Staff using personal gmail account in school- Acceptable?

[mikeprice]

On a seperate note

 

if a teacher (e.g.) was insisting on using their personal email for school business - and a data breach was suspected, or an access request was received - would the school be able to demand access to all their emails as this is the only way to ensure ot is dealt with properly??

 

I know a lot of people would have personal stuff on an email account that they would not like work colleagues looking through!

 

This may be a way to persuade them to stop using them and use the work based one

[blueday]

Recently went on some updated GDPR training. He was quite clear that you shouldn't be doing it and the words" just incase" he clearly stated no don't do it.

 

.... We even got told during the training that we should be redacting more information than what we do. Every person in this seminar failed the task.... including me and our DPO. We should be redacting MUCH more and only the directly related data should be allowed.

 

That's really interesting - can you give some examples of what they thought should be redacted but you didn't? We had a similar experience, when we had to get a legal firm to go over the documents we were planning to reveal under a SAR - they redacted loads of extra stuff! However, experience with the ICO suggests that they lean on the side of giving more rather than less.

[GrumbleDook]

SLT don't agree that school can be fined.

 

They can. ICO have started fining schools ... admittedly just for failure to pay the registration fee, but they are asking questions of schools and trusts now. I'm not saying that to scare-monger ... I'm saying that to show that sticking their heads in the sand is not an option any more.

[jthompson]

anyone any examples of school being fined - a concrete example might be needed here

 

There was a headteacher who got fined for using a USB stick full of data from a previous school he'd worked at. He was found personally responsible, which ought to ramp up the jeopardy quite effectively when recounting the story to staff.

 

https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/12/former-headteacher-prosecuted-for-unlawfully-obtaining-school-children-s-personal-information/

[GrumbleDook]

Recently went on some updated GDPR training. He was quite clear that you shouldn't be doing it and the words" just incase" he clearly stated no don't do it.

 

How does your DPO deal with SARs? Has the DPO reported to the Governors/HT over personal Gmail accounts?

 

We had a SAR not long ago and the pile of work was ridiculous but had to be done. Emails had to be copied, paper copies made, our MIS data exported (including scanned/documents) and making sure every external site we used was included. All that information had to be double checked to make sure it didn't include personal details of anyone else. We even got told during the training that we should be redacting more information than what we do. Every person in this seminar failed the task.... including me and our DPO. We should be redacting MUCH more and only the directly related data should be allowed.

 

It has to be on a case-by-case basis. sometimes the choice is down to the school. I've seen people say you should *never* include the names of others involved who were working in a professional capacity (there is a court ruling showing that you can categorise instead ... e.g. HR1, SLT1, SLT2, etc.) but there are times when that is plain stupid as we *know* it is obvious who was involved and an FOI request will provide details of who fulfils those roles.

[DGardiner]

DPO left. Waiting for new DPO.

BTW HT and DHT agreed to have corporate Gmail account. I have purchased the domain but waiting for the checks to be finished. I understand that being a school it is complicated to do the company checks.

 

 

Just remember google apps for edu is free - has an application proccess i havent been through for 8 years but it should cost you only the domain to implement, if you can find a company that provides the training and whatnot as a google partner they can really speed this proccess up i found

 

I waited weeks for my application and got pointed to a training provider who had the GAFE account approved the next day.

[saggu]

Just remember google apps for edu is free - has an application proccess i havent been through for 8 years but it should cost you only the domain to implement, if you can find a company that provides the training and whatnot as a google partner they can really speed this proccess up i found

 

I waited weeks for my application and got pointed to a training provider who had the GAFE account approved the next day.

 

I am still waiting. Would you mind PM me the name of the company?

Many thanks

[GrumbleDook]

I am still waiting. Would you mind PM me the name of the company?

Many thanks

Chat with the team at Haptic ... they are pretty spot on for this.

[saggu]

Our domain is verified now and I have started to configure G suite. I am on my way!

Thank you all for you advice and input. Edugeek platform is the best!!