ESS SIMS 3 Year Contracts

[GrumbleDook]

Just had this statement from our outsourced DPO. They specialise in DPO services in schools.

 

"As a very short summary, you should refuse to sign any contract change unless you consider the procurement requirements of the DfE and conduct an impact assessment with your DPO as dictated by 70(1) of the DPA 2018.

$ at this stage does not consider ESS in the claimed form to meet the obligations of a compliant Processor"

 

So now there is a DPA angle too.

My outsourced DPO is happy for me to share their name, but to avoid any risk of advertising, I've not mentioned them here, but I can respond to PMs.

 

The issue is that for most schools, ESS is not a processor but a supplier of software that allows *the school* to process data. They could be deemed not to provide you software that allows you to meet your requirements under UK GDRP and DPA2018, but unless a full review of how your SIMS has been configured has been done, then that is a brave thing for a DPO to say. The purpose for you processing it has not changed, the technology has not changed, you are just arguing about the contract and any limitations it includes ... and that is a risk thing for the school to judge (hence the DPIA).

 

It might be that this is a short-hand way of saying a whole bunch of things about risk, future plans of the school(s), guidance from DfE, and so on ... but saying they don't meet the obligations of a compliant Processor ... feel free to pass on my details to them or to say hello at the IRMS conference tomorrow.

[PrimaryNetMan]

Regarding 1 year renewals, perhaps if you get one you have to sign a non-disclosure agreement with the penalty of word getting out being a 10 year renewal and monthly census submissions?

 

of course I cannot possibly comment on whether or not I have signed any such thing....

 

No chance of monthly census submissions. They wouldn't be able to keep up with all the revised filesets each month!

[synaesthesia]

The issue is that for most schools, ESS is not a processor but a supplier of software that allows *the school* to process data. They could be deemed not to provide you software that allows you to meet your requirements under UK GDRP and DPA2018, but unless a full review of how your SIMS has been configured has been done, then that is a brave thing for a DPO to say. The purpose for you processing it has not changed, the technology has not changed, you are just arguing about the contract and any limitations it includes ... and that is a risk thing for the school to judge (hence the DPIA).

 

It might be that this is a short-hand way of saying a whole bunch of things about risk, future plans of the school(s), guidance from DfE, and so on ... but saying they don't meet the obligations of a compliant Processor ... feel free to pass on my details to them or to say hello at the IRMS conference tomorrow.

 

A good point raised here - indeed this feels like nothing short than a single DPO's opinion of whether this constitutes acceptable risk via said DPIA but is there any further context to it? As it stands, just a standard school hosted SIMS setup would surely make ESS a supplier and nothing more - certainly not a processor, but when "cloud hosted" surely that line moves towards the school being controller and ESS (or whatever 3rd party) being processor?

I'm new to the DPO role so don't shoot me if there's something obvious I've missed!

[Ditto]

The issue is that for most schools, ESS is not a processor but a supplier of software that allows *the school* to process data. They could be deemed not to provide you software that allows you to meet your requirements under UK GDRP and DPA2018, but unless a full review of how your SIMS has been configured has been done, then that is a brave thing for a DPO to say. The purpose for you processing it has not changed, the technology has not changed, you are just arguing about the contract and any limitations it includes ... and that is a risk thing for the school to judge (hence the DPIA).

 

It might be that this is a short-hand way of saying a whole bunch of things about risk, future plans of the school(s), guidance from DfE, and so on ... but saying they don't meet the obligations of a compliant Processor ... feel free to pass on my details to them or to say hello at the IRMS conference tomorrow.

An interesting point about software on your own kit versus alternatives, but not to let this aspect drift the thread, I've spun off a separate one at http://www.edugeek.net/forums/data-protection-information-handling/225150-dpa-2018-gdpr-processors-local-vs-hosted-vs-cloud.html

 

Re section 70(1), What I see the wording say is:

 

Section 70(1):

 

Position of data protection officer

The controller must ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.

