Legal basis for filtering and monitoring - responding to a parent

[mcolliver]

Hi,

 

I know the legal basis is statutory guidance for KCSIE and PREVENT however we have a parent pressing against this.

 

So - the collection of sites / search terms etc - the legality of collecting this data.

MITM attacks (ie our request for students to install a certificate onto their personal devices).

Goes beyond any 'reasonable' implementation of the requirements.

Exposure to future legal and financial risks:

* what if the company sells on the data?

* what if the company is breached (and this data become available)?

* what if we 'punish' a student for what they are looking at (by collecting this 'illegal' data)

 

Now I'm sure we can keep replying to this with KCSIE and PREVENT (and also how safeguarding trumps GDPR etc).

 

My request is has anybody had to deal with a parent like this before and have any advice.

(This is an international parent who has professional understanding of IT security)

 

Cheers,

Martyn

[mikes]

Isn't PREVENT enough? it's a legal requirement so you have to monitor the devices they use. I had a parent upset at me in the past because the student did not have his own device and when he signed into the parents device, he had the warning about us being able to wipe it etc.

I was told to tell the parent - if they are not happy with these terms then the kid could use the breaktime/lunchtime homework club.

 

But as an alternative a few years ago before Covid when we were being pushed by an MS Rep and another Google contractor, when I brought up the lack of monitoring and filtering, I was told basically that should be a teacher/discipline problem, after all the person in charge of handing out paper shouldn't be getting involved if a student writes a nasty message to another student then throws it to them on a paper plane. And if a student brings up a p*orn magazine it wouldn't be dealt with by IT, but rather SMT.

[titch]

I think these are all fair points from the parent.

 

We are essentially breaking the internet to be able to filter and monitor effectively and we are putting a huge amount of trust in these companies not to slurp a whole lot of data. I'm not practising what I preach here as I have senso/securly and a PA firewall decrypting everything but in my heart of hearts I wouldn't accept this for myself and wonder why we blindly accept it for our kids.

 

It's a complete tight rope and I really wouldn't want to fall off either side.

 

Sorry no help in answering your questions but don't be defensive with the parent. Be open and transparent , maybe ask them what they would do if faced with the same challenges that schools are.

[Steve21]

Surely you just turn this back onto the parent - If your kid is signing the ICT AUP you have agreed to these terms, whether or not you disagree with the principle. If you aren't willing to then you have no computer access. - This also removes the "What if's" as it's then down to the parent to decide if they agree or not.

 

In terms of the requirement for a "lawful basis" in that scenario assuming that reference was to GDPR it's then simply consent. (Ignoring any moral arguments regarding legal obligations and where they start/stop)

 

The "reasonable" or in GDPR terms "necessary" implementation are only under certain bases which doesn't include consent so wouldn't be a factor in there either.

 

Steve

[DrCheese]

If they are using school devices, then they need to deal with it. It isn't up to the parent to decide how you choose to comply with regulations on devices that you directly own. If they feel so strongly about it, they are free to take their children to another school.

 

Personal devices - I'm not a fan of forcing MITM certs on users, but unless you are forcing them to use personal devices in school, they could... just not use them on the school's wifi if they disagree with your chosen policy on this.

Even if you are enforcing the use of personal devices, they could just get a data contract to get around this issue.

If they then choose to access content that would have been blocked on your system & show it around the classroom, then the school should have policies in place to handle that (That aren't really an IT thing to handle)

 

I don't think it's worth the headache arguing back at this, just point them at KSCIE & PREVENT, then call it a day. You aren't the ones they should be complaining at or in a position to really change anything so it's all wasted effort on everyone's behalf.

[filteringtech]

Well, I've never installed any school SSL certs on or ever attached any of MY personal devices onto a school network in over 20 years and will never do so, or login to personal accounts on a school network.

 

We do have an opportunity to use filtering for other good reasons, and that is to block not just the ads (KCSIE), but as much as possible of the tracking and profiling ecosystem which can give our users a much better and actually more private web experience than they would normally get.

[sigma]

Having thought a bit more about this, the monitoring that bothers me the most because we know about the false positive, false negative and other errors that creep into supposedly ‘intelligent’ categorisation algorithms is the online “mental health” monitoring.

