Google consent has been refused by parent (primary school)

[paulkerton]

This is something I can't stress enough. Communication is absolutely key to a successful and understanding relationship

 

I'd agree, but comments like

 

It's not as though Google has not been caught out doing things that said they wouldn't oer the last few years, so it's not really suprising that there might be some hesitance.

 

Are unhelpful and factually incorrect.

After all: https://www.forbes.com/sites/daveywinder/2020/01/22/microsoft-security-shocker-as-250-million-customer-records-exposed-online/?sh=fb830064d1b3

[synaesthesia]

This is what I mean - people may not know the implications or reasons for the school's decisions and the schools should be willing and able to provide information to help them make up their minds. Obviously where the OP is concerned there is a legitimate operational reason and consent isn't required, but for biometrics it's far from that clear cut. However that is veering off topic and back into the joys of GDPR and personal data consent.

[blueday]

So what happens if a school has gone ahead and asked for consent for all sorts of things they didn't need to - the ICO say that once you have used consent as the lawful basis you can't usually change it to a different lawful basis?

[GrumbleDook]

You aren't giving out a fingerprint, you're giving out an algorithmic representation of it based on whatever method the system uses. It's not like someone can come along and rebuild your fingerprint from the data stored in a database.

 

Furthermore, fingerprints can be recovered from most surfaces quite trivially, and I doubt you are removing your fingerprints from every surface you have ever touched?

 

There is an issue about the normalisation of surveillance that predominantly occurs because of lack of correct assessment of risk and lack of communication.

 

There are also issues around schools making life difficult for families that don’t agree with it.

 

If someone doesn’t want biometrics used, then fine … that is what the law says.

[GrumbleDook]

This is something I can't stress enough. Communication is absolutely key to a successful and understanding relationship

Perhaps the difference between "consent" and "informed consent" needs making clearer.

 

In the issue we are discussing ‘informed consent’ is not a relevant term. That one is to do with medical scenarios about treatment and not covered under data protection law (though it is closely linked to explicit consent for article 9 … processing of special category personal data).

 

In this case, if you are not following the transparency principle when looking to gain consent it is a flawed request anyway.

[GrumbleDook]

So what happens if a school has gone ahead and asked for consent for all sorts of things they didn't need to - the ICO say that once you have used consent as the lawful basis you can't usually change it to a different lawful basis?

 

This is a fair point.

 

However, if after a review it has been noted that it is not the most appropriate lawful basis, you can start a DPIA as if you were starting afresh and look at the best option, engage with stakeholders, ensure all risks where covered and make sure it was transparent.

 

You can’t just decide to change the lawful basis and not tell anyone or not change any safeguards you have in place.

[GrumbleDook]

I agree, but schools can & should put their foot down sometimes. If a parent doesn't like a solution you've chosen after doing all your due diligence & you don't need to ask for their consent, at the end of the day there's no need to entertain them further - They have no legal rights to block the school - (I'm very much of the mantra that if they don't like it, they're free to complain to the ICO (Who would probably back you) or transfer schools!)

 

The right to object is absolute, however the object does not have to be upheld, but we should remember that it is a right.

 

You may legally be allowed to do something but if half your parents are complaining then something is not right. Remember that data protection legislation has its origins in human rights, not corporate law.

[synaesthesia]

In the issue we are discussing ‘informed consent’ is not a relevant term. That one is to do with medical scenarios about treatment and not covered under data protection law (though it is closely linked to explicit consent for article 9 … processing of special category personal data).

 

In this case, if you are not following the transparency principle when looking to gain consent it is a flawed request anyway.

 

Apologies, I didn't mean it in that context - I was vaguely aware of "informed consent" but wasn't aware it's a specific principal So yes, the transparency principle is what I was referring to and why communication is key - all this information should be available immediately and conveniently at the time of asking for that consent. Informed consent seemed like a good way of putting it!

[enjay]

As far as I am aware she gets all the homework on paper or emailed to parent.

 

But Google Classroom is so much more than a homework planner. What if the homework is to work collaboratively with other students on something? Must those students also use paper? Must the teacher mark hand-written work and store it separately for that one student because they have submitted it differently?

