Monitoring of Staff and Student files and emails

[MkII]

I know we've discussed this topic in other threads but I thought I should put this on it's own to keep things simple.

 

Our security officer just mailed me this in response to my question about monitoring files - I said we needed consent to be able to do this.

 

"Hi Mark

 

With regard to RIPA, as I understand it you do not need written permission to monitor anyone's email or files. You just need to ensure they are aware of the policy that states "they will be monitored for policy compliance"

 

extract ...

 

Under the Regulation of Investigatory Powers Act 2000 (RIPA) interception is allowed for certain listed purposes without the consent of employees. The government's Interception of Communications Regulations 2000 authorise employers to monitor staff e-mails, Internet use and even phone calls at work, provided employers have a 'lawful' business purpose and that they make 'all reasonable efforts' to inform users of the monitoring.

 

... I assume it's got to be the same for pupils??

 

RIPA starts to conflict with the Human Rights Act with regard to privacy issues, but the general advice given by specialists is that you write your policy in such a way that states you can and will monitor any data on your network to ensure policy compliance, and to aid in resolving networking issues.

 

We do not ask staff to sign the policy and Personnel/Legal have ensured that we are within the law to monitor any email when we are investigating abuse of Council policy cases.

 

It would be worth asking advice of the legal section when you have completed your policy. If there are any cases where you receive complaints, then I guess you would ask the Legal department to act on your behalf."

 

Any thoughts?

[russdev]

don;t you need staff to sign it otherwise policy is useless as they can claim they never know about it...

 

Russ

[MkII]

'all reasonable efforts' to inform users of the monitoring.

 

I'm hoping putting it in the staff handbook and proving a link to the policy is enough - it's more than our parent council do and they seem to think they're fully covered....

 

Thing is this'll be an easy answer - no staff strikes coz of the sysadmins nazi policies LOL!

[Geoff]

Any thoughts?

 

Obligitory 'told you so!'

 

But seriously, the advice you have given is sound. One tip though. Your security officer mentions talking to the legal department. Be careful with this as it's tempting to just let legal redraft big chunks of your policy turning it into legal gobbledegook.

[russdev]

biggist problem i see with that is how many of you have seen a staff hadnbook i did 9 months after i joined...

 

Russ

[ICTNUT]

Hi all,

 

I think it would be easy to implement for staff, but its the students that are the harder area to govern.

 

If you are going to bring in policy then I guess the easiest way would be to place it into the "handbook" for students.

 

For new ones this is fine but for already established students what then issue a new handbook, what about the costs involved I hear them all cry.

 

Also not forgetting the parents.......

 

This is going to be a minefield to get around.

[MkII]

Welcome ICTNUT. I don't think a student handbook is viable at all. There is the question of existing students [and parents/guardians] and how they can be brought up to date. The key point for me is "all reasonable effort to inform users".

 

I intend to have a forced click to accept before logon to cover that, and then an updated AUP on the student intranet.

 

Check out other threads similar to this topic for the whole picture .

[russdev]

lets put it like this I would rather have staff sign it just to cover myself but then personel choice?

 

and geoff's comments about legal department i agree with that they tend to make documents unreadable and then it become useles policy as people do not understand it....

 

Russ

[Ric_]

@ICTNUT: If you check out the WIKI, you will see a letter and policy. These are intended to be send home to parents and the slip returned when signed by the kiddies and their parents.

 

The kids then keep the copy of the policy.

[ICTNUT]

@ Ric_: Cheers mate

[Geoff]

Another useful place to put these kinds of policy documents is on an internal webserver (if you have one).

[Dos_Box]

Also if you have a logon message then that covers you too. If it states 'By clicking OK you are agreeing to abide by the school ICT usage policy....' etc.

This part is vital as it is your big legal get out that the user claims they did not know about or sign a school ICT policy.

[ICTNUT]

@Geoff: We have Sharepoint fully rolled out here so placement of the docs is not a problem it just ensuring it is enforced and legal.

 

@Dos_Box: as of this afternoon the logon message is in place ;-)

 

Cheers all