DfE letter to Academies regarding Data Protection after Brexit

[k-strider]

This was in the letter which is why i am activley trying to work out where various companies store there data / datacenters..

[AndyCrow]

Exactly.

[jthompson]

Out of interest, where and who has stated the UK will not be an adequate country. If we adhere to GDPR, it seems illogical we would not be.

 

Hmm, this is confusing me now. I guess that come Brexit, we'll effectively be forking the EU GDPR to get our own UK GDPR. Who's to say that the EU can continue to recognise UK GDPR as sufficiently compatible with theirs, in the absence of any agreement between the EU and the UK? Not anyone in the UK, that's for sure, even if the UK is happy to say "EU-compliant is good enough for us".

[k-strider]

OK got another Email from UNIFROG another UK one

Hi Gordon,

 

Thanks for your email.

 

Our servers are based in the UK so a 'no deal' scenario as we leave the EU is no problem in this regard.

 

Please let me know if you have any further questions.

 

Best wishes,

 

Tom

[Ditto]

This was in the letter which is why i am activley trying to work out where various companies store there data / datacenters..

[ATTACH=CONFIG]55054[/ATTACH]

Interestingly the statement of 'chance that a narrow interpretation... could...' seems to indicate low probability. Following the link for education to https://www.gov.uk/guidance/eu-exit-guide-data-protection-for-education-providers the following initially appears more reassuring.

 

 

Receiving data back from the EEA, it seems important as to whether you are receiving the data as a controller or a processor. In the main, we, the school, are going to be the controller and the service provider the processor. Following through to the link to ICO, https://ico.org.uk/for-organisations/data-protection-and-brexit/keep-data-flowing-from-the-eea-to-the-uk-interactive-tool/ and running our scenario through concludes as follows:

 

Not quite sure where that leaves us...

[k-strider]

Would it be sensible to setup a separate thread that just lists companies that have got back to us with the location of data centres rather than a debate about whether we need to do anything or not so it’s nice and succinct... should we need to actually do anything cause ppl are right we are all just guessing atm

[elsiegee40]

Would it be sensible to setup a separate thread that just lists companies that have got back to us with the location of data centres rather than a debate about whether we need to do anything or not so it’s nice and succinct... should we need to actually do anything cause ppl are right we are all just guessing atm

 

Leave this one for debate. I am happy to pin the new thread

[k-strider]

Sage 200 Accounts held in Dublin

[enjay]

Surely I'm not alone in thinking this is scaremongering, or posturing by the Govt to try and get a different deal from the EU. Do we really think Google are going to risk their reputation and their access to all that lovely personal data by letting the connection between UK and their datacentres break on 31st October?

[GrumbleDook]

The issue is around when data is being sent back into the UK by your processor or the sub-processors. There are situations that could arise where Supervisory Authorities could restrict data being sent back. It is a bit of a ludicrous situation and I'm not going to even start talking about whether the probability can be calculated (you would have to assess each and every day from now until the moment any agreement between UK and EU/EEA is made) ... Standard Contract Clauses don't have a model to cover the EU-UK Processor to Controller but they can be adapted.

 

Yes, for our customers we are asking ... and most guidance from ICO is fairly generic but repeated calls to the helpdesk has raised interesting options ... one has even gone as far as the data controller contacting each Supervisory Authority for each case!

The best thing you can do is say not to panic, check that processors are doing what they can to ensure data continues to flow. The reason the DfE cannot do this risk assessment on mass as *it* doesn't know what you are using and each school / or trust (in the case of MATs) is the legal entity.

 

It will be a fun few weeks. Let's just say that at least Education is getting some guidance ... there are folk out there completely in the dark.

[jthompson]

Surely I'm not alone in thinking this is scaremongering, or posturing by the Govt to try and get a different deal from the EU. Do we really think Google are going to risk their reputation and their access to all that lovely personal data by letting the connection between UK and their datacentres break on 31st October?

 

I suppose Google have the luxury of being able to shift UK data to datacenters outside of the EEC.