 

Also, what if they refuse to use Activelearn? Must the school buy a print text book for that one child? How about if they refuse GCSE Pod or MyMaths which doesn't have even a clunky workaround for omission?

[enjay]

Were I that parent, I would appreciate some engagement from the school to understand my issues. I would hope that the school would go through the details with me, reassure me that my child could block the camera, reassure me about who can access my child's work ,interactions ,what they will have access to within the space and about the school's deletion policy when they go up to high school. There's a chance that I might be able to provide consent on this basis. It is important to come to a workable solution that protects the interests of the child, the parent and the school and avoiding appearing to be high-handed.

 

I agree. Ultimately the school doesn't need parental consent and can just set up the Google account regardless, however it is definitely worth engaging with them to explain the benefits and hopefully win support. If the parent still isn't happy, then tough luck the school is doing it anyway but always nicer not to have to take that line, especially as at some point in the future the school might want parental support on something else, a discipline matter with their child for example, and that would be easier if parent and school were "friends".

[enjay]

5 - Google has a raft of additional services. If you select these as being available for your data subjects, then Google are also a Data Controller in their own right. For these, you do need Consent. The additional services are not turned on by default and this is because Google knows that they should not be. If you, as a school, turn them on ... then it is your responsibility to sort consent and notify parents/children that there data is being shared with Google for Google's own purposes ... and link to information from Google too.

 

Can you expand on that one, @GrumbleDook If we don't need consent for say Classroom, why do we need consent for other Google services which are integral to our curriculum delivery? Which additional services require consenting?

[GrumbleDook]

Can you expand on that one, @GrumbleDook If we don't need consent for say Classroom, why do we need consent for other Google services which are integral to our curriculum delivery? Which additional services require consenting?

 

Google Workspace for education has a list of core services. For these, Google has previously confirmed that the data and any personal data is kept in the EEA (in Ireland) and not part of the blob sent to the US as per other Google and Google Workspace accounts. Google has also said that for these, Google remains a data processor as the school is the DC, and Google only processes for the purposes set out by the school. I'm sure the Google Edu members on here can dig out the relevant links.

 

For the additional services, Google says that for some elements of these, they are also a data controller in their own right. They will take this data to the US and they will use it for things like targeting ads. These additional services are turned off by default from everything I have been shown and told so far, but this may not have always been the case. If you are using any of these additional services then yes, you are going to need consent, and you will need a backup plan if you don't get it. https://support.google.com/a/answer/6356441?hl=en is one of the support items I would suggest folk look at.

 

As I understand it, but I have yet to had a cast-iron guarantee from Google Edu, turning off additional services for an account does not block it, only stops that account from being used for it. So you will get whatever messages you get when you go to a Google service without signing in.

 

I'll be honest with you, I've been tempted to pull the exact same trick with the school that one of my children goes to. I have annotated the forms they send to us about consent and hit a brick wall at times as the priority is education (understandably so). There is a large chunk of politics around this and I would be remiss not to say that schools are still missing out on a lot of information that they need, there are minimal discussions between DfE and ICO, and the larger emphasis is on CyberSec with schools (for obvious reasons). That doesn't mean that you can be informed and prepared for when parents rightfully ask questions and take your schools to task.

 

I know the Google Edu team work their socks off to get things right ... but their emphasis is also on education too. And yes, Microsoft has their own issues.

[chazzy2501]

if this were me (I don't use google) but I'd ask the parent if they were ok making a pseudo pupil and have their child use that with the google services.

[GrumbleDook]

if this were me (I don't use google) but I'd ask the parent if they were ok making a pseudo pupil and have their child use that with the google services.

 

The problem is that it will still contain data the pupil was generating, including the class, activities, etc. The name may be different, but it is still the same pupil. This would not sort out the consent issue.

[chazzy2501]

That's why I would involve the parent with the solution. They may not be entirely inflexible, ask them if they're ok with the compromise or if they have a solution to the issue. if they're adamant then the problem moves to the teachers and management.

[Primus]

That's why I would involve the parent with the solution. They may not be entirely inflexible, ask them if they're ok with the compromise or if they have a solution to the issue. if they're adamant then the problem moves to the teachers and management.

