iDoceo - Apple App and GDPR compliance

[Ditto]

Brace yourselves! Just discovered a teacher is using an iPad app called iDoceo as a result of me being asked to create a new generic userid (Google) so a few staff can share the iPad and app. I raise the question of GDPR compliance... response was how could the data ever be lost...

Clearly our GDPR INSET training hasn't quite done the job! Then I learnt pupil photos have been upload to the system. So I asked about where the data's stored... and learn a Dropbox account is used... we don't have school ones, so presumably a personal account.

Now, I'm a advocate of technology being used in education and it looks a really useful app, so I'd be delighted to have the product properly supported, but we do need to remain compliant.

 

So finally to the question, is anyone using iDoceo and has assessed it from a GDPR point of view - or is willing to have a look now and comment. https://www.idoceo.net/index.php/en/

[Mistert89]

If I recall, Dropbox personal is free and outside EU/GDPR approved geolocation. The paid one can be specified in UK jurisdiction. We banned ‘staff-found’ applications such as this. Love ‘em or hate them, we bought Sims Teacher App and maintain data control.

[djrscally]

The Dropbox thing; you really ought to have a policy forbidding that now. Certainly if someone here did that nowadays they'd be having a conversation with me and HR. Same if this is a personal iPad as opposed to one under your control.

 

iDoceo, the impression I'm getting from the site is that the data is stored locally unless they use the iDoceo connect thingy. At minimum they're going to count as processing data uploaded to iDoceo Connect so you'll need an agreement in place defining that processing.

[edmokeski]

We use iDoceo in a limited deployment (because it's fairly pricey, as apps go) and are satisfied re: GDPR. Data is stored locally within the app, aside from backups. Backups are stored to school Google Drive accounts (GSuite for Edu), and the app integrates with Google Classroom to autopopulate classes etc..

[howartp]

We use it across school.

 

GSuite Edu for backups and photo sync, FoldR to get classes in.

 

No other storage issues.

[AndrewSharp]

Clearly our GDPR INSET training hasn't quite done the job!

 

Sounds like a policy review might be in order too unless this was purely a lack of understanding of the existing policy. Is there a policy which makes it clear to staff that they may not install new applications or begin new processing methods without this being reviewed and has that been made clear through INSET and other mechanisms?

 

A review to determine whether a full DPIA is needed, and to record the decision, as well as a review of the processor contract would be among the minimum actions before starting to use a new way of processing personal data. That's too much detail to cover in an INSET, as most staff won't be involved, but all staff need to be aware that changes to processing personal data require planning by suitably qualifies staff.

Edited October 16, 2018 by AndrewSharp

[Ditto]

We use iDoceo in a limited deployment (because it's fairly pricey, as apps go) and are satisfied re: GDPR. Data is stored locally within the app, aside from backups. Backups are stored to school Google Drive accounts (GSuite for Edu), and the app integrates with Google Classroom to autopopulate classes etc..

 

What is the sort of cost we are seeing for 'pricey'?

[edmokeski]

I think it's about twelve pounds per license? There's no VPP bulk discount at all, though, so it adds up quickly. We buy licenses one at a time on request, whereas with most other apps we buy and deploy them in bulk for our whole user base.

[Ditto]

VPP? At the moment it's one iPad being shared with a single account by 2 music teachers. I presume there is no cost related per pupil?

[edmokeski]

Slightly different scale! No, no per-pupil charges. And it's a one-off purchase, rather than the ever-proliferating subscription model.

We're 1:1, so have 60-odd teachers on iDoceo so far.

[themightymrp]

As @edmokeski and @howartp have said, we are happy with using it. We have iDoceo across our teacher iPads (note - purchased AGES ago when it was cheap ) and in the latest build you can choose the backup locations as OneDrive for Business. being an Office 365 school this works OK with us. Also we don't use student photos with it.