ClassCharts GDPR security issue

[PotNoodleTech]

"Yes, I can confirm that we discovered the incident on the XX January and this was reported to the ICO on Wednesday the XX January at 10am in accordance with the ICO guidelines."

 

This is how real companies deal with data issues properly, they don't bury their heads in the sand and pretend nothing happened like Classcharts/TES.

[GrumbleDook]

A quick one from me. I know I’ve mentioned it before, and it might come across as pedantic (yeah, I know … me … pedantic!!!) but please be careful how you refer to other organisations who you use to process your data.

A Data Processor (DP1) is a data hub product (lots of terms could be used, substitute whichever you prefer) that is used to shuffle data to lots of other vendors (DP2-10), and to pull it back in where needed. This is where the school is giving an instruction to a data processor to work with a second data processor.

Sharing data with the DfE or LA is sharing it with a third party. You might get DP1 to do the work, but this is sharing with a third party. The recipient will have their own purpose and lawful basis for using the data. This is what makes them a third party, in data protection/privacy terms.

However, you (the school) still have to agree and give the instruction to DP1 to do the work. Nothing should just be passed around or taken “just in case”.

Getting your staff to understand the difference between these two (DP and 3rd party) is core to getting them to think about what data they are sending over and why.

The expert is right to say that the platforms need to be vetted. This is nothing new.

[Kollektiv26]

They flat out lied to us and claimed there was no data breach even when we provided them with screenshots of other school pupils appearing on our class charts!.

 

Madness

 

They should have just taken responsibility, said sorry and sorted it out

[psynegy]

They flat out lied to us and claimed there was no data breach even when we provided them with screenshots of other school pupils appearing on our class charts!.

Madness

They should have just taken responsibility, said sorry and sorted it out

 

I've been contacting the IT departments at schools where we've received screenshots for, to hand over what evidence we have. Much more powerful ammunition in their hands than ours.

Edited February 13, 2024 by psynegy

[robintech]

I wonder if all the comments were from the same staff member. If so, I suspect someone got hold of their password or phone.

 

They've updated the article to add this

 

However, following publication of this story, a Tes spokesman told the BBC the events at Northfield school arose as a result of a user accidentally sharing a password, adding that the incident did not represent a vulnerability on its platform and was dealt with by the school swiftly.

[mikes]

Hi guys - just had a call about a parent who had viewed their daughter Maggie Thatcher, but got a completely different pupil Christopher Thatcher instead - there has never been a Christopher Thatcher on roll here - I haven't looked fully into this yet as I'm dealing with a diff issue but does anyone know if this has reared its ugly head again? - edit disregard might be something else Edited July 4, 2024 by mikes

[howartp]

edit disregard might be something else

Just posting so folk receive the update saying to disregard.

[mikes]

Just posting so folk receive the update saying to disregard.

 

yeah sorry guys no need to panic it's not an issue with classcharts.