 

Different, but we had a pupil last year that hit a National Crime Agency block list and got a very stern warning for just Googling their own name. No pupil should be ever humiliated that way, and that blocklist is off now.

[Davit2005]

Surely it's a school policy not an IT policy.

[CHiLL]

This is my take on it, based on what I've read/believe to be the case:

 

KCSIE and PREVENT cover the school's reasons for monitoring and collecting Internet activity.

MITM/certificates on personal devices is at the discretion of the individual. They choose to use their personal device on the network and therefore must adhere to the company's requirements. MITM certificates also enable the monitoring/collecting of secure website data/HTTPS, to also comply with KCSIE and PREVENT.

I'm pretty certain that schools are not allowed to sell personal information, otherwise legal action could be taken against the school. It is the school's responsibility to ensure that data that is being shared with external companies is being kept under the GDPR regulations and that the company has a policy stating it will not sell/share the data. If that is broken, then the school can take legal action against the company.

If the company is breached and data is stolen, then that ties in with the above point that the customer (the school) will have to take action against the company.

Students are pusished if they breach the school's policies/rules on computer use, which the student or parent should have signed in order to use the computers. Such policies would include fordidding the student to access certain types of content, such as: Restricted/Age-inappropriate, dangerous, social media, extremism, weapons, etc.

[sigma]

We are being served with too many policies that can appear to conflict at times such as the Cybersecurity policy of needing 2FA and the new policy of disallowing pupils access to mobile phones. I’m sure there are others.

 

As far as selling personal data, is concerned, of course schools won’t directly, but without delving properly into online ad blocking and tracking there will be a fair bit ‘gifted’ to Axicom and their ilk, just from browsing and not forgetting that which is sold/gifted by the DfE.

 

https://schoolsweek.co.uk/dfe-reprimanded-after-pupil-data-used-by-gambling-firms/

 

Sorry, I digress.

[pete]

Get some background info. Is the parent basing their concerns on their experience of data protection/privacy laws in mainland Europe?

 

Exposure to future legal and financial risks:

* what if the company sells on the data?

* what if the company is breached (and this data become available)?

 

Perform due diligence the same as any other product or service you buy into. Your DPIA that you undertook before implementing the solution should have covered this. Including checking retention limits (and adjusting where necessary) and explicitly opting out of any "we store data to improve the product, it's anonymous, honest" T&Cs. Plus research into the company and any past security incidents and how they handled them.

 

Education software providers do tend to be a bit more slack when it comes to security (a search on Edugeek will reveal a couple where the vendor went completely toys out of the pram when called on their questionable development decisions), so making sure the school has done due diligence is a valid query.

 

Now I'm sure we can keep replying to this with KCSIE and PREVENT (and also how safeguarding trumps GDPR etc).

 

Safeguarding does not trump GDPR. GDPR does not trump Safeguarding. You act with consideration to both, sharing only the information necessary with the people necessary to achieve your aim (protect the kid).

 

(Yes, I would like to hunt down the safeguarding person who started the X trumps Y idiocy).

[TechMonkey]

So - the collection of sites / search terms etc - the legality of collecting this data.

- AFAIK there is no legality of collecting this beyond GDPR. Organisations have been doing this since internet proxies were first introduced. As long as the school and company you are dealing with follow GDPR (getting rid of data in a reasonable time frame, encryption, etc) there is no issue.

 

MITM attacks (ie our request for students to install a certificate onto their personal devices).

- Not sure their issue. If you were asking the student to install all certificates then taht would be an issue, but you are asking for a single one. If the parent does not trust the company issuing that certificate, that is another issue. But is the parent asking to review every company the school is using?

 

Goes beyond any 'reasonable' implementation of the requirements.

- What do they feel is reasonable? That is a very hyperbolic statement. It is a standard implementation across many sectors and industries.

 

Exposure to future legal and financial risks:

* what if the company sells on the data?

* what if the company is breached (and this data become available)?

* what if we 'punish' a student for what they are looking at (by collecting this 'illegal' data)

 

- I'm presuming the school has a contract with the company. What does that say? If the company did do that, then I imagine they would be in breach of GDPR so there would be a legal case against them.

- Yes this is a real concern. But the company should be able to supply information on what they do to prevent this.

- What of it? If a pupil is looking at porn, or bullying someone else, or looking at things they shouldn't it is part of the AUP (it is part of the AUP right?) that they get punished.

