DfE letter to Academies regarding Data Protection after Brexit

[AndyCrow]

A few schools we deal with received a letter yesterday from Lord Agnew outlining steps schools should consider taking with regards to Brexit.

From a data protection angle its quite difficult to answer as we dont know if it will happen and if it does whether there will be a deal or not.

 

Transferring data out of the UK isn't an issue but in the worse case scenario there may be some issues getting access to data if servers are based outside of the UK. We are recommending that schools note which cloud services they are using and we contact them to see whether new contract clauses need to be included.

 

It may be a good idea to share this information on here so that everyone knows which products carry the greatest potential risks.

[elsiegee40]

@GrumbleDook?

[blueday]

I think it's totally unrealistic to expect schools themselves to contact all their suppliers and check their future compliance - shouldn't it be the other way around? Surely all those suppliers should be updating their data protection agreements/contracts and signposting to their customers.

[elsiegee40]

I think it's totally unrealistic to expect schools themselves to contact all their suppliers and check their future compliance - shouldn't it be the other way around? Surely all those suppliers should be updating their data protection agreements/contracts and signposting to their customers.

 

Due diligence is a two way process in any organisation, not just schools.

 

Yes, your suppliers should be stepping forward and telling you, but how many of those emails will actually be read and checked by the recipient? I bet many have been deleted immediately without thought along with all the marketing propaganda.

 

The organisation has no choice but to go out looking for itself. Suppliers could make it easier by putting the relevant information somewhere easy to find on their website.

[FishCustard]

I've been doing a fair bit of Brexit-proofing of the operations here (and convincing other department heads to do the same!). I took my foot off the accelerator so to speak when the Benn Act was passed as it looked less likely that no-deal would happen. Given that we don't know whether the PM will abide by the law(!) however, I should probably get back to it.

 

I imagine Office 365 won't be an issue, although I've not found any documentation.

 

What issues does Lord Agnew's letter specify - surely suppliers in the EU won't blackhole connections from the UK in the event of no-deal?

[bossman]

@AndyCrow

 

As we used to say many years ago before the EU and Brexit "Don't panic Mr Mannering!"

 

All will out in the end and the due processes will take place and the world will still spin on its axis and there will still be two certainties in Life!

 

Death and Taxes!

 

Live long and prosper!

 

Its a great life @elsiegee40

 

Don't Worry be Happy!........ :)

[FishCustard]

I doubt my Head will feel the same way if school operations grind to a halt after a no-deal...

[bossman]

@FishCustard

 

You worry too much about absolutely nothing that you can control!

 

School operations will undoubtedly carry on as normal as will most everything else....you've all got Brexit fever!

[k-strider]

i asked advanced learning today they confrimed that progresso/cloud school is stored in the london AWS data center.

[k-strider]

Got another response today

Hi Gordon,

I can confirm that our data centres are in the UK - you can find more about this on the attached Data Factsheet detailing some commonly asked questions about IT security, including how and where we store personal data relating to your establishment and staff - there is also our general GDPR information notice below, should that also be useful to you to have on record.

The Hodder Education Group is committed to protecting and safeguarding your personal data. As such, we would like to share with you our updated Privacy Notice https://www.hoddereducation.co.uk/privacynotice that meets the terms of the new GDPR regulation.

[XiJ]

@FishCustard

 

You worry too much about absolutely nothing that you can control!

 

School operations will undoubtedly carry on as normal as will most everything else....you've all got Brexit fever!

 

Apart from the cost of buying equipment. Luckily schools are rolling in money.

[Ditto]

i asked advanced learning today they confrimed that progresso/cloud school is stored in the london AWS data center.

That's interesting as they used to be in Ireland. The London AWS centre I believe opened in 2016, so it makes sense they moved. Does anyone know when and has there been an improvement in performance? For anyone looking for Amazon's statement on Brexit (including the possibility of No-Deal) see https://aws.amazon.com/compliance/gdpr-center/brexit/.

Edited September 19, 2019 by Ditto

[enjay]

That's interesting as they used to be in Ireland.

 

I suspect they moved in readiness for this moment...

[bossman]

Apart from the cost of buying equipment. Luckily schools are rolling in money.

 

Some schools, I'm afraid are, due to the North South divide!

 

But then this is also something that we have no control over so who do we think we are?

 

We are mere mortals and we have to cut our cloth accordingly, we seek other ways to give value for money when it comes to IT in schools.

[IrritableTech]

One of the reasons schools felt more comfortable signing up with O365 rather than GSuite was that the microsoft servers were in the EEA - typically Amsterdam and Ireland I believe.

Has anyone got any thoughts on this relationship given a no deal exit?

 

[edit]

Having found this... https://products.office.com/en-gb/where-is-your-data-located#office-ContentAreaHeadingTemplate-bkjgypc

 

It seems only limited product data is now kept outside of the UK. Azure AD might be the biggest concern for schools. However I read the advice as still an decision for schools share data with these companies and territories (adequate protections) but the question here is that EEA organisations may not want to share their data with UK organisations post no deal exit.

