PTA Accounts

[APMerry]

Does any one have email accounts for the PTA (Parent Teacher Association) on their school exchange?

 

I've got one, which is used by several members of the PTA, but I'm not comfortable with it being shared and therefore having not multi factor authentication. They also like setting up forwarding rules to forward specific mails to private email addresses of other members of the PTA.

 

Just wondered how others handle this kind of situation?

[RLR]

We got rid of our PTA accounts several years ago and they now have to use a consumer email address such as gmail.com

[EssentialRug]

We got rid of our PTA accounts several years ago and they now have to use a consumer email address such as gmail.com

 

Same here. They asked for school addresses and we declined. They now use Hotmail.

[djm968]

I wouldn't be "comfortable" with this either, due to the potential increased risk of a GDPR data breach.

[localzuk]

We disallow any shared accounts like this. The only exception is a shared mailbox that is linked to people's personal accounts. So, each PTA person would have their own account, and we'd delegate the shared mailbox to them. Not that we've had any requests for PTA emails though.

 

If we did, there's also the consideration of access to mailing lists etc... We would not want PTA members being able to email people randomly, so they'd have severely restricted accounts if we allowed them.

[pete]

One person per account and MFA enabled for all adults - no exceptions.

[free780]

It’s the same issue for governors (depends on organisation). It gets a lot worse with Cyber Essentials. E-Mail forwarding is a bad idea as is any account without MFA/Identity Protection.

[enjay]

We would not want PTA members being able to email people randomly, so they'd have severely restricted accounts if we allowed them.

 

Any parent could probably do that to any staff member anyway, and if your PTA are emailing students, I think you've got a different problem!

 

Forwarding rules are a bit of a concern (although you can't stop them manually forwarding them anyway) although if you're doing the communication right, the PTA shouldn't be getting anything sensitive anyway so not a huge concern if it leaves your domain.

 

This thread has set me thinking though. Our PTA have a couple of accounts which I'd never really questioned before.

[FN-GM]

I wouldn't be "comfortable" with this either, due to the potential increased risk of a GDPR data breach.

 

The PTA should not be processing any personal data in the first place. So there wouldn’t be a GDPR risk.

[djm968]

The PTA should not be processing any personal data in the first place. So there wouldn’t be a GDPR risk.

You are correct they won't be processing personal data but they would have access to it using a shared account without MFA. There is also an increased risk of staff "accidentally" sending personal data to a shared PTA account, if this resides on your system.

[enjay]

You are correct they won't be processing personal data but they would have access to it using a shared account without MFA.

 

Other than student names from the address book, what other personal data would they have? If the account is locked down correctly, they'd just have email, Drive and nothing else.

[localzuk]

Any parent could probably do that to any staff member anyway, and if your PTA are emailing students, I think you've got a different problem!

 

How would they know their email addresses? We don't list them anywhere publicly, and they're not guessable. Whereas if they're on our email system, they have access to our address list (unless we limit them to a custom address list like we do our students).

[enjay]

How would they know their email addresses? We don't list them anywhere publicly, and they're not guessable

 

Ah okay, I was assuming they were [email protected]

[djm968]

Other than student names from the address book, what other personal data would they have? If the account is locked down correctly, they'd just have email, Drive and nothing else.

I would ask the School what sort of checks they do for these PTA members? Do they sign any confidentially agreement, acceptable use policies, have they been DBS checked etc etc. It doesn't really matter what personal data they have access to, providing an account on your system without MFA increases the risk of a data breach. Edited May 16, 2023 by djm968

[GrumbleDook]

PTAs are (generally) separate entities to the school, and so need to cover their own data protection requirements.

It is possible for PTA 'staff' to have access to school systems as school volunteers, and to also make use of the school data ... but only if there is a clear data sharing agreement in place, relevant safeguards are in place and it is made completely transparent to school staff, children and families.

It can be helpful to have this sort of relationship established, as it can cover H&S requirements, safeguarding concerns during PTA events (as school staff may be doubling up on their roles ... school staff and PTA volunteer), and simplify fundraising projects (yearbook, etc.)

 

Shared mailbox? No. Email forwarding? No.

Ensuring they are data protection/privacy/safeguarding/H&S trained? Hell, yes! If that is easier to do under the school banner and the payback is some email access (appropriately restricted, monitored and audited) then why not?

[APMerry]

Thanks for all the responses, nothing like starting a good discussion.

 

I'm off to have one of those 'but it's always been like this' discussions.