 

Ultimately it comes down to, as part of the agreement to use their device on your network they install this certificate. If the parent does not agree with this, the choices are to use paper and pen or go elsewhere. Harsh take but that is the choice, unless you are willing to bend or ignore the rules for one pupil/parent. If you are then why not break them for all pupils? At which point why have the policy you have?

 

If you want to be more concilliatory you can ask them wht their ultimate objection is and what are their concerns? Then try and allay them.

[Fazza]

As long as you mention that all computers are monitored etc. in your acceptable use agreement then you should be find and can just refer them to that as at some point either the parents or the child should have agreed to it. If it's not mentioned in you AUP or neither the child or parent has agreed to it as part of any process then that may be a problem.

[msi_school]

As long as you mention that all computers are monitored etc. in your acceptable use agreement then you should be find and can just refer them to that as at some point either the parents or the child should have agreed to it. If it's not mentioned in you AUP or neither the child or parent has agreed to it as part of any process then that may be a problem.

 

Bit of a side note but AUPs should be redistributed to staff at least once a year and more often for students otherwise it is unreasonable for you to assume they can remember the stipulations.

[elsiegee40]

@GrumbleDook are you around?

[localzuk]

This has several aspects.

 

First lets hit the data protection part - this should be covered by your Data Protection Policy. Any services used that collect data should have been checked and a DPIA done. As filtering and monitoring are required by law, your lawful basis is legal obligation. As part of this, you must only collect the data necessary to comply with the law. That is specified in our Prevent duties (so, we need to analyse every page someone goes to, and compare it to the list of banned sites per Prevent, IWF etc...), and then per our KCSIE duties (as expanded via the guidance here - https://saferinternet.org.uk/guide-and-resource/teachers-and-school-staff/appropriate-filtering-and-monitoring).

 

Concerns about companies selling data is covered by GDPR and your DPIA. If your data sharing agreement with such a company does not allow it, then the company is legally not allowed to sell that data. If they do, the company can be sued, and prosecuted.

 

Next, you have to look at the issue of using a personal device. Your ICT Acceptable Use Policy (potentially with a specific part for BYOD stuff) should cover this. If they agree to that AUP, then they agree to the way you require filtering to be done. If they do not agree, then they do not get to connect their personal device to your network.

 

Lastly, your policies must provide detail on how you filter and monitor. They must reflect actual practise, and not what you wish it to be. It is for the school to determine the extent of their filtering/monitoring. E.g. Do BYOD devices continue to be monitored out of school? If no, specify this in your policies and AUP. Make it very clear and simple.

[TechMonkey]

Bit of a side note but AUPs should be redistributed to staff at least once a year and more often for students otherwise it is unreasonable for you to assume they can remember the stipulations.

 

I'd only agree if your policies aren't available on your intranet/SharePoint. Otherwise staff should make themselves aware of company policies. Always good to send out reminders, but ignorance of a policy is not a defence.

With pupils, have them up on the IT room wall or in key places. Otherwise

[msi_school]

I'd only agree if your policies aren't available on your intranet/SharePoint. Otherwise staff should make themselves aware of company policies. Always good to send out reminders, but ignorance of a policy is not a defence.

With pupils, have them up on the IT room wall or in key places. Otherwise

 

An employment tribunal is not a court of law and the rules are different, There was a case about 10 years ago when someone was reinstated because it was unreasonable to expect them to remember all the rules of the AUP after a couple of years. This is why you have to read KCSIE & etc. every year.

[pete]

An employment tribunal is not a court of law and the rules are different, There was a case about 10 years ago when someone was reinstated because it was unreasonable to expect them to remember all the rules of the AUP after a couple of years. This is why you have to read KCSIE & etc. every year.

 

Yup, it's not reasonable to expect people to check websites on a regular basis just in case a policy/T&Cs have been updated.

 

We (MAT) have 44 publicly-available policies at the trust level. Individual schools have ~10-15 publicly available policies (attendance, uniform, home-school agreements etc) on top of that.

 

A basic "hey, we changed policy X, here's the summary of changes and a link to the new policy" email protects the staff member and the employer.

Edited October 11, 2023 by pete

[Mr.Ben]

I'd only agree if your policies aren't available on your intranet/SharePoint. Otherwise staff should make themselves aware of company policies. Always good to send out reminders, but ignorance of a policy is not a defence.

