Staff using personal gmail account in school- Acceptable?

[saggu]

Our school staff do not have work gmail account but they use their personal account to do school work and share with other staff. Is it acceptable? Is it a normal practice in other schools?

Thanks for your input in advance.

[robyholmes]

Your ICT policy should cover this, it's very bad practice and hard to defend if you have a breach.

[XiJ]

No no no. And aside from my IT angle, as a parent if they’re sharing data about my child via personal e mail I’d be making a complaint.

[Edu-IT]

Why do they not have work email addresses? I definitely say that using personal email addresses for work is a no no for many reasons. [emoji46] Edited October 12, 2019 by Edu-IT

[Ditto]

I think the answer is clear already. It's a big NO! Out of interest, what IT hardware and software does the school have?

[elsiegee40]

Massive NO!

 

Let’s start with GDPR. Is your DPO happy with this? If so, they need sacking.

 

With personal accounts you have no control over the data, no ability to fulfil subject access requests and yet your school is still liable for the security of the data.

 

You also have a major Safeguarding risk with no hope of tracing who said what to whom and when. No opportunity to filter, etc.

 

There is absolutely no excuse for this when O365 and G Suite are available free of charge.

 

I can hear @GrumbleDook screaming from many miles away

Edited October 12, 2019 by elsiegee40

[localzuk]

Another aspect as to why this is a big no - when a school signs up for Office 365 or G Suite, it is set up to be domiciled in an EU data-center. It also removes email scanning for personalised advertising. Personal accounts do not have this, and using them would be a very clear breach of the DPA 2018.

[saggu]

Thank you all. What if they claim they do not use pupil's data but use to work collaboratively on school's policies, timetabling, surveys etc? having said that timetables will have staff's names. Also what about linking the work email to their personal email? in this way all the staff's email ID is in their personal email account which can easily be tamped. Yes? No?

[saggu]

I think the answer is clear already. It's a big NO! Out of interest, what IT hardware and software does the school have?

LGFL email account for all staff. No Office 365 or G suite. Remote access available.

[elsiegee40]

Thank you all. What if they claim they do not use pupil's data but use to work collaboratively on school's policies, timetabling, surveys etc? having said that timetables will have staff's names. Also what about linking the work email to their personal email? in this way all the staff's email ID is in their personal email account which can easily be tamped. Yes? No?

 

It is still a no. If accusations start flying about who said what about whom, or about how $sensitive-data got out into the wild, how can your school defend itself?

 

Your DPO should be stamping down on this. Your school should have an AUP to say that this will not happen. Your school should be disciplining those who continue to fail to use the officially provided communication channels.

 

This protects the school, the students and the staff themselves. Put it in terms of an allegation made against them by a pupil and the loss of their career... it might focus minds.

Edited October 12, 2019 by elsiegee40

[XiJ]

The first thing you should do Monday (or actually now) is start configuring an O365/GSuite system and get accounts setup.

 

Make sure from the top down it’s enforced that ALL staff need to use work e mail accounts for work. No exceptions.

[mikeprice]

Personal experience

 

At my last school I had a school email account - and I obviously have my own personal email account

 

While I was there I was involved in a alot of email discussions about contract, support issues, organisational issues, swapping of ideas etc etc

 

When I left I cleaned up my account and deleted a lot of irrelevant stuff - then changed the password to something random just before I left the building

 

At that point the school (in fact the DH) had access to the admin email system so could easily (assuming he listen to my instruction and/or read my hand over notes) change my work email password and hence have access to all this info.

A lot of this info could be very useful - and belongs to the school as I used it as an employee of the school - not as a private person

 

If however I had done all this using my personal email then I would have kept all the data/info and the school would not have access

 

 

 

As similar problem arose just after I started at that school. The previous technician had died suddenly (very sad - not old and still had a kid at the school and had been there for years) hence everything he knew was inaccessible

Including his personal email account as the password was unknown even to his kids - and, as I found out, the school website. Turned out that, because it was easier, he had registered a website in his own name and used it as the school website and for the school email

So - when he died his wife inherited the website ownership. Clearly the family were going through a lot at the time and to get control of the website would have been asking too much

 

By which time the website registration had died so the school suddenly had no website

and the whole school email system stopped because it all went through the website

 

and all the info about where and how the website was set up would have been available through his work email - except that his email (and everyone else's) was now inaccessible

 

 

which is why all email should be owned and controlled by the school

[fiza]

LGFL email account for all staff. No Office 365 or G suite. Remote access available.

