Google Workspace email - SAR Request

[password1234]

Hi all

 

Had a query from a parent requeting an SAR request that containts reference to their child in any email correspondance sent within the schools email system

 

they using google workspace email for this

 

Anyone know if its possible to retrieve this information from Google admin console?

 

Familiar with 365, Google not so much!

[Jaan]

Would Google vault not do this for you?

 

edit 2: sorry this is the right link https://services.google.com/fh/files/misc/gsuite_dsr_customer_guide.pdf

Edited September 26, 2023 by Jaan

[jthompson]

Google Vault is the tool to use. It's its own app, not a part of the Admin console.

[Sibrows]

As others have said Google Vault will provide the result your after but try and get the query to exclude bits to reduce the amount of info it returns.

Frustratingly it will return either a pst or mbox file for every mailbox it finds results in.

 

Having had 4 SARs this academic year with 10k+ emails returned for each I’m familiar with this issue.

 

Happy to share some of the bits I’ve put together to reduce the time this takes

[mikes]

Vault is great - vault.google.com - lifesaver for checking chat, google docs, e-mails, I only wish it was easier to check version history of docs because kids like to chat using the same doc typing over existing text. You can search all data for specific terms just hope the child specified doesn't have a common name! Edited September 26, 2023 by mikes

[TIOAOA]

@Sibrows I'd be grateful if you could share those bits. Just had 3 SAR's cross my desk on the first week in the new job.

[PotNoodleTech]

Yep use vault - but come back to the parent and ask them to be more explicit on the exact information they require, as just searching for all emails on a pupil for no real reason would probably return hundreds or thousands of emails and could be considered onerous and thus you could refuse.

[dmj]

Had this problem in my last school. We put a strict policy in that all emails get centrally deleted after 12 months. All 'critical' information needs to be stored in the appropriate system.

It made SAR's a much simpler task.

[PotNoodleTech]

Had this problem in my last school. We put a strict policy in that all emails get centrally deleted after 12 months. All 'critical' information needs to be stored in the appropriate system.

It made SAR's a much simpler task.

 

This is an interesting one, I know lots of places are doing this now. The worrying thing is that I've actually saved more than one persons Job during investigations by being able to go back 2 or 3 years in office365.

 

If everything was fixed to 12 months here then those staff would have likely been toast. That worrys me. Imagine your under investigation and you've now go no proof of anything that went on for the investigator as it's over 12 months ago? You'd be screwed!

[jthompson]

Had this problem in my last school. We put a strict policy in that all emails get centrally deleted after 12 months. All 'critical' information needs to be stored in the appropriate system.

It made SAR's a much simpler task.

 

Maybe 13 months? Just to grease the gears of any annual stuff.

[DGardiner]

This is an interesting one, I know lots of places are doing this now. The worrying thing is that I've actually saved more than one persons Job during investigations by being able to go back 2 or 3 years in office365.

 

If everything was fixed to 12 months here then those staff would have likely been toast. That worrys me. Imagine your under investigation and you've now go no proof of anything that went on for the investigator as it's over 12 months ago? You'd be screwed!

 

yeah, we have everything since the beggining of using google, a 5 year old email saved us from a financial issue and caught a dodgy energy supplier with fake "authorisations" from someone who left 2 years ago to broker our energy supplies for all of our schools for the next 10 years

 

i think id argue until we upgrade to the licence that has the dlp labels in google and make sure we have really good labeling proccesses that we dont delete anything

Edited November 14, 2024 by DGardiner

[pete]

yeah, we have everything since the beggining of using google, a 5 year old email saved us from a financial issue and caught a dodgy energy supplier with fake "authorisations" from someone who left 2 years ago to broker our energy supplies for all of our schools for the next 10 years

 

i think id argue until we upgrade to the licence that has the dlp labels in google and make sure we have really good labeling proccesses that we dont delete anything

 

I mean, it's a risk assessment like anything else. Got a lot of feckless liabilities employed at a place that you can't fire? Maybe pick a shorter retention period. Generally sane and reliable staff who take pride on doing a good job? Longer period may be less of a risk.

[PotNoodleTech]

I mean, it's a risk assessment like anything else. Got a lot of feckless liabilities employed at a place that you can't fire? Maybe pick a shorter retention period. Generally sane and reliable staff who take pride on doing a good job? Longer period may be less of a risk.

 

Lets hope your place doesnt think like that when it comes to your disciplinery!

[pete]

Lets hope your place doesnt think like that when it comes to your disciplinery!

 

You seem to have interpreted my comment as a strategy for firing staff? That's not the intent.

 

The driving force behind email retention policies is everything to with reducing liability for the organisation.

 

Your example (saving someone's job) is arguing for data retention "just in case". That's not reasonable and only enriches solicitors.

 

My argument is if you're going for a long retention period, make sure you're not employing idiots (who will do documented stupid things that cause liability for the organisation).

 

If you are employing idiots, you cannot have a long retention period because of their habit of documenting liability.

[PotNoodleTech]

I don't really get your point. What I said was a longer retention period literally saved members of staffs jobs livelyhoods etc because the email trail showed they had done nothing unprofessional.

 

I dont really see how that could ever be considered a bad thing no matter the quality of the staff - fair is fair and no one should lose their job becuse data has been wiped because of someones obsession with making SARs easier/less frequent.

 

I dont really see how anyone could come to the conlusion that a a 12 month retention is acceptible for professional communication method that contains everything the school does (and may have to prove it's done) from daily comms to teaching to safeguarding to behaviour, to finance, to legal.

 

Thats all I am saying! It wasnt a dig at a strategy for firing staff just genuine confusion/disagreement

Edited November 15, 2024 by PotNoodleTech

[Boredguy]

Are you able to set different retention periods in G-Suite like you can in 365?

We have majority of staff on 12 months, but roles like HR/Finance/Head Teacher have 36 month for issues like mentioned above.

 

We also recommend that e-mail is not a file storage system so important content should be printed to PDF and kept as a file.