I know the our DPO is working on the basis that this is a 'material' change of your contract, agreeing with James Weatherilll statement in his Arbor blog and that triggers the ned for an DPIA. Yet, I acknowledge that is one (or two) opinions and there are others. Our DPO has highlighted that the 'timely manner' isn't achieved in this instance and that's the main thrust of the objection. They have plenty more though. I do fully understand the point though about being a 'compliant processor'. I would be fascinating to listen in to a discussion on the whole ESS 3 year contract saga with a number of DPO's.

 

I shall pass on your details. It's likely your paths have entwined given the common ground, but I suspect the IRMS opportunity has been missed.

Edited November 28, 2021 by Ditto

[Ditto]

A good point raised here - indeed this feels like nothing short than a single DPO's opinion of whether this constitutes acceptable risk via said DPIA but is there any further context to it? As it stands, just a standard school hosted SIMS setup would surely make ESS a supplier and nothing more - certainly not a processor, but when "cloud hosted" surely that line moves towards the school being controller and ESS (or whatever 3rd party) being processor?

I'm new to the DPO role so don't shoot me if there's something obvious I've missed!

I'm not a DPO, but it has been suggested a Data Protection Manager (DPM) that has an out-sourced DPO to call upon. The one thing I have learnt, is that whilst there are some black and white matters, a lot is grey and risk based. In our roles we may call upon many single opinions and then make a decision having reviewed the whole. I entirely agree about the point comparing internal run systems versus cloud based and as you'll see, I've spun off another thread for that aspect.

[GrumbleDook]

The material change in contract is one relevant to contract law, not to data protection law. If there was no initial complaint about the software provider no longer being Capita, they are on shaky ground to claim DP law as the issue.

There is a change of risk. But I’ll feed my other comments into the other thread

[Andycat]

Everyone is in the same boat I know, but our SLT don't want to change. Last year of the Principal, Exams Officer and Office Manager. Priority to them is catch up learning, and safety of staff and pupils.

 

Our costs over 3 years place us needing a tender or framework even by our own financial procedures let alone anyone else's! I'm sure many of you are in the same boat, ie your school/academy wants to stay with SIMS, regardless of your own technical opinion!!

 

How are you going about it?

[supportman]

Everyone is in the same boat I know, but our SLT don't want to change. Last year of the Principal, Exams Officer and Office Manager. Priority to them is catch up learning, and safety of staff and pupils.

 

Our costs over 3 years place us needing a tender or framework even by our own financial procedures let alone anyone else's! I'm sure many of you are in the same boat, ie your school/academy wants to stay with SIMS, regardless of your own technical opinion!!

 

How are you going about it?

 

Get SLT into the demos with 3 companies including Sims, they will soon changed their minds when they see the features of other cloud MIS's.

[Andycat]

We had Bromcom and Arbor in just pre covid, and they were dismissed by SLT at the time!

[paulkerton]

We had Bromcom and Arbor in just pre covid, and they were dismissed by SLT at the time!

What were their grounds for that, out of interest?

[Andycat]

What were their grounds for that, out of interest?

 

At the time, promise of SIMS 8(!!) but actually, all more expensive too.

[paulkerton]

At the time, promise of SIMS 8(!!) but actually, all more expensive too.

The promise of SIMS 8?? Is there any chance you could give me their numbers, as I know this Nigerian Prince who has millions of dollars he needs to stash away in other people's bank accounts!!

 

I absolutely refuse to believe either Bromcom or Arbor is more expensive.

Were they counting hosting/server costs, SQL costs, support and backup costs too - or just purchasing the SIMS licensing?

[Andycat]

The promise of SIMS 8?? Is there any chance you could give me their numbers, as I know this Nigerian Prince who has millions of dollars he needs to stash away in other people's bank accounts!!

 

I absolutely refuse to believe either Bromcom or Arbor is more expensive.

Were they counting hosting/server costs, SQL costs, support and backup costs too - or just purchasing the SIMS licensing?

 

This was over 2 years ago, so no doubt a lot has changed. I know they factored in cover costs for training. And the fact we'd gone SIMS-Facility CMIS-Sims in an 8 year period because of BSF

[supportman]

Our move from Sims to Bromcom was essentially cost neutral.

 

We removed a lot of 3rd party services which made it even better over time.

 

Arbor even give you a spreadsheet to work out the cost difference with Sims. The cost savings were pretty plain to see if you looked at the whole system.

