CAPITA SIMS - significant risk of data breach for customers

[DODICT]

Sure you will be aware of the recent bug in SIMS that helpfully shuffles up contacts in your MIS to present a significant risk of contacting the wrong parents and possible data breaches. Never mind scenarios where you cant contact parents in an emergency.

 

Anyone had a look at their contract or discussed with Capita whether they have fulfilled their obligations as a data processor.

 

There are still schools that don't know about this and isn't that a fundamental failing of their obligation under GPR to notify the contracted party of the risk ? There's posts on the support sites now but that's far too passive in my mind.

[elsiegee40]

Being discussed here Urgent Capita Sims Data Issue - Issued by childrens services

https://www.edugeek.net/showthread.php?t=198167

[DODICT]

that thread is more focused on resolving the issue etc rather than the overarching data protection obligations - I didn't want to side track people supporting the steps to diagnose and remedy with talks of contractual obligations

[pete]

There are still schools that don't know about this and isn't that a fundamental failing of their obligation under GPR to notify the contracted party of the risk ?

 

Capita emailed (14-06-18) the nominated contacts at each school regarding this. Now that may have been the headteacher who routinely ignored it, but I did get notified and (IIRC) it was up as a KB article before then.

[DODICT]

did it say there's an issue with CTFs or make the school fully aware there was a significant risk of a data protection breach and potential for widespread corruption of parental contacts ?

[localzuk]

Capita emailed (14-06-18) the nominated contacts at each school regarding this. Now that may have been the headteacher who routinely ignored it, but I did get notified and (IIRC) it was up as a KB article before then.

Interesting, as I got an advert from them on 14-06-18 but no notification...

[djrscally]

Capita emailed (14-06-18) the nominated contacts at each school regarding this. Now that may have been the headteacher who routinely ignored it, but I did get notified and (IIRC) it was up as a KB article before then.

 

Hasn't it been happening since December though?

[pete]

Interesting, as I got an advert from them on 14-06-18 but no notification...

 

Email was "Important Updates from your SIMS Customer Success Manager"

 

Body text was:

 

Dear Colleague

 

Have you taken the options process online yet?

 

In November 2017, Dr Challoner’s High School took its options process fully online with a dedicated solution, the online SIMS Options, which manages the entire process via a secure, web-based portal. Attached is a case study in which the school's Data and Student Experience Manager, Karen Cross, explains how the school has adapted to the new system and the benefits it has brought since replacing the previous process.

 

For further information, and to access a wealth of resources, visit the Options Online section in the documentation centre here.

 

CTF Contact Address Problem

 

Unfortunately, there is a problem with our contact matching that means that in some cases the importing of a CTF to an admission group will have replaced the address for an existing contact with an incorrect address and incorrectly link the pupil to that contact. Please accept our apologies for this mistake. To solve this issue, patch 23971 can be applied. It is available to download from SOLUS 3. For Capita Hosted schools, this patch has already been applied for you.

 

Optionally, you could make use of a routine, which we expect to be able to provide in the near future, to detect if any of a school's contact data has been affected by this bug. We expect to be able to make patch 24040 available in the near future to restore the original address for the contacts and to link the imported pupils to the correct contact. However, it is important to note that this restoration will only be possible where the school has not already attempted to resolve the issue for a contact.

 

To stay up to date with the progress in resolving this issue, please see the CTF Newsfeed in MyAccount here. Don’t forget to select “watch” the notification to receive email notification when updates to this newsfeed are posted.

[DODICT]

yeah I'm afraid that isn't even close to what they needed to be saying. Laughable.

 

slip it in alongside a sales pitch for options and no mention of significant data protection concern.

Edited July 18, 2018 by DODICT

[localzuk]

Email was "Important Updates from your SIMS Customer Success Manager"

Body text was:

Yup, as I said in the other thread - I am the nominated contact for our 6 schools (at least I should be, as I'm the one who fills in all the forms, and have put my name and details in there!) and didn't receive anything like that. Would it be just those who get support direct from them, as we get ours from our LEA SIMS team?

[pete]

yeah I'm afraid that isn't even close to what they needed to be saying. Laughable.

 

slip it in alongside a sales pitch for options and no mention of significant data protection concern.

 

Agreed, they dropped so many balls it's more balls than floor at this point.

 

We're in the happy position of never importing parent or student contact details from CTF because the data is of such poor quality.

 

edit: @localzuk

 

I get the annual tally-up of modules we use and pupil numbers to check and confirm, so it might be that person?

Edited July 18, 2018 by pete

[localzuk]

I get the annual tally-up of modules we use and pupil numbers to check and confirm, so it might be that person?

Yep, that's me, for 6 schools. Didn't get anything.

[bigdannyb79]

I find it amazing a single school has a data breach and it makes BBC news and yet a large company introduce an error potentially causing 80% of schools in England to violate their data protection obligations and do little in the way of communicating the severity of the issue and yet they plod on seemingly unaffected and unchallenged.

 

It was introduced in Dec, known about weeks ago, and yet the comms from Capita has amounted to a side note on a sales pitch for Options ? This should have been a phone call to every school to verify they understood the issue and pointed to a fix and steps to remedy issues explained.

 

One of my schools had this issue and the patch was applied to stop it reoccurring but nothing was said about remedying the corruption, we were simply told to reenter the missing addresses. To knowingly leave customers in this situation is absolutely shocking.

 

I wont be waiting to see the 'new' SIMS - I've seen enough of Capita for a lifetime.