Google consent has been refused by parent (primary school)

[TwistedHelixis]

We have just had a parent refuse consent for their child to access Google Classroom or any Google core services.

 

This could cause a few problems :-(

 

What if the parents don't want us using SIMS or another main product?

 

Do we just need to find alternative provisions for this one pupil?

[Boredguy]

Unless I'm mistaken, the requirement for you to store their educational record in your MIS (regardless of product) is not something that parents can refuse due to it being part of the duty of care.

Refusing consent for G-Suite applications is certainly a new one, as I assume that it's one of your Core IT provisions, the same way as Office 365 is for us.

[TwistedHelixis]

Unless I'm mistaken, the requirement for you to store their educational record in your MIS (regardless of product) is not something that parents can refuse due to it being part of the duty of care.

Refusing consent for G-Suite applications is certainly a new one, as I assume that it's one of your Core IT provisions, the same way as Office 365 is for us.

 

So are you saying as its our core IT provision they cant actually refuse?

[Meldrew]

We have just had a parent refuse consent for their child to access Google Classroom or any Google core services.

 

 

Are you saying you routinely ask parents consent for using Google, or have they just written in saying they don't want their child using it?

 

 

Meldrew

[IrritableTech]

So are you saying as its our core IT provision they cant actually refuse?

 

You need to look at the lawful basis on which you can process the data - consent is just one of them.

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

 

You are required to educate this child and if you're happy that the google suite is an important part of delivering that requirement you may feel you can use an alternative legal basis.

[TwistedHelixis]

Are you saying you routinely ask parents consent for using Google, or have they just written in saying they don't want their child using it?

 

We are actually in the middle of rolling this out for the pupils at this school and havent sent out any consent forms yet. We are just setting up the accounts and testing Classroom.

 

Google say we should send consent forms for pupils under 13.

[DavR]

We don't rely on consent for anything beyond the photo consents.

 

G Suite goes into our privacy policy with everything else.

[TwistedHelixis]

So if we just put something on our website saying we use Google blar blar that should be good

[IrritableTech]

So if we just put something on our website saying we use Google blar blar that should be good

 

Not really.

Before you uploaded any data subject names to Google to create the accounts you mentioned you should have completed a DPIA. This process would identify why you want to use the Google services, what information you intend to share, what benefit it has to your users or organization as well as any thoughts on risk and ways of reducing that. Through that process you should identify what permissions are needed or which basis you intend to use to hand the data over to a third party.

 

Then if a concerned party approaches you with questions, or you have a breach you can produce your impact assessment. It may be proved wrong and you may have to adjust it later, but you can prove beyond doubt that you considered data protection before sharing data.

Edited May 17, 2021 by IrritableTech

[DavR]

We have a section in our privacy notices detailing who we share information with, and Google are one of the third parties listed in there. Privacy Notice for students is on our website, and is given to all new starters.

 

Ultimately, consent is only one of the legal bases for processing and sharing data, you can rely on a different one for these tasks. Other will know better, but I think you can use "necessary for the performance of a task carried out in the public interest" to cover yourself for this, as it's necessary for their education.

[paulkerton]

We have just had a parent refuse consent for their child to access Google Classroom or any Google core services.

 

This could cause a few problems :-(

 

What if the parents don't want us using SIMS or another main product?

 

Do we just need to find alternative provisions for this one pupil?

 

You don't need to ask for consent on anything that is considered business critical.

If you've got something (like SIMS, or your computing platform) that would break your ability to deliver your core working, then you can put the position of "its non-negotiable" in place, basically.

You still need to have everything in place as if you would be asking consent though.

 

Google say we should send consent forms for pupils under 13.

 

That's a complicated mess created by the COPPA law, and Google being ultra-cautious about it. I get why Google want it in place, but Google can be a little idealist about how schools operate and work.

Edited May 17, 2021 by paulkerton

[dmason2]

maybe a letter from the head indicating the fall back of not having the form signed may change the parent's mind. not being able to have IT lessons through not having the permission - knock on being student is behind on IT skills

[hardtailstar]

Only one of our students has denied consent for Google.

