Parental consent required

[Bigbird7]

A couple of services used by primary schools - Education City and Code.org are apparently asking for explicit parental consent before student details can be shared. In our data map I'd covered the legal reason for processing under public duty. Anyone got any thoughts on this extra admin burden? Is it necessary at all or have I missed something?

[Meldrew]

I had something similar where a company was asking that I sign to say that I had asked explicit consent that (staff) details were passed onto them. I tried telling them that I didn't need to get consent, therefore couldn't sign. I'd recommend writing to them explaining that it was is not necessary and in fact not feasible and see what they come back with.

 

Meldrew

[mthomas08]

A couple of services used by primary schools - Education City and Code.org are apparently asking for explicit parental consent before student details can be shared. In our data map I'd covered the legal reason for processing under public duty. Anyone got any thoughts on this extra admin burden? Is it necessary at all or have I missed something?

 

We was told to put them in our policies because they are external/cloud based of data handling.

[Bigbird7]

An example of what one company is saying with regard to gaining parental consent to use their systems“If you are an Educator and you register an account for a student who is under the age of 13 (a “Child”), you represent and warrant that you or the educational organization you work for has proper permission to register the Child for Code.org, and that you have obtained the necessary parental consent for Code.org’s collection of the Child’s personal information for the use and benefit of the school and for no other commercial purpose. In addition, you agree to be bound by these Terms on behalf of the educational organization you work for.”

 

Others are very similar. Any thoughts on how to deal with this appreciated.

[peej2k]

You have to get parental consent for any service where you're passing any pupil information into it, or generating information on it.

So for services like Scratch, it is fairly easy. You don't sign up accounts and you get children to upload and download their work each time.

 

For Office 365, Google for Education, Education City, J2E, Purple Mash, Tapestry etc. then you'd need permission for each child unless you have a legal justification.

You should seek Internet Use permission too, but some parents will say I don't want them to use the internet but I want them to use GfE/O365/Education City.

 

And here's another one: You don't need to take a photo of a child to track that child's progress in Tapestry so you'd need permission - but if your school is using it as it's child progress tracking tool you don't need permission to track the child in it as that's a need to do legal requirement.

 

Its a bit of a nightmare to be honest.

[Narwhal]

You do not need explicit consent for most of the activities that take place in a school. Most will be covered under Article 6© compliance with a legal obligation or 6(e) necessary for the performance of a task in the public interest (educating the child). this would cover your MIS and most cloud-based educational sites such as GfE. The sites that you use must be GDPR compliant however. Some activities, it could be argued, are not specifically required for teaching or if you are passing control of the data to and external company, in these circumstances you would need specific consent. For the collection of biometric data you will always need consent. It will depend on the wording with any contract, if it says "you or the educational organization you work for has proper permission to register the Child" you would be ok but the line "and that you have obtained the necessary parental consent for Code.org’s collection of the Child’s personal information" could pose a problem. You shouldn't need the consent but you would be agreeing that you have obtained it.

[peej2k]

this would cover your MIS and most cloud-based educational sites such as GfE.

 

You might want to tell that to Google, who insist that you have permission specifically for GfE and for each and every third party application that you use through Google.

[Narwhal]

You might want to tell that to Google, who insist that you have permission specifically for GfE and for each and every third party application that you use through Google.

 

Where in their terms does it say that?

[peej2k]

2.4 End User Consent. Customer's Administrators may have the ability to access, monitor, use, or disclose data available to End Users within the End User Accounts. Customer will obtain and maintain all required consents from End Users to allow: (i) Customer's access, monitoring, use and disclosure of this data and Google providing Customer with the ability to do so and (ii) Google to provide the Services.

 

2.5 COPPA and Parental Consent. If Customer allows End Users under the age of 13 to use the Services, Customer consents as required under the Children’s Online Privacy Protection Act to the collection and use of personal information in the Services, described in the G Suite for Education Privacy Notice, from such End Users. Customer will obtain parental consent for the collection and use of personal information in the Additional Services that Customer allows End Users to access before allowing any End Users under the age of 18 to use those services.

 

Also an older one:

 

2.4 End-User Consent. Customer's Administrators may have the ability to access, monitor, use or disclose data available to End Users within the End-User Accounts. Customer will obtain and maintain all required consents from End Users to allow: (i) Customer's access, monitoring, use and disclosure of this data and Google providing Customer with the ability to do so and (ii) Google to provide the Services.

Edited June 8, 2018 by peej2k

[jmak]

 

For Office 365, Google for Education, Education City, J2E, Purple Mash, Tapestry etc. then you'd need permission for each child unless you have a legal justification.

You should seek Internet Use permission too, but some parents will say I don't want them to use the internet but I want them to use GfE/O365/Education City.

 

 

Teaching Computing (including e-safety and effective use of the internet for research and coding) is part of the national curriculum. That'd be pretty difficult without internet access. We use Purple Mash (amongst others) to teach this. Accounts are managed through AD and Azure AD Connect, so every child has a Microsoft account. Therefore I'd strongly argue that we don't need consent for this.

 

There are some grey areas, but IMHO we should try hard to ensure we don't need consent in as many areas as possible.

[jmak]

2.4 End User Consent. Customer's Administrators may have the ability to access, monitor, use, or disclose data available to End Users within the End User Accounts. Customer will obtain and maintain all required consents from End Users to allow: .

 

I'd argue that we don't require consent. On that basis we wouldn't be in breach of Google's terms by not seeking consent.

[Narwhal]

That looks like the American version. COPPA is an American law.

[peej2k]

It may be, but the consent parts of COPPA have been adopted into GDPR. It's exactly why GDPR is set to 13 for age of responsibility.

I do some work with a Google Partner, the terms do say you need permission. You can try and argue your way around it, but it'd leave you in a bad position if a parent argued the point.

 

https://gsuite.google.com/intl/en_uk/terms/2013/1/premier_terms.html.

[Narwhal]

"Customer will obtain and maintain all required consents from End Users"

This is the clause in that document that you linked to but the school does not require active consent.

[peej2k]

If they are under 13, they require consent from the parent.

If you don't believe me, go and ask Google directly.

[Bigbird7]

An interesting conversation around my original post...

My view is that all of the companies that are effectively saying you need parental consent to use their systems have been sucked into the consent is king argument. For the majority of systems that schools use they are able to use public duty as their legal basis for processing and sharing. There will be an exception to this which would be information service providers, which I would regard GSuite as being, where consent would be required.

The bottom line is that if we have to gain consent for these services then they will lose customers, most schools have enough trouble getting consent forms back anyway!