DPO leaving, but may have data

[wickit]

As the topic title describes

We have a bursar that is leaving, they are also the DPO.

Here lies my predicament, the new bursar does not start for a month or so, so we would be without a DPO for a while; this I can live with.

But, the bursar that is leaving may have data; albeit encrypted, on a device or usb drive.

 

Does anyone here have a template letter or form, that I could use to get the bursar to sign agreeing to delete/destroy all data.

Or any other advise

 

Cheers

[AndrewSharp]

I'd suggest that you check the standard staff contract - it should include a duty of confidentiality and a requirement to return any school property on leaving which you can refer to in a conversation or letter from their line manager (probably the Head) to ask the bursar to return any school equipment or data. This shouldn't be news to the outgoing Bursar, as DPO they should have been auditing that this process is working effectively.

 

It's unlikely that your bursar is a good candidate for DPO, so the school leadership should consider appointing someone who a) isn't directly involved in decisions about data processing and b) who has the necessary data protection expertise and access to regular training, or better still outsource the role to an independent specialist (declaration of interest - that's what we do).

Edited December 4, 2018 by AndrewSharp

[elsiegee40]

The Bursar usually has direct responsibility for finance and HR therefore there’s a conflict of interest. Their replacement should not be the new DPO.

 

As for your question, check your AUP and lift the sentences from that for the letter.

 

Your Bursar will undoubtedly be a key holder and have paswords to banking services, etc so all this should go in the same letter which should be written by the Head

[enjay]

But, the bursar that is leaving may have data; albeit encrypted, on a device or usb drive.

 

ANY staff member could be in this situation, so whatever you end up writing for your bursar should be applied to all staff when they leave.

[GrumbleDook]

I think the recent thread about ICO fining a former Head for removing data should be enough to quell this.

http://www.edugeek.net/forums/data-protection-information-handling/202021-head-teacher-fined-dp-breach.html

Edited December 5, 2018 by elsiegee40