 

As far as I am aware she gets all the homework on paper or emailed to parent.

[DrCheese]

If you're not asking for consent on this & can cover it with another legal basis, then the end user has no right to withdraw consent for it - Else where would it end? You'd have people pull consent from all sorts of things & make running a school impossible. What if they don't like any alternative except some obscure one they like?

[paulkerton]

*BING BONG*

Mr @GrumbleDook - can @GrumbleDook please come to the thread please. Thank you.

*BING BONG*

[GrumbleDook]

Oh sweet $deity, where to start.

 

1 - Google Classroom is part of the core suite of Google Workspace for Education Fundamentals (https://edu.google.com/products/workspace-for-education/education-fundamentals/) and as such, they operate as your data processor. No data is taken or used by Google for their own purposes for the core suite.

2 - Ensuring the well-being and safety of your staff and children, the delivery of the educational curriculum, and the strategic and operational elements of the school form the core activities of your school. These are generally covered under public task, though other lawful bases could also comply.

3 - Consent for where data is processed as part of your core activities is generally not appropriate. Consent can be withdrawn and if that means the data subject is negatively affected, then the data controller has an imbalance of power, and consent should not have been used.

4 - When you are working with a data processor, they are exactly that ... a data processor, operating under your agreed instructions (that is why it is a Data Processing Agreement), and so Google, in the case of the school's core activities, is *not* a third party. A third party, although often used because it is a term within contract law, has a very specific definition within GDPR. It means someone who is not the Data Subject, Data Controller, Data Processor or a sub-processor. Effectively, they are a separate Data Controller who can also use the data for their own purposes. Please remember that this is the core services we are talking about (hosted in Ireland, not the US). Your Privacy Notice should not state that they are a third party (nor any other data processor or sub-processor) otherwise you can get people thinking you are handing the data here, there and everywhere!

5 - Google has a raft of additional services. If you select these as being available for your data subjects, then Google are also a Data Controller in their own right. For these, you do need Consent. The additional services are not turned on by default and this is because Google knows that they should not be. If you, as a school, turn them on ... then it is your responsibility to sort consent and notify parents/children that there data is being shared with Google for Google's own purposes ... and link to information from Google too.

 

The above applies to Microsoft and their partners, and a host of others too. If the data is only used at your instruction, then why are you asking for consent?

 

There will be times it is relevant (pictures on websites, etc.) or a legal requirement (biometrics), but most schools should look at public task. It is even covered as such in the DfE guide on data protection.

 

Yes, I know a lot of educational tools talk about consent and 13, especially those US-based or delivering to the US. COPPA has a section that covers this and it is relevant to US schools, not UK. The requirement for consent is due to the way the it is worded and conversations with the FTC have shown that the only lawful basis available in the US under COPPA is Consent, and that is either provided by the user, their parents directly or via the school on behalf of the parents. Consent also has a slightly different meaning too, but not by much.

 

If you see a DPA that mentions COPPA as the basis of the agreement, tell them you need it framed within GDPR terms. You also need to get them state where any other organisation they work with is a sub-processor (operating under your instructions still) or a true third party (and taking the data to use themselves). The former is good, the latter is to be avoided except for in specific circumstances (some elements of research, etc.)

 

So, back the original problem.

 

If you are using a curriculum tool, and the data is only ever processed under your instruction, then do not use consent unless there is a specific requirement to do so (images, biometrics, etc.).

[GrumbleDook]

We have just had a parent refuse consent for their child to access Google Classroom or any Google core services.

 

This could cause a few problems :-(

 

What if the parents don't want us using SIMS or another main product?

 

Do we just need to find alternative provisions for this one pupil?

 

See my comments above, also have a long chat with your DPO. If your DPO needs any peer-review then I know many who can help. If you want a direct chat with me (or your DPO does) then let me know.

[TwistedHelixis]

@GrumbleDook

 

Many thanks for taking the time to explain this, I have just forwarded onto the school concerned.

