Google apps - Do we need parent consent & can someone share one if we do. (Primary)

[TwistedHelixis]

Just about to let the pupils use Google Classroom at a primary school and then remembered we might need to get the parents consent.

 

Do we need consent?

 

Can someone share a consent form so I have something to work from.

 

Thanks

[paulkerton]

Grey area.

If it's required for your school to be operational, then you don't need consent... Basically. (More complicated than that though!)

 

As the law changes on Thursday and you're required by law to provide online learning should the school close, if Classroom is the solution, I would argue that you don't need consent for GDPR purposes, though I'm sure Google would prefer you to get this consent anyway.

 

But this is something you need to check with your DPO.

Edited October 19, 2020 by paulkerton

[RLR]

Are they logging in with their own school google account? My sons school has asked parents to use Google Classroom with a personal google account.

[paulkerton]

Are they logging in with their own school google account? My sons school has asked parents to use Google Classroom with a personal google account.

WHA?!?! That's a terrible, terrible idea.

Pupils using personal accounts? Or parents getting access to Classroom Summaries with personal accounts?

[RLR]

WHA?!?! That's a terrible, terrible idea.

Pupils using personal accounts? Or parents getting access to Classroom Summaries with personal accounts?

Parents have joined as students using their own personal gmail accounts.

[paulkerton]

Parents have joined as students using their own personal gmail accounts.

That's a really bad idea. Parents are now pupils. Parents can communicate with other pupils that aren't their own in the same class. What happens when a parent behaves inappropriately in a classroom?

Do they have a Google for Education Partner? They would've recommended heavily not to do this.

[steveg]

You should ideally complete a DPIA as this will be a new system. Your ROPA should be updated, which will include the lawful basis you have for using this system / processing this data. The outcome of this will likely be that you do not need to get consent, certainly it's important that you don't get consent when you don't need it, as this can be withdrawn, and you shouldn't then change the lawful basis for processing the data to something else.

[RLR]

That's a really bad idea. Parents are now pupils. Parents can communicate with other pupils that aren't their own in the same class. What happens when a parent behaves inappropriately in a classroom?

Do they have a Google for Education Partner? They would've recommended heavily not to do this.

 

I did think this when they first announced it. It is only used for homework. I think their argument would be that this is the parents way of accessing the student homework and shouldn't be used by the student.

[paulkerton]

I did think this when they first announced it. It is only used for homework. I think their argument would be that this is the parents way of accessing the student homework and shouldn't be used by the student.

Sounds like they've gone and used the wrong platform for them then.

[BinoX]

Mainly a lurker, but thought I'd post on this as I've recently had this discussion with some Heads.

 

The Google statement says (slightly boldified for quick reading)

 

Additional Services

require consent for minor users: G Suite for Education requires in its agreement (section 2.5) that schools obtain parent or guardian consent for any Additional Services they allow students under the age of 18 to use.

Schools may

opt to

get consent for

Core Services

as well: As a

best practice

, school may also want to get parent or guardian consent for the Core Services they enable. Otherwise, a school would provide consent for Core Services on parents’ behalf by signing up for and using these G Suite for Education services.

 

 

Being as Classroom is a core service, it will be fine - however, our MAT has opted to get parental consent anyway as it is indeed best practice. If any parents do not want their child(ren) using Google services, we have alternative provision in place.

Edited October 19, 2020 by BinoX

[BinoX]

I did think this when they first announced it. It is only used for homework. I think their argument would be that this is the parents way of accessing the student homework and shouldn't be used by the student.

Parents can be added as Guardians for the students, and they can see homework that way...

[Ditto]

I would say you don't need consent but you may need to update some policies to notify. The message is clear already, but do not use personal accounts, only school ones. I'm not even sure it would be within T&C's, but regardless, for so many other reasons, school accounts are the only way to go.

[paulkerton]

Parents can be added as Guardians for the students, and they can see homework that way...

Well, they can see what work is expected, but they can't see the work itself.

[TwistedHelixis]

Are they logging in with their own school google account? My sons school has asked parents to use Google Classroom with a personal google account.

 

I am a bit shocked that the school is not even bothering to setup the student accounts.

 

Anyway to answer the question, or perhaps I already have, we have student accounts setup within our domain.

 

our MAT has opted to get parental consent anyway as it is indeed best practice.

Would you mind sharing you consent form, its not normally something I would do, and if its already been done.......

[dmj]

I don't think it is best practice to ask for consent in this case.

You can't have a situation where parents withdraw consent if the service is essential for how the school operates and communicates with parents - thus consent isn't appropriate in this case.

[elsiegee40]

@GrumbleDook

[DGardiner]

Just about to let the pupils use Google Classroom at a primary school and then remembered we might need to get the parents consent.

 

Do we need consent?

 

Can someone share a consent form so I have something to work from.

 

Thanks

 

 

Google have some templates on the support page - But id argue operationally its required now in order to deliver home learning, We have been getting verbal consent where it was not already gained

[BinoX]

Google have some templates on the support page - But id argue operationally its required now in order to deliver home learning, We have been getting verbal consent where it was not already gained

This argument was talked through at a leadership meeting, and they came to the conclusion that: If you have any provision for students that don't have internet access (or a suitable device) at home then it could be seen as being as optional rather than required.

 

I'm not sure if your school has any students in that situation, but we have more than a handful.

 

At the end of the day, it's down to the leaders at each individual school/MAT on how to classify their use of services - I'm just passing along the experience that I've not long finished going through.

[DGardiner]

This argument was talked through at a leadership meeting, and they came to the conclusion that: If you have any provision for students that don't have internet access (or a suitable device) at home then it could be seen as being as optional rather than required.

