Google consent has been refused by parent (primary school)

[enjay]

Because it's possible to use maps without an account, and an account is not necessary for T&L

 

Okay, that's Maps. Cloud Print is also an additional service, that does require an account and may well be necessary for T&L (certainly will be in any BYOD environment) (and yes, I know Cloud Print is being withdrawn, but you get my point anyway).

[enjay]

No, you can switch off access, so if they're signed in with their account it will say "Google Maps is not available for this account".

 

Which would require them to sign OUT of their account in order to use Maps, then have to sign back in again to write a Google Doc about whatever they were doing in Maps.

[paulkerton]

Which would require them to sign OUT of their account in order to use Maps, then have to sign back in again to write a Google Doc about whatever they were doing in Maps.

Hey, I'd just try and get the consent for it myself. Problem solved.

[enjay]

Hey, I'd just try and get the consent for it myself. Problem solved.

 

Problem solved, until someone declines.

[localzuk]

Which is a "risk" the school can decide upon, no? Do a DPIA on it, satisfy yourself any shared data will be anonymised then allow the students to use it as part of T&L, without consent because of the public task exemption, just like we do any other online resource. What am I not seeing here?

Because it isn't about your use of the data for T&L. You wouldn't need consent for your own use. You need consent to let Google use it for their own use, as a data controller and not a data processor.

 

Think of the non-core services as services that gather data for advertising, profiling and research. None of those things are anything to do with you as a school, so you giving the third party that data for those purposes has no legitimate reason under public task justification. That's why it needs consent.

 

Google don't allow you to pick and choose how the data is processed for those non-core apps, therefore you have to treat them as a separate data controller for all use.

[paulkerton]

Problem solved, until someone declines.

Here are the differences: https://support.google.com/a/answer/6356441

Here is what Google suggest in regards to parent communication: https://support.google.com/a/answer/6356509?hl=en

Here are the Additional Product Terms and Conditions : https://workspace.google.com/intl/en/terms/additional_services.html

 

Ulimately, this isn't a job for ICT, this is a job for your Data Protection Officer. If Google Maps is a hurdle people can't overcome when it comes to getting permissions, then maybe Digimaps for Schools is your answer?

[enjay]

Think of the non-core services as services that gather data for advertising, profiling and research. None of those things are anything to do with you as a school, so you giving the third party that data for those purposes has no legitimate reason under public task justification. That's why it needs consent.

 

Okay, that makes sense. Thanks.

 

Fortunately the only additional service we've got enabled is Cloud Print, and as I don't think we ever used that and it has been deprecated now, I think we're okay.

[markberry]

Definitely shouldn't be using consent for this or any other teaching tools. It should be stated in your privacy notice that you use their information for 'supporting pupil learning' and 'to monitor and report on pupil attainment progress' which covers online teaching tools and this is done under the legal basis of public interest (i.e. provision of education etc).

 

The only things you should be seeking consent for are any times you want to use personal data for things unrelated to the provision of education, such as in marketing materials, newspaper articles etc.

[GrumbleDook]

Okay, so I get the difference between the services, but not why consent is required for one and not the other. If we use Youtube, Google Maps or whatever additional service as part of our curriculum delivery, why does the public task exemption not still apply?

 

Coming back to this (and thanks to the several folks who prodded), I think there is something that does need to be explained a bit more, about the reuse of data by EdTech/Tech companies and possible issues around it. This could be a looooong session and whilst I know I have covered some bits before I think it might be best to run a webinar on it. Would that be something people are interested in?