taking information offsite

[k-mart]

Has anyone here got guidelines or even an information policy regarding the taking of PII (personally identifiable information) off site, e.g. a teacher taking details the new intake to a seminar or conference.

 

I recently went to set up a laptop for a HoY who was going to conference and sat on a drive was an Excel file freshly pumped out of SIMS with *full* details of our year 8 – address, parent contact details d.o.b. etc

 

Not very satisfactory…..

 

I’m currently working on a security policy – aup, email, passwords etc – and thought it’d be prudent to at least have some working guidelines regarding this area.

 

Any advice, sample policies or comments would be appreciated

[russdev]

All and I mean ALL information taken off site has to be approved by head or someone assigned to monitor it aka data protection officer.

 

What it comes down to taking data off site needs to be for work purposes and can be only shared with relevant people and certainly taking it to a conference i would say is breaking dpa.

 

This also includes taking backups off site which have personal data on them..

 

Russ

[Tuxguy]

Not sure if this is exactly the same issue, but when I was wanting to host a Moodle service outside the school I was told not to as it would mean some student info would be going off-site, and that was a no-no. Fair enough, I suppose. So I now have the Moodle server on our school network ok and accessible from the internet. However, and this is the point of interest to me, I do note that the external access part our Kaleidos system seems to be hosted somewhere off-site, so what's the deal there? Anyone understand the Kaleidos system well enough to know if there is student data being held externally?

[GrumbleDook]

When dealing with student information and the DPA you have to ensure that it is mentioned in the register that information will be off-site to use for specific circumstances. You then have to have procedures in place to safeguard this information and get someone at the other end to sign agreements.

 

If your VLE is hosted, organised or built by your LA / RBC then they have pretty much all that information already and as teh umbrella group their entry in the DPA covers you ...

 

If you are hosting the VLE with a private company a signed document from them to say that the data will not be accessed by anyone other than you, and that they will ask you permission before moving, deleting copying or altering the data in any way.

 

There may be specific guidelines on this from your LA and they may have said "No ... no data to go off-site" ... partly as protection for you ... but partly to make you use their VLE ...

 

An example of student data going off site and being secure ... speak with the folks at SAM Learning about a draft T&C ... you shold be able to get one and in there (or it may have been the final contract) there are restrictions to protect schools under the DPA.

[buzzard]

I know this post is a bit old but this has come up as we've just moved to a single domain, before the admin system backup was managed by the office manager, who took the tapes home. Now obviously she has no acces to the tapes and will not have any. But I could do with some hard evidence to prove my point about info off site, I have said its to do with the DPA and needs the Data Controller person involved but am getting a "What's a data controller?" look from members of SMT...

 

Any help would be appreciated!

 

Thanks

 

Ben

[timbo343]

Becta have an article on their site regarding this and they say that any information that is taken off site needs to be encrypted. I know we had a big discussion with the auditor at county and they were saying that no backups or information should be taken off site. We pushed this case all the way until they finally gave in and said as long as your information is encrypted you were allowed to take it off site.

[buzzard]

Thanks Tim is this the info you're referring to?

 

LINK

 

Thanks for the guidance!

Edited June 11, 2008 by buzzard