 

I'm not sure if your school has any students in that situation, but we have more than a handful.

 

At the end of the day, it's down to the leaders at each individual school/MAT on how to classify their use of services - I'm just passing along the experience that I've not long finished going through.

 

in households where this is the case we are providing connectivity and equipment

[GrumbleDook]

As already mentioned by @BinoX , the additional services are the problem.

 

Core services are where the data is only processed as set out for the purposes of the Data Controller, in this case the school. The purpose is likely to be the delivery of an education curriculum, the pastoral support and well-being of individuals, and the management and running of the school. All these quite easily fit under public task. Some types of processing that you may do in there, where quizzes end up profiling and so on, need to be considered in this though. You will have some who question this and this is part of a long, ongoing debate on who sets out the purpose and what data is being used.

 

Additional services are where both the school and Google are data controllers in their own right. Consent is needed as a result.

 

By default, Additional Services are turned off for users when a new G Suite instance is setup. Historically, this may not have been the case.

If you have enabled YouTube for your users, then Google are tracking the data for their own purposes and are a controller in their own right. Consent is needed for Google's purposes.

 

I'm eager to see what comes out of this, as we have never had any proposals or standards around learning platforms and tools before ...

...

...

...

...

...

Well, apart from Becta, the report from ETAG, the continued work of thousands of schools ... but I am sure that it will work out ok.

Edited October 19, 2020 by elsiegee40

[Ditto]

I'd like to go back to the OP's question, which was specifically Google Classroom and parental consent. The discussion beyond that is interesting and useful, but for that original question, my understanding is that Classroom is core and therefore not an issue. I wonder if this is being over-thought. Seeking parental consent can complicate life unnecessarily. If the pupils work at home with books and text books, with teachers marking up the responses, I doubt anyone would give any thought to consent. What would you do if a parent did not consent to using books for data storage processing?! My non-legal view is that using Google Classroom is not much different and the duty of the school to provide an education. How they do that is in many ways the schools decision. I reflect on a situation where we had a parent refuse to fill in a Google Form to book their parent in to see a play the child was in. The parent just didn't trust anything Google. We worked around it with paper, but the child and parent could have missed out. So, to conclude, be GDPR compliant, but avoid complicating life where you can. The world has perhaps become overly complex!

[GrumbleDook]

@Ditto You've pretty much covered it.

It is core, it is covered under Public Task (or even Legal Obligation after later in the week) and is 'almost' a Substitution of what already goes on (see the SAMR model for more on this).

 

- - - Updated - - -

@Ditto You've pretty much covered it.

It is core, it is covered under Public Task (or even Legal Obligation after later in the week) and is 'almost' a Substitution of what already goes on (see the SAMR model for more on this).

[EduDataPro]

Picking up on this thread from last year, is anyone using 'CS First', and if so are you getting parental consent? It's an 'additional service' outside of Gsuite so according to Google, schools should 'get parental consent before allowing these users to use CS First' however according to this help page https://support.google.com/csfirst/answer/7476833?hl=en&ref_topic=7477412#privacy_policy the data sharing required to use it sounds to be restricted to their Gsuite creditionals (see below), and even this has a workaround if you use the option for creating anonymous logins.

 

Bearing in mind in theory schools should be gaining parental consent to use any 'additional services' including Google Maps, does anyone know of any UK school that does this? But similar to CS First I would expect the user data shared with Google Maps is pretty limited, so it's less of a GDPR issue and more of a breaking the Google agreement issue.

 

 

-------------

 

Our website is governed by the terms and privacy policy listed on our website (bottom of each page). Additionally:

 

• Students may sign in to CS First using a G Suite for Education account or they can create a CS First account with a randomly-generated username and password, but they cannot use a personal Google account.
  
• Google does not ask for any personally identifiable information from students through CS First.
  
• To preserve student privacy, names added to CS First accounts in your teacher dashboard are stored on your computer and browser rather than on Google's servers.
  

 

source: https://support.google.com/csfirst/answer/7476833?hl=en&ref_topic=7477412#privacy_policy

 

The agreement info from CS First:

 

CS First is an additional service not covered by your organisation’s Google Workspace for Education agreement. This means that this service may collect and use information for the purposes described in our Privacy Notice and the terms that apply to this service. You can learn more about the differences between core and additional services in our Help Centre.

 

• If you have end users under the age of 18, your institution is required under its Google Workspace agreement to get parental consent before allowing these users to use CS First. More information that your institution can share with students and parents about Google’s services and privacy practices is available in our Help Centre.
  
• You acknowledge and agree that you will comply with all laws and regulations that apply to your provision of CS First to your end users, including, as applicable, the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA).
  

[GrumbleDook]

The CS First request for consent is based on COPPA requirements so please be mindful of that.

 

It is a curriculum package and I would need to get a better picture of a) how any personal data is used by Google for Google b) whether any of that data is also shared with third parties and c) how any rights of individuals are dealt with.

@Zoom7000 can you ask the team about any of this? Has this come up in any discussions in the GEGs?

[Zoom7000]

The CS First request for consent is based on COPPA requirements so please be mindful of that.

 

It is a curriculum package and I would need to get a better picture of a) how any personal data is used by Google for Google b) whether any of that data is also shared with third parties and c) how any rights of individuals are dealt with.

@Zoom7000 can you ask the team about any of this? Has this come up in any discussions in the GEGs?

 

I did notice someone complain about worrying concerns around CS First, especially as it was becoming a Google Workspace for Education additional service, as opposed to a core service, although I don't know the finer details about the concerns.

 

There are valid considerations that will need to be made because it is not a core service and therefore not covered by the standard Google Workspace for Education T&Cs.