Student Email Account & Parental Access

[jaminben]

Hello,

 

We've had a request from a teacher to reset a students email password which they will then forward onto to the parent so the parent can access the account... we can see the student accessed their email yesterday so we know it works and that they probably know the password. The student is also over 13 years of age.

 

I'm assuming the student has a right privacy and that they can choose to give\deny access at that age under GDPR regulations? So should we not be giving access? Am I reading too much into GDPR?

 

Any advice would be appreciated.

 

Thanks

[synaesthesia]

Correct. As soon as they hit 13 it's their right to that data privacy. They can give permission for their parents to access in that way, and they can also change their password and not give those details and you wouldn't be able to force otherwise.

[pete]

My first question would be "What problem are you trying to solve?"

 

We wouldn't give a member of the public access to organisation IT systems. They're neither a student or an employee.

 

In the case of a student in hospital without WiFi and a looming deadline (for example), we'd likely email the work across to the parent.

Edited February 26, 2020 by pete

[jthompson]

You must also consider that others in the organisation may be sending to that address either directly or via a mailing list in the expectation that the account is not being shared with parents.

[paulkerton]

Correct. As soon as they hit 13 it's their right to that data privacy. They can give permission for their parents to access in that way, and they can also change their password and not give those details and you wouldn't be able to force otherwise.

Yes. Except in Scotland, where its 12. But yes, if you want to do this, you'd have to get affirmative consent, freely given from the child if they're over 13. That freely given part is important. If the teacher or parent is putting pressure on the student to give access, then it's impossible for the child to freely give their consent, even if they do give consent at some point.

 

So definitely watch the teacher and parent behaviour on this!

Edited February 27, 2020 by paulkerton

[jthompson]

I'm not sure about this. I wouldn't equate it to a subject access request under GDPR. I'd be more inclined to treat it as a data breach: that's perhaps the only way that GDPR has anything to do with it. Mailboxes don't exist in isolation. They contain communications with other people, so you can't really treat it like it's a subject access request that affects only that one pupil.

[paulkerton]

Chatting to my line manager, he also made a great point.

I assume you have an acceptable use policy in place where the child can't share their passwords with other people? They'd be in breach of that if they share their password, wouldn't they?

[synaesthesia]

Until that age, a parent is legally allowed to act entirely as a proxy for their child. No communication should ever be sent to a pupil that shouldn't be seen by a parent anyway, that's just a matter of common sense and if that same account allows access to other systems (remote access, shared areas, onedrive, sharepoint etc etc) then the same applies - if parents shouldn't see it, neither should the pupil and you have an unrelated problem to attend to. Then after that age, it boils down to explicit consent from the child.

[jthompson]

I'd want the parent to sign the acceptable use policy, then. They'd be in a position to communicate with pupils and staff whilst assuming the child's identity. How comfortable should we be with that?

[Boredguy]

Our AUP for students is also signed by the parent/guardian as well as the student so they know the policy (and it helps when staff enforce breaches that result in sanctions)

We've had a few parents over the last year or two call up asking for their students login details so they can install Office 365, we just politely point out we don't know the password, and if their child has forgotten it they need to come and see us to get it reset. In each instance the parent has been fine with that stance and it has not been an issue.

 

If the student is off on long term sickness, then resources are always sent via the parents contact details by the office so should not be an issue.

[enjay]

This is probably so the parent can support the child better, e.g. see their work and check what homework they've been set. We periodically had requests like this at my previous school where homework details were often sent via Google Classroom (and the planner therefore just said "homework is on Classroom").

 

I wonder if they've gone for the obvious option of asking the child first, or just leapt to the technical...

 

The parent then having the ability to pretend to be the child via email, etc. is an interesting point though. I hadn't considered that previously. Of course, most parents will know their kids' PIN codes for their phones, etc. so can probably spoof emails already if they wanted to.

[GrumbleDook]

Correct. As soon as they hit 13 it's their right to that data privacy. They can give permission for their parents to access in that way, and they can also change their password and not give those details and you wouldn't be able to force otherwise.

 

This is incorrect. The age of 13 is related to Internet Society Services, where the relationship is directly between the child and the service provider (e.g. Blizzard) and is related to where Consent is the lawful basis for processing.

 

Whilst children have a right to control their data from any age, you have to be mindful of their competency. In Scotland that is deemed in law as over 12 (basically 12 years and 1 second counts), but in the rest of the UK there is no set age.

 

To be honest, this is more of a safeguarding question than anything else. Why do the parents want or need access? Is this related to possible harm the child is getting into (county lines etc.)? Is there a risk that they will send emails from this account to other children, possibly pretending to be their child? Is this part of a greater issue?

 

Until those questions have been answered then it is hard to pin down what to do.

 

I would suggest a discussion between your line manager, the teach and the DSL in the first instance and then chat to the parents after that.

[paulkerton]

This is incorrect. The age of 13 is related to Internet Society Services, where the relationship is directly between the child and the service provider (e.g. Blizzard) and is related to where Consent is the lawful basis for processing.

Forgive my ignorance, but doesn't that age of 13 grey area within the law only apply for those things that are legally statutory, such as reporting to parents?

 

So for example, if a school is using Office 365 and the child is over 13, they still need consent from the child to provide any personal data to that service? I'm not sure schools can just say "Well we use that here, so you don't have the right to withdraw." Can it?

 

The law was very much fudged into existence, so its really quite a mess for schools to pick these things apart. Any hints and advise is always welcome from any source!

[enjay]

So for example, if a school is using Office 365 and the child is over 13, they still need consent from the child to provide any personal data to that service? I'm not sure schools can just say "Well we use that here, so you don't have the right to withdraw." Can it?

 

Actually that's exactly what the school can do. Consent is only one of 6 (?) legaljustifications for processing data, another being work undertaken as part of a public duty - that is the reason schools should give for processing data in Office 365 etc. If you used consent as the reason and a child were to withdraw it, teachers would have to print individual pages for that child because they couldn't email them!

[synaesthesia]

This is incorrect. The age of 13 is related to Internet Society Services, where the relationship is directly between the child and the service provider (e.g. Blizzard) and is related to where Consent is the lawful basis for processing.

 

Whilst children have a right to control their data from any age, you have to be mindful of their competency. In Scotland that is deemed in law as over 12 (basically 12 years and 1 second counts), but in the rest of the UK there is no set age.

 

To be honest, this is more of a safeguarding question than anything else. Why do the parents want or need access? Is this related to possible harm the child is getting into (county lines etc.)? Is there a risk that they will send emails from this account to other children, possibly pretending to be their child? Is this part of a greater issue?

 

Until those questions have been answered then it is hard to pin down what to do.

 

I would suggest a discussion between your line manager, the teach and the DSL in the first instance and then chat to the parents after that.

 

Looks like I need to do rather more reading! I recall that bit being rather more black and white last year!

[GrumbleDook]

@enjay has it spot on. Why are you using Consent? It is not the most appropriate lawful basis. Also, the age is related to consent for ISS. If it comes via the school it is not ISS (Internet Society Service).