tech_guy Posted February 17, 2011 Posted February 17, 2011 I've been asked to investigate the use of DropBox in a school environment where staff use it as a means of having access to certain files. We were looking at creating accounts for all our teaching staff, installing the software on their laptops, and running a training session to get them up to speed. I have approached our LA with their take on the possible data protection implications and we are awaiting a response. Is anyone else using DropBox in this way?
localzuk Posted February 17, 2011 Posted February 17, 2011 You have to make sure that the dropbox servers are in the EU, else you'd be breaching data protection laws. 1
IrritableTech Posted February 17, 2011 Posted February 17, 2011 One teacher made this request to me some time ago. I seem to remember servers were not in the eu, and they explain in their T&Cs that they will scan your files and collate information. If that is still the case, I'm guessing you'll be bound by the DPA to keep clear of such services. 1
Sylv3r Posted February 17, 2011 Posted February 17, 2011 Another thing to bare in mind is Dropbox free for personal use? Would that include use by all staff in a school? That is debatable.
GrumbleDook Posted February 17, 2011 Posted February 17, 2011 I've sent a few questions to the legal folk at Dropbox to see what they say. they are similar questions to those asked about Google. The difference here is that DropBox use Amazon and it is Amazon who have signed the Safe Harbor agreement, not DropBox. I would ask Becta about it ... but ...
glennda Posted February 17, 2011 Posted February 17, 2011 I've always said no to things like this - but i have implemeanted a remote access system so users can get to there own files from home and also upload them back in just keep having to stop myself banning memory sticks for kids as they keep telling me i can't but i want to so much - all they do is cause problems especially the newer ones which half don't work because they try to install software which the students aren't allowed to do.
lasercat Posted April 1, 2011 Posted April 1, 2011 I've sent a few questions to the legal folk at Dropbox to see what they say. they are similar questions to those asked about Google. The difference here is that DropBox use Amazon and it is Amazon who have signed the Safe Harbor agreement, not DropBox. I would ask Becta about it ... but ... Tony, did you ever hear anything back from