Desmos & GDPR

[foofighterjim]

So I've had a Maths teacher enquire about: https://www.desmos.com

 

Are anyone else using this? I'm stuck on their privacy policy and GDPR.

 

Being an online system I've done the usual thing of checking for (UK) GDPR compliance. In their privacy policy it references COPPA and FERPA, I can't find anything that suggests that either or both combined would make this site fully GDPR compliant. Their privacy policy or FAQ does not mention GDPR at all. Reading their Privacy Policy, it all seams very reasonable and covers the main aspects of GDPR I would look for but it doesn't specifically mention GDPR.

 

I'm set to decline this request, unless I've missed something...

[foofighterjim]

I had seen that but dismissed it because that is desmos.org and the site is run from desmos.com, I thought they were two separate platforms.

 

Edit: actually, is this right? Nowhere on that link does it specify that the GDPR statement relates to desmos.com?

Edited January 11, 2021 by foofighterjim

[Primus]

From a cursory look desmos.org and desmos.com are not the same thing at all.

[6Foot2]

From a cursory look desmos.org and desmos.com are not the same thing at all.

 

It seems so. I searched expecting my results to correctly show what I had expected. I have removed my misleading reply.

[6Foot2]

I have searched again, more carefully this time.

 

I now have this result:

 

Link: Desmos.com - Delete Your Account or Get a Copy of Your Personal Data [YourDigitalRight.org]

 

 

I hope this is more useful than my last reply.

[GrumbleDook]

The problem with some US-based companies is that unless there is a significant foothold in the UK and EU, they won't bother with the relevant information unless pushed and pushed.

 

If you look at the Student data section they talk about sharing with third parties ... and that is because this is the term used by FTC and contract laws ... but if you read some statements such as

"Desmos only shares Student Data in a few limited circumstances, as described below.

 

We may share Student Data in the following ways:

 

As needed to perform the Desmos Services and/or at the direction of a School and as authorized by our contract with the School. For example, information including Student Data, will be shared between and among authorized School users, such as teachers and administrators.Schools may also be able to facilitate data sharing with other authorized third parties. This sharing will depend on the settings and functionality selected by the School.

With our trusted vendors, third party service providers and other individuals who perform services on our behalf, but only if such providers have a need to access such information for the purpose of carrying out their work for us and do so under strict confidentiality and data security terms.

We may share aggregate or anonymized data (including personal data that has been stripped of personally identifying characteristics) with third parties, but will do so only in such a way that no individual may reasonably be identified.

We may be required to share information with law enforcement or other third parties when compelled to do so by court order or other legal process, to comply with statutes or regulations, to enforce our Terms of Use, or if we believe in good faith that the disclosure is necessary to protect the rights, property or personal safety of our visitors.

In the event of a change of control: If we sell, divest or transfer the business or a portion of our business, we will not transfer Student personal information without first giving you the ability to opt-out of the transfer by deleting your account, unless the new owner intends to maintain and provide the Service as a going concern, and provided that the new owner has agreed to data privacy standards no less stringent than our own. We may also transfer personal information – under the same conditions – in the course of mergers, acquisitions, bankruptcies, dissolutions, reorganizations, liquidations, similar transactions or proceedings involving all or a portion of our business"

 

They are basically saying that they use sub-processors.

You can email them as ask them to clarify if the use of the term 'third parties' in this section is the equivalent of saying 'sub-processor' within GDPR. Explain that GDPR has a very specific definition of what a 'third party' is, so you just want to clarify that these are really just sub-processors.

Ask them to complete the security RFI that is on the Education Data Matters website.

 

Don't just look at the docs alone, if you have a concern. Talk to them ... most are happy to change and update things if it make them more friendly to more customers in the UK.

[foofighterjim]

Thanks both.

 

I'll get onto them via email too then, like you pointed out, some terminology seems to be a little off but yet they mention GDPR when it comes to deleting an account. Obviously, if they can just clarify in their Privacy policy then there is no grey area.

 

Out of interest @GrumbleDook do we now need them to explicitly specify UK GDPR? Or are we still covered by the European agreement as we (to my knowledge) haven't made any changes yet.

[foofighterjim]

So, I emailed Desmos yesterday and got a reply this afternoon (not bad).

 

They basically said that they have tried to be GDPR compliant but can't fully certify. The advice was to sign the students up using parental email addresses. So that will be a no to using Desmos then!

[GrumbleDook]

So, I emailed Desmos yesterday and got a reply this afternoon (not bad).

 

They basically said that they have tried to be GDPR compliant but can't fully certify. The advice was to sign the students up using parental email addresses. So that will be a no to using Desmos then!

 

 

Seriously?

[foofighterjim]

 

Seriously?

 

Seriously.

 

Although they did for some reason think I was in the Netherlands. However, in terms of GDPR that makes little difference.

[GrumbleDook]

PM me your contact there ... I'm open to work and so will approach them. Even if I can't help, I know a lot of others who can!

[foofighterjim]

PM Sent

[Meldrew]

Had this from a teacher wanting to use this:

"I have been on twitter as lots of schools in the UK use this package (and lots of big national organisations also promote its use) to question this and their response is it is GDPR compliant? ...I cannot believe the other organisations would be using it if it wasn’t ?"

[strawberry]

.I cannot believe the other organisations would be using it if it wasn’t ?"

 

From the profession that flocked to sparklebox after the negative publicity, also the profession that bring you a CD and ask you to install it for everyone.

[foofighterjim]

I know @GrumbleDook is looking at this in general. However, you never know, if you get in touch with them, you may get a different answer to what I had.

[AndyCrow]

Any new service should have a DP Impact Assessment conducted before it is installed. In this instance the process will flag that the product isnt GDPR compliant.

Your DPO will then make their comments on the suitability of the product.

At this point the decision to use it or not should be with the Governors. If they decide it is worth the risk then it's their decision and any repercussions will rest with them.

[noeltitheradge]

Very interesting thread

[Max_Power]

Coming across more and more privacy statements of this type where COPPA and FERPA are both expanded upon extensively but then GDPR is either non existent or vaguely mentioned. Most are American companies which is understandable, but I am seeing more and more EU based companies too.

 

Latest one is the GeoGebra online apps. https://www.geogebra.org/privacy

 

Is very confusing. Do we have to abide by COPPA and FERPA, e.g. users under 13 need written parental consent or do we purely risk asses from a GDPR perspective?

 

GeoGebra are based in Austria which is even more odd they push the COPPA and FERPA as opposed to GDPR.

 

Ideally we want to be able to allow students to login to GeoGebra with their 365 account in order to save the graphs etc they are making.

[AndyCrow]

This is a very good example of why a DPIA should be completed.

Whilst the company stresses that they comply with COPPA and FERPA, which indicates they are trying to maintain good practices, they need to comply with GDPR for UK and EU data subjects.

 

Their Privacy Notice is not compliant with GDPR and provides insufficient details. The school should ask the company for their Data Processing Agreement with the Terms and Conditions as part of the DPIA process. These will need to be assessed.

 

The fact that they are selling their service into the EU and dont seem to have offices here means that they need an EU Representative and they have chosen someone in Austria for that purpose.

 

Going back to my previous point. Once the DPIA is completed and reviewed by the DPO, the Governors should make a risk based decision as to whether you should use the product or look for a similar product.