Sharing a document with Pupils parents - GDPR

[genesis]

Hi

 

We use O365 and SharePoint. A member of the Learning Support staff has asked whether it’s possible for staff to share a confidential document located on our SharePoint with a pupil’s parents and allow them to edit it.

 

 

The parents reportedly work at a school and i assume their school also uses O365.

 

 

According to GDPR, would it be acceptable to share the document with the parents, and would it be permissible to use their school email address for this purpose?

Alternatively, is there another way to achieve this?

 

 

Thanks.

[NegativeKillDeath]

GDPR compliance would depend on the content of the document. I wouldn't want to share it to another school's M365 email address, it would need to be to a personal email. Its a real bugbear of mine when people use their work emails for personal use. If you share the document to a non M365 account then the person will get an email each time the sharing link is clicked to confirm its the email owner trying to access it.

[FN-GM]

In addition to the above, I would also question why the staff member isn’t using the approved process. By doing something different, individuals are opening themselves up to problems.

[Roberto]

I’d echo what FN-GM said - what process would they follow if the parents concerned didn’t allegedly “work at a school”. Great, now do that process.

[MatthewL]

What has working at another school got to do with it, they could work at corporation 123 that uses 365, they are a parent regardless.

 

3 options really, share it to them using 365 to their email of choice, could be a gmail or corporation123 that is their choice, email them the document as an attachment again to email of their choice and password protect the document or print it let them manually edit it and send it back (probably not the prefered choice).

 

Lots of people use work email addresses but its something we discourage but how they manage their email is their choice.

[enjay]

What am I missing here? Of course you can share a document with parents if it relates to their child (with some specific safeguarding exceptions). Sharing in M365 is acceptable because it is secure, and sharing to a workplace account (Corp XYZ Ltd or a school, it doesn't matter) is also acceptable as long as the parent is aware someone at their workplace might be able to view the email too.

 

- - - Updated - - -

 

In addition to the above, I would also question why the staff member isn’t using the approved process. By doing something different, individuals are opening themselves up to problems.

 

It sounds like they need collaboration with the parent, so emailing an attachment or hand-delivering a printout might not be suitable.

[NegativeKillDeath]

What am I missing here? Of course you can share a document with parents if it relates to their child (with some specific safeguarding exceptions). Sharing in M365 is acceptable because it is secure, and sharing to a workplace account (Corp XYZ Ltd or a school, it doesn't matter) is also acceptable as long as the parent is aware someone at their workplace might be able to view the email too..

 

My concern is that if we know that a corporate email address is owned by the corp and may be accessed by parties other than the parent should we be trying to mitigate any risk. I would ask the parent if they had a personal account we could use instead.

[enjay]

My concern is that if we know that a corporate email address is owned by the corp and may be accessed by parties other than the parent should we be trying to mitigate any risk. I would ask the parent if they had a personal account we could use instead.

 

A personal account might be accessible to anyone who gets hands on their parent's phone. Yes, we should tell the parent that someone at work could access it, but it is their choice which email address is used.

[PotNoodleTech]

I think the real question is if the document is that confidential should be be being shared with a non-employee? It all depends on the content of the document.

 

If it's a spreadsheet of all the welbeing issues for all the pupils then HECK NO.

 

If it is a letter to the parent and the parent only and doesnt concern any data for any other pupil parent or teacher then yes maybe that could be sharable.

 

Be careful either way as stuff like this is a data breech just waiting to happen. Don't forget that when you share a document with someone outside of school you effectively lose control over that data, the parent can do anything with it from forwarding it to printing it and leaving it in their car to sending it to the local newspaper.

[enjay]

I think the real question is if the document is that confidential should be be being shared with a non-employee? It all depends on the content of the document.

 

Agreed, but if this is information they would share with a parent, then sharing it via M365 to a corporate account is fine.

 

Don't forget that when you share a document with someone outside of school you effectively lose control over that data, the parent can do anything with it from forwarding it to printing it and leaving it in their car to sending it to the local newspaper.

 

This is true of an email or a printed letter too.

[mikes]

Do you normally send these types of e-mails to parents personal gmail accounts? I can't see why a work o365 account would be much different myself?

[genesis]

We use 0365 and our staff can share the document using the parent personal email address ? and it should be GDPR compliant?