With pupils, have them up on the IT room wall or in key places. Otherwise

We are using conditional access polices for staff to distribute AUPs and get them to agree to them once a year.

[TechMonkey]

An employment tribunal is not a court of law and the rules are different, There was a case about 10 years ago when someone was reinstated because it was unreasonable to expect them to remember all the rules of the AUP after a couple of years. This is why you have to read KCSIE & etc. every year.

 

I've never heard of this one. Do you have a case or a source for this?

 

I agree with Pete, if there are changes you have to inform staff but I was always under the impression that if nothing changes you don't need to keep bombarding people, though a reminder on important bits is always a good idea.

[localzuk]

Regarding updating people - we use a system to do this. Policies are reviewed yearly/2 yearly. Updates then get added to the system and all staff are notified automatically that the policy has changed and that they need to check it and confirm they've read it on the system. (We use iAm Compliant for this).

 

So far, it has made managing polices much simpler for the Trust.

[msi_school]

I've never heard of this one. Do you have a case or a source for this?

 

I agree with Pete, if there are changes you have to inform staff but I was always under the impression that if nothing changes you don't need to keep bombarding people, though a reminder on important bits is always a good idea.

 

You don't have to but it is recommended by employment lawyers.

 

https://laceyssolicitors.co.uk/2021/12/13/employment-policies-and-procedures-time-for-a-refresh/

 

https://www.iwg.co.uk/news/employment-policies-and-procedures-time-for-a-refresh/

 

 

I cant find the citation for computer related policies but Allay (UK) Ltd v Gehlen which was a discrimination case in which the training was over a year old and "The Employment Tribunal held that the training had become “stale” and that refreshing that training would have been a reasonable step for the employer to take in the circumstances"

 

https://www.gov.uk/employment-appeal-tribunal-decisions/allay-uk-ltd-v-mr-s-gehlen-ukeat-slash-0031-slash-20-slash-at

 

https://www.blakemorgan.co.uk/eat-upholds-finding-that-staff-training-on-harassment-was-stale-and-needed-refreshing/

[TechMonkey]

Sorry but none of that relates to making sure staff remember policies, just that training should be kept up to date if using it as a statutory defence. In fact the main part of Allay v Gehlen is that even though the training was recent the actual training was stale. So you could argue that just sending out the same AUP evey year makes it stale and ineffective.

[msi_school]

Sorry but none of that relates to making sure staff remember policies, just that training should be kept up to date if using it as a statutory defence. In fact the main part of Allay v Gehlen is that even though the training was recent the actual training was stale. So you could argue that just sending out the same AUP evey year makes it stale and ineffective.

 

The purpose of staff training is to inform and educate the staff on the business processes and policies so that they can follow them in the execution of their work, you are correct that the AUP/Training is required to be kept up to date but depending on the policy it may never change, I assume most business' no smoking policies where written once in the 90/00's and have never been updated. Also to be honest the statutory defense is that the staff where provided training, not that they remembered it.

 

I was told in about 2010 to distribute IT policies every year by an SLT after they had consulted with a employment lawyer and they quoted the AUP related case I cant find a citation for. I am not a solicitor or have any formal training in law so I could be wrong however the reading I get from the ruling, is not that the training was at fault but it was delivered too long ago.

 

The training had been delivered several years ago

We accept that that training had covered harassment related to race. However, in all cases the training which had been delivered was several years before the events in question and was clearly stale. We do not accept that the respondent had taken all reasonable steps to avoid discrimination in the workplace for a reasonable step would have been to refresh that training.

 

The training made clear what to do but it wasn't done

The training had made plain to the employees what they should do if they heard unacceptable remarks and they all failed to follow that guidance. The training patently needed to be refreshed and it would have been a reasonable step to do so.

 

The company lost the case

The statutory defence advanced by the respondent is not made out.”

 

Not from the ruling but from the Nelsons Business Law link

In fact, Allay (UK) Ltd had provided Mr Pearson with refresher training after finding out about the comments that had been made, which the Employment Tribunal found supported their assertion that in the employer’s mind, that would have been an effective step to take.

 

Also as a safest path approach I am not doing any harm by distributing AUPs regularly.