Edited September 20, 2019 by IrritableTech

[Primus]

One of the reasons schools felt more comfortable signing up with O365 rather than GSuite was that the microsoft servers were in the EEA - typically Amsterdam and Ireland I believe.

 

Has anyone got any thoughts on this relationship given a no deal exit?

 

I'm not going to deny this may be why some schools did but I think it would have been quite far down the list - I think O365 was almost chosen by default - "we've used Microsoft Office etc for years and this is their new thing".

 

I also believe it's only in the last year or two that Microsoft have allowed you to choose where your tenancy stores its data.

[k-strider]

I also believe it's only in the last year or two that Microsoft have allowed you to choose where your tenancy stores its data.

 

where is this in the Admin Center?? please i would like to check

[bossman]

One of the reasons schools felt more comfortable signing up with O365 rather than GSuite was that the microsoft servers were in the EEA - typically Amsterdam and Ireland I believe.

 

Not true, we decided to go with GSuite because of the experience which was in our opinion far better than Microsoft had to offer at the time and would benefit our school more and they too have their Data Centres there also...

So did other schools and some have since migrated from Microsoft to Google and vice versa and some even run both systems....

 

Has anyone got any thoughts on this relationship given a no deal exit?

 

I doubt anything will change much if at all and this is just a pure logical guess as is most of the threads about Brexit on here, everyone whether they are pro or against is just doing that!......"Guessing!"

 

No one knows what is around the corner do we?

[jthompson]

I was under the impression that GDPR will essentially live on unchanged in UK law regardless. Provided everything is compliant with EU GDPR, it'll be compliant with UK GDPR.

 

gov.uk - Brexit guide: data protection for education providers

[dmj]

I was under the impression that GDPR will essentially live on unchanged in UK law regardless. Provided everything is compliant with EU GDPR, it'll be compliant with UK GDPR.

 

gov.uk - Brexit guide: data protection for education providers

 

Not quite sure how that works with regards to data staying inside the EU? We now have to move the datacentres out of the UK ?

[bossman]

Not quite sure how that works with regards to data staying inside the EU? We now have to move the datacentres out of the UK ?

 

Quote https://www.gov.uk/guidance/eu-exit-guide-data-protection-for-education-providers

 

General Data Protection Regulation (GDPR)

 

"GDPR will be incorporated into UK law if there’s a no-deal Brexit.

 

This and the Data Protection Act 2018 will continue to apply to data transferred within or from the UK."

 

So why would the Data Centres have to be moved?

[AndyCrow]

If we leave without a deal we will not be seen as an adequate country for data transfers by the EU this is despite GDPR being enshrined in UK law. Therfor theoretically this could cause a problem with data transferring back into the UK.

For this reason the Govt is recommending in their advice

"If you’re running a school exchange with a data controller based in the EEA, you may want to consider whether standard contractual clauses (SCC) are suitable.”

 

It is therefor important to know where the data is stored.

[theeggmaster]

Quote https://www.gov.uk/guidance/eu-exit-guide-data-protection-for-education-providers

 

General Data Protection Regulation (GDPR)

 

"GDPR will be incorporated into UK law if there’s a no-deal Brexit.

 

This and the Data Protection Act 2018 will continue to apply to data transferred within or from the UK."

 

So why would the Data Centres have to be moved?

 

I believe that the principles of GDPR will be copied into the DPA 2018 to make them functionally similar, but we won't actually be following GDPR if we're not part of the EU.

[bossman]

If we leave without a deal we will not be seen as an adequate country for data transfers by the EU this is despite GDPR being enshrined in UK law. Therfor theoretically this could cause a problem with data transferring back into the UK.

For this reason the Govt is recommending in their advice

"If you’re running a school exchange with a data controller based in the EEA, you may want to consider whether standard contractual clauses (SCC) are suitable.”

 

It is therefor important to know where the data is stored.

 

I am sure that these data providers will already have sorted most of where the data has to be stored and we as schools can be assured that we comply fully whether in or out of the EU...

 

The world does not revolve around the EU!...

 

Though some people in the UK believe it does....

 

The EU doesn't want to lose communications with the rest of the world especially with us and the sharing of data is prevalent to everyone's future on this planet, without it technological advances for whatever reasons cannot move forward and this especially within the medical environment so it would be foolish of the EU to disrupt the processes already in place for whatever reasons...

 

Scaremongering is rife among people today in the UK as well as the rest of the world and it only aids those that spread it...

[Ditto]

we will not be seen as an adequate country for data transfers by the EU this is despite GDPR being enshrined in UK law.

Out of interest, where and who has stated the UK will not be an adequate country. If we adhere to GDPR, it seems illogical we would not be.

 

"If you’re running a school exchange with a data controller based in the EEA, you may want to consider whether standard contractual clauses (SCC) are suitable.”

The DfE also say that their is no substitute to taking legal advice. Hmmm, so every school/academy goes out and gets legal advice, which will no doubt say it's all a matter of risk assessment anyway. Doesn't sound like a cost effective solution - how about DfE seek that legal advice and let us all know how best to proceed. But then again, I'd expect they'd have to say the legal advice is that it's all a matter of risk assessment!