Edited November 29, 2021 by supportman

[LeMarchand]

I absolutely refuse to believe either Bromcom or Arbor is more expensive.

Were they counting hosting/server costs, SQL costs, support and backup costs too - or just purchasing the SIMS licensing?

 

Mine are all KS1/2 but Arbor was a lot cheaper even just counting the licensing.

[mthomas08]

Sorry to bump up this question but has anyone got an official response from the DFE?

 

So far, these websites claim they are aware of it.. but seem to be copy pasted responses stating the exact same thing.

[mavhc]

Speaking of remote SIMS access security, is this a joke? https://id.sims.co.uk/support/wiki/46/an-introduction-to-two-factor-authentication

 

Setup 2fa, but only require someone to guess a security question to override it.

 

That can't be compliant with any security audit

[localzuk]

Speaking of remote SIMS access security, is this a joke? https://id.sims.co.uk/support/wiki/46/an-introduction-to-two-factor-authentication

 

Setup 2fa, but only require someone to guess a security question to override it.

 

That can't be compliant with any security audit

That's what a lot of banks still do...

[DFerrans]

Slightly different to a lot of the posts here. As a school we are happy to Stay with SIMS as a product, to effectively choose to leave within 2 months is a tough ask for any large educational facility. Especially trying to convince staff that they are going to have to do everything differently.

 

I have been in contact briefly with the annual entitlement people and have requested the following information. In principle we are more than happy to sign up for 3 years, as this will give us time and the ability to see and look at other products without it being a kneejerk reaction. But we are already planning on removing the finance package after year 1. I'm trying to get confirmation that the price will reduce in Yr. 2 and Yr. 3 if we were to cancel a module. As yet they have not been able to answer this question. Which was asked over 7 days ago.

 

On the other hand though they have confirmed that modules would be allowed to be added through this time, but the price would increase.

 

We are looking to move away from FMS and possibly InTouch over the next 3 years, but just need confirmation from Annual entitlement that the price we are signing up now, will reduce in yr. 2 and 3 if the modules are cancelled.

 

If anyone has had success in negotiating this or has any clarification how a reduction in a module would affect the cost i would be interested in your comments.

[Damon]

I believe if your agreement is via an LA, you will have to keep paying for FMS as it's a package deal with the MIS.

[DavidYoung]

I'm trying to get confirmation that the price will reduce in Yr. 2 and Yr. 3 if we were to cancel a module. As yet they have not been able to answer this question. Which was asked over 7 days ago.

 

If anyone has had success in negotiating this or has any clarification how a reduction in a module would affect the cost i would be interested in your comments.

 

One of our schools got stung by a 3 year contract when they became an academy and had to re-licence. They signed a 3 year deal and wanted to remove a module after the first year but couldn't as it was under contract.

 

I would be surprised if anything were to change on that front.

[DFerrans]

I believe if your agreement is via an LA, you will have to keep paying for FMS as it's a package deal with the MIS.

 

Hopefully annual services will let me know what's covered with the 3 years, but i'm not sure they know yet either......

[DFerrans]

One of our schools got stung by a 3 year contract when they became an academy and had to re-licence. They signed a 3 year deal and wanted to remove a module after the first year but couldn't as it was under contract.

 

I would be surprised if anything were to change on that front.

 

Thanks for that, It will be a pain, but hopefully with everyone talking to them about it they may yet be able to come up with a renewal that helps everyone out.

[supportman]

Thanks for that, It will be a pain, but hopefully with everyone talking to them about it they may yet be able to come up with a renewal that helps everyone out.

 

Doubt it. They have been very clear so far that they want to lock schools into the product and services for a long time.

 

They know fully well lots of people are thinking about moving and are protecting their market in any way they can.

 

This is how private equity works sadly, the only thing the company now cares about is market value and revenue streams. The customer expereince doesnt matter so much, especially when you can tie your legacy customers in for 1000+ days.

Edited November 30, 2021 by supportman

[mthomas08]

Even if schools get locked in to the 3 year contract, record everything you are going through with ESS.

 

This information will be useful if/when you do your tender process. Customer experience and faith is an important part of the decision making - something I raised in Governor meetings.