stance would be if someone reported it (ie a student/parent)?

[Oaktech]

Define lost...

 

Failed backup followed by crypto infection unrecoverable data type lost? Or handed over to a courier in the required (unencrypted) format for an exam board and never delivered type lost?

 

I think you would be open to legal action in the first case but it would not be a reportable incident to the ICO, you haven't lost the data in a way that would land it in the hands of an unauthorised person. The second case your DPO will probably be burnt at the stake and a huge can of worms will be opened.

[mthomas08]

Trying to put together a list of risks for DPA2018 risk register.

 

If a school were to lose coursework, saved electronically, only copies would this be a reportable to ICO? What if it were audio recordings such as language orals or music compositions?

 

My thought process would be that it could cause harm (emotional) and by potential loss of exam grades which may result in loss of finance in future for the individual.

 

What are your thoughts on this, am I reading too much into this? What do you think the ICO stance would be if someone reported it (ie a student/parent)?

 

First you'd do an investigation to work out exactly what data was lost, how it got lost and people responsible. Then if it contained say... a full name, DOB and addresses.. that's quite serious.. and I'd class that as a serious breach - considering police interview recordings have been reported lost and fines involved.. (not all are video based).

 

If you lose simple work which doesn't contain personal data.... well.. that's nothing to do with GDPR because you can't ID anyone.. that wouldbe down to the school and (I believe) educational authority..

[forkies]

Define lost...

 

Failed backup followed by crypto infection unrecoverable data type lost? Or handed over to a courier in the required (unencrypted) format for an exam board and never delivered type lost?

 

I think you would be open to legal action in the first case but it would not be a reportable incident to the ICO, you haven't lost the data in a way that would land it in the hands of an unauthorised person. The second case your DPO will probably be burnt at the stake and a huge can of worms will be opened.

 

Sorry, should have used a different word! We have had similar in the past were a member of staff has the recordings on a digital recorder, in the process of moving them from the recorder to the laptop they “delete” the files.

GDPR states we should have reasonable backup systems in place to ensure constant access to data etc so for example this happened before a backup could take place or due to a technical issue preventing backups of that specific data taking place.

Still referring to just coursework which is final grade dependant and has to be submitted to an exam board, we would in theory have to make the students resit the recordings (according to my exams officer) which could be detrimental to the final grades.