 

You'll tie yourself up in knots with solutions like this, engaging with the parent is the right thing to do but creating unique solutions for individual students is not. The school uses Google Workspace for Education, it is an embedded part of the school, students need to use it as part of their day to day lessons.

[enjay]

You'll tie yourself up in knots with solutions like this, engaging with the parent is the right thing to do but creating unique solutions for individual students is not. The school uses Google Workspace for Education, it is an embedded part of the school, students need to use it as part of their day to day lessons.

 

100%. Your objective in the parent discussion is not to find a compromise with which the parent is happy, your objective is to bring the parent around to agreeing with what you're going to do anyway.

[enjay]

Google Workspace for education has a list of core services. For these, Google has previously confirmed that the data and any personal data is kept in the EEA (in Ireland) and not part of the blob sent to the US as per other Google and Google Workspace accounts. Google has also said that for these, Google remains a data processor as the school is the DC, and Google only processes for the purposes set out by the school. I'm sure the Google Edu members on here can dig out the relevant links.

 

For the additional services, Google says that for some elements of these, they are also a data controller in their own right. They will take this data to the US and they will use it for things like targeting ads. These additional services are turned off by default from everything I have been shown and told so far, but this may not have always been the case. If you are using any of these additional services then yes, you are going to need consent, and you will need a backup plan if you don't get it.

 

Okay, so I get the difference between the services, but not why consent is required for one and not the other. If we use Youtube, Google Maps or whatever additional service as part of our curriculum delivery, why does the public task exemption not still apply?

[mthomas08]

Okay, so I get the difference between the services, but not why consent is required for one and not the other. If we use Youtube, Google Maps or whatever additional service as part of our curriculum delivery, why does the public task exemption not still apply?

 

Sounds like your school needs some GDPR training

 

One key factor is the level of personal data. A photo or biometric is considered to be a very high level/sensitivity. A first name is practically almost nothing - after all.. knowing my name is Dave doesn't narrow down who I am.. yet a photo would... or my full name and address and medical information...

 

What would happen if a parent made a SAR - subject access request?

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

I would recommend on giving the ICO website a very good read - its got a ton of information.

 

Some schools have access to legal teams and are very good at dealing with questions on GDPR - our legal team have been great on the finer details but our DPO has been fully trained on GDPR.

[enjay]

One key factor is the level of personal data. A photo or biometric is considered to be a very high level/sensitivity. A first name is practically almost nothing - after all.. knowing my name is Dave doesn't narrow down who I am.. yet a photo would... or my full name and address and medical information...

 

I am well aware of the difference between my name and my medical history, thanks. What I'm less clear on is the difference between Google Classroom and Google Maps, and why one requires consent and the other not.

[Jawloms]

I am well aware of the difference between my name and my medical history, thanks. What I'm less clear on is the difference between Google Classroom and Google Maps, and why one requires consent and the other not.

 

I assume (but am not 100%) that it is basically because Google have said they'll behave with any data on Classroom, but maps etc. data could be passed around various places and processed for ads and stuff.

[enjay]

I assume (but am not 100%) that it is basically because Google have said they'll behave with any data on Classroom, but maps etc. data could be passed around various places and processed for ads and stuff.

 

Which is a "risk" the school can decide upon, no? Do a DPIA on it, satisfy yourself any shared data will be anonymised then allow the students to use it as part of T&L, without consent because of the public task exemption, just like we do any other online resource. What am I not seeing here?

[bald_pig]

Which is a "risk" the school can decide upon, no? Do a DPIA on it, satisfy yourself any shared data will be anonymised then allow the students to use it as part of T&L, without consent because of the public task exemption, just like we do any other online resource. What am I not seeing here?

 

Because it's possible to use maps without an account, and an account is not necessary for T&L

[enjay]

Because it's possible to use maps without an account, and an account is not necessary for T&L

 

So if they have an account anyway, are we meant to ask them to log out before using Maps?

[paulkerton]

So if they have an account anyway, are we meant to ask them to log out before using Maps?

No, you can switch off access, so if they're signed in with their account it will say "Google Maps is not available for this account".