Teacher copying data

[GrumbleDook]

To some extent it is indeed to do with job roles.

 

We may decide that NMs don't need access either but have an uber-account that they can use when they need to go and and do stuff (check for the presence of games, restore work, etc) ... most of us might view that as the Administrator account, but that should not be an account we think of as a regular account.

 

Unfortunately, whether like it or not, there is a clear instruction under the DPA that data should only be used by those who have the need to use it as part of their job.

 

I stand by my point that many people don't know the range of personal information a student holds on their home area and this raises a number of concerns under the DPA. Under the ICO *I* am personally responsible for ensuring that staff (not just teachers ... and not specifically aimed just at teachers either) only have access to the things they need access to.

 

I am also responsible for ensuring staff are given guidance about data protection and the implications of it, knowing that should they breach the DPA then they are personally culpable ... unless I have not kept them informed ... in which case it falls back to me.

 

I cannot, hand on heart, say that all staff are aware. Staff do not always read the paperwork you give them before they sign it. They do not always read the updated policies we me readily available (and point them at) and so a number of steps need to be taken in conjunction with this.

 

1 - You need to review what access staff have to the MIS. All staff should be logging into it with a separate account that is unique for them. As well as ensuring that they only have access to the areas they are entitled to, you have an audit log of what they have been doing on there.

 

2 - You need to review the access that has been assigned on the MIS. Staff that change roles in a school often just have the extra bits dumped on top instead of stripping out the areas they no longer need (and believe me ... they don't need access to everything. Go speak to your SENCO or child protection officer if you don't believe me)

 

3 - You have to accept that the MIS is not the sole repository of personal information. An exported report can be transported to too many places to think about and the person generating that report has a responsibility to ensure it is only used by those authorised to do so *as part of their job*!

 

4 - You have to accept that data is often collected by staff and students for innocuous reasons, but when combined with other freely available information it becomes personal and identifiable. Access to this information needs to be treated in the same manner that you would for centrally stored information on an MIS. Only give access to those who need it, for the period they need it for and then remove access or destroy it afterwards.

 

5 - The removal of any such data from the school needs to be authorised and for a specific reason. The teacher in question is not authorised to do so (backups being the job of someone else) and has not been done under the DP principles. This is a perfect example of how not to do things. We can extrapolate it further to ensure that backup tapes that are taken offsite are encrpyted (either at backup or as a backup of an encrypted file / folder), that all USB keys used by teachers use something like TrueCrpyt (commercial solutions are available) and that all access remotely into a school needs to be done on a secure connection, over HTTPS / SSL and not HTTP or basic RDP.

 

This is being reviewed by Becta and other Govt Agencies ... the definition of data classes and their relevant levels of impact is being done and there will be some clear exemplar cases over the coming months.

 

The OP has a valid arguement and once informing the SLT (get it minuted that you did so) then turning a blind eye may still not be good enough in the coming months.