[sigma]

Were I that parent, I would appreciate some engagement from the school to understand my issues. I would hope that the school would go through the details with me, reassure me that my child could block the camera, reassure me about who can access my child's work ,interactions ,what they will have access to within the space and about the school's deletion policy when they go up to high school. There's a chance that I might be able to provide consent on this basis. It is important to come to a workable solution that protects the interests of the child, the parent and the school and avoiding appearing to be high-handed.

 

It's not as though Google has not been caught out doing things that said they wouldn't oer the last few years, so it's not really suprising that there might be some hesitance.

 

(Bear in mind, that once data is extracted from SIMS to national databases, we do not actually know who has access to it or why).

 

As a parent, I denied the school permission to use my child's biomentric data for cashless catering. She was given a code. It worked well.

[DrCheese]

here's a chance that I might be able to provide consent on this basis. It is important to come to a workable solution that protects the interests of the child, the parent and the school and avoiding appearing to be high-handed.

 

This is why using consent for this is a bad idea. If a parent refuses to provide consent for every solution the school comes up with.. then what? Your then beholden to the parent for a "Workable solution" - What if you have a whole bunch of parents who pull consent, each with their own idea of a "Workable solution" - It quickly becomes unfeasible.

 

Example:- You have students whose parents have opted out of Google. So you decide to use Office365... except you also have students who have opted out of that. Another solution? Well you have a parent who's only "workable solution" is some random OSS software.

How can teachers even begin to start with that? Duplicate training/work across systems?

 

It's not about being heavy-handed, it's about being able to provide a cost effective service (i.e Education of students) - If the GDPR allows them to use another legal basis that avoids parents having an opt-out then they should use that.

 

 

As a parent, I denied the school permission to use my child's biomentric data for cashless catering. She was given a code. It worked well.

Biometric data is covered under a separate law from 2012 (Protection of Freedoms Act 2012) which explicitly states schools have to ask consent for biometric data to be stored (Which is why you'd have been asked)

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/692116/Protection_of_Biometric_Information.pdf

[bald_pig]

As a parent, I denied the school permission to use my child's biomentric data for cashless catering. She was given a code. It worked well.

 

I'm curious, why would you deny that?

[synaesthesia]

Were I that parent, I would appreciate some engagement from the school to understand my issues. I would hope that the school would go through the details with me, reassure me that my child could block the camera, reassure me about who can access my child's work ,interactions ,what they will have access to within the space and about the school's deletion policy when they go up to high school. There's a chance that I might be able to provide consent on this basis. It is important to come to a workable solution that protects the interests of the child, the parent and the school and avoiding appearing to be high-handed.

 

It's not as though Google has not been caught out doing things that said they wouldn't oer the last few years, so it's not really suprising that there might be some hesitance.

 

(Bear in mind, that once data is extracted from SIMS to national databases, we do not actually know who has access to it or why).

 

As a parent, I denied the school permission to use my child's biomentric data for cashless catering. She was given a code. It worked well.

 

This is something I can't stress enough. Communication is absolutely key to a successful and understanding relationship

Perhaps the difference between "consent" and "informed consent" needs making clearer.

[sigma]

Since you can't change a fingerprint, you don't give it out unless it's essential. Since there was an alternative, it wasn't essential.

[DrCheese]

This is something I can't stress enough. Communication is absolutely key to a successful and understanding relationship

Perhaps the difference between "consent" and "informed consent" needs making clearer.

 

I agree, but schools can & should put their foot down sometimes. If a parent doesn't like a solution you've chosen after doing all your due diligence & you don't need to ask for their consent, at the end of the day there's no need to entertain them further - They have no legal rights to block the school - (I'm very much of the mantra that if they don't like it, they're free to complain to the ICO (Who would probably back you) or transfer schools!)

Edited May 20, 2021 by DrCheese

[bald_pig]

Since you can't change a fingerprint, you don't give it out unless it's essential. Since there was an alternative, it wasn't essential.

 

You aren't giving out a fingerprint, you're giving out an algorithmic representation of it based on whatever method the system uses. It's not like someone can come along and rebuild your fingerprint from the data stored in a database.

 

Furthermore, fingerprints can be recovered from most surfaces quite trivially, and I doubt you are removing your fingerprints from every surface you have ever touched?