USB Stick - Personal

[Aldmi]

We have terminated a etachers contarct with immediate effect and they are no longer allowed on the school site.

 

In clearing out their office we have found a USB stick which has a mixture of their personal stuff (family photos, bank statements etc) and also school related stuff (student reports, tracking data etc)

 

The school uses 365 so all data is stored on onedrive/sharepoint so we have never had this issue before.

 

Anyone had this situation before and how have they addressed it? Its their own personal USB so not school property but feel it would be a data breach handing it back. The member have staff has ingagaed a solicitor who has demanded it back

[Steve21]

I'd say that's for HR/legal to work out.

 

No different to having a bag left with school paperwork in it, whether you'd return it with paper in etc isn't down to you to choose

 

Steve

[kennysarmy]

We have terminated a etachers contarct with immediate effect and they are no longer allowed on the school site.

 

In clearing out their office we have found a USB stick which has a mixture of their personal stuff (family photos, bank statements etc) and also school related stuff (student reports, tracking data etc)

 

The school uses 365 so all data is stored on onedrive/sharepoint so we have never had this issue before.

 

Anyone had this situation before and how have they addressed it? Its their own personal USB so not school property but feel it would be a data breach handing it back. The member have staff has ingagaed a solicitor who has demanded it back

 

Why not just delete the school data then had it back?

 

Am I missing something?

[Rob_D]

Why not just delete the school data then had it back?

Am I missing something?

 

Ultimately, that's probably the best solution. But, I can see plenty of reasons the school might want to consider their approach carefully.

 

On the one side, I can the school feeling uncomfortable accessing (or having been seen to have accessed) a drive with such personal information as bank statements. If it were me, I'd definitely want SLT there while I'm doing the deleting to witness I didn't touch anything else and maybe even go so far as to screen record the process.

You might even want to go so far as having the ex-staff member present while the data is deleted, or deletion done by a 3rd party arbitrator.

 

On the other, simply deleted files can be easily recovered by the user, and given the termination sounds pretty acrimonious and the data sounds like it contains student PII, the school might not trust the user not to try recovering it.

[36Degrees]

The member have staff has ingagaed a solicitor who has demanded it back

 

Don't do anything with it until you have got something in writing from someone further up the food chain, preferably the Head Teacher. I assume you have an AUP or Cyber Security policy that states any personal data relating to the school should not be stored on portable media and definitely not on unencrypted portable media?

[Oaktech]

We had a similar situation at my secondary school and the solution from Legal was that a a 3rd party appointed by the teacher's union should do it.

 

Under the supervision of both a representative from school legal and the union, the 3rd party technician identified and listed the contents of the stick and suggested a separation of personal and school files and folders.

 

The school legal and the teacher, via the union and after some back and forth about ownership of planning, eventually, confirmed they were happy with the separation of items.

 

Under supervision from school legal and the union again the 3rd party copied off only the personal information onto a new stick of identical specification and gave that to the teacher via the union with a receipt.

 

The original stick was given back to the school and destroyed in the usual WEEE stream.

 

Cost the school a fair bit.

[djm968]

Does your School have a policy that covers School Data on personal devices?

[enjay]

This is above your pay grade. The Headteacher needs advice from legal and HR. The staff member has probably (hopefully!) breached policy by having student data on a USB, but if/how the school wants to tackle that depends on the wider situation of the termination and appeal. You have no right to keep their personal property or deny them access to the data (especially if it is their only copy of those files), so that at least needs returning. There is also, as @Oaktech said, the somewhat grey and usually undisputed area of intellectual property rights over work the teacher has done. Maybe you'll end up giving them copies of their planning and schemes of work, but no student PII.