Excessive data collection and control over data - InVentry

[IT_JB]

An FYI for those who use Arbor and InVentry the base level of requested permission is hugely excessive. Here's a copy of the access request.

 

 

Not sure if this is the same for other MIS links but i don't see why it should have any more than read permission and write for attendance. Definitely not delete! After raising the issue with their support team i got a call from one of their higher ups, he said they had reviewed it internally and agreed it was excessive. They are now looking to reduce the level of permission requested but was not able to give an eta because it's something that would affect all customers (who use Arbor) as this is a global permission list used for all schools.

 

If there are any other Arbor + InVentry schools on here could you give your account managers a push? Maybe with more people raising this as an issue they will get to it a bit quicker!

[Ditto]

I had similar with Wonde and Progresso access requirements for CPOMS. We completed a DPIA and reduced access to what was relevant, as required to remain GDPR compliant. Good to see they are at least engaging in the topic but really they should have done so quite a while ago.