If they all have LGfL email accounts then they should be using those for communication. LGfL also now do G Suite accounts so no excuses really. I would prevent forwarding of any kind to stop emails going to personal accounts.

[Ditto]

If they all have LGfL email accounts then they should be using those for communication. LGfL also now do G Suite accounts so no excuses really. I would prevent forwarding of any kind to stop emails going to personal accounts.

Ditto @fiza! @saggu, have a look at https://www.lgfl.net/services/google-apps, then speak to LgFL to help you move forward. Not only will you remove a massive GDPR issue, your teaching staff will be able to collaborate in a much more effective way. Win, Win!

[saggu]

Many thanks. So helpful! I can pick up points to build my case to propose to SLT to stop using their personal email account.

[saggu]

I have action this @Ditto. But we do not want to loose lgfl email. We want both-gmail and lgfl emails.

[saggu]

The first thing you should do Monday (or actually now) is start configuring an O365/GSuite system and get accounts setup.

 

Make sure from the top down it’s enforced that ALL staff need to use work e mail accounts for work. No exceptions.

 

Any suggestion where can I register new domain for our school?

[elsiegee40]

I have action this @Ditto. But we do not want to loose lgfl email. We want both-gmail and lgfl emails.

 

Why have both? That just makes matters more confusing for people to use. They need one account in one place. Force the them to use their lgfl accounts OR switch to G Mail. Don’t let them have two different accounts

[fiza]

I have action this @Ditto. But we do not want to loose lgfl email. We want both-gmail and lgfl emails.

If staff have LGfL email accounts then why are they using personal ones? It doesn't make sense.

[mikeprice]

At my old school theer was some resistance from teacher about switching to use the school emails - one in particular

 

The DH eventually solved it by sendingall communications out only to school accounts - and at the same time changing a lot of things they were required to do over a few weeks - like changing how figures were to be entered - but only sending the details to email rather than printing them and giving them out in a meeting

 

once they were forced to keep checking their work email the excuses - like not remembering the password or can;t get onto it at home - could all be addressed and then stopped

 

One teacher stated that it was a point of principle and she would never use the school email (????) even if she was sacked. The DH stated if she was consistently failing to submit progress figures etc etc in spite of having access to the instructions - and having help available (i.e. me) at all times - then the school would have to start competency proceedings

 

she started using the school email

[XiJ]

Any suggestion where can I register new domain for our school?

 

To be honest we do it in-house. I’ve used easily before. As long you as you access dns changes you should be fine.

[enjay]

I have action this @Ditto. But we do not want to loose lgfl email. We want both-gmail and lgfl emails.

 

Your staff won't want to check two mailboxes, but with G Suite, you can have multiple domains registered so emails sent to @school.county.sch.uk and @schoolname.com will be received in the one inbox.

[PotNoodleTech]

Ideally, you need a replacement in place before you take away access to their personal accounts (arguably, more die hard data protectors will say just pull the plug now, and they'd be right to!)

 

School Google or office 365, both free. Our google costs us like £8 a year and thats just for the domain name renewal.

[dmj]

If you don't provide staff with the tools they want to use, don't complain if they workaround the problem.

In my mind there are two options, ban everything or just give them accounts - it's not going to cost you anything.

 

Why have both? That just makes matters more confusing for people to use. They need one account in one place. Force the them to use their lgfl accounts OR switch to G Mail. Don’t let them have two different accounts

It actually simplifies things: If you give staff tools that they are already comfortable with it *reduces* your support costs, those that are comfortable with outlook use outlook, those that like gmail use gmail. I don't really see a problem with it, gmail is sensible enough to be able to pull mail from external servers, allow forwarding etc. It's quite a good solution to have a mixed environment, it has very good spam filters, exemplary mobile access and would work with other mail systems.

[bobsmith]

When we set up our Google domain it was fairly painless to get people to move anything school related to their new school account (email was handled via MS Exchange still, google just redirected everything) - this was more their google drive stuff than email but the same principle applies.

 

A quick word for me about safeguarding and liability got them moving sharpish. They are still allowed to do things like lesson plans on their personal accounts - but nothing concerning staff/pupil data is allowed on there. This is simply so they've still got their personally made resources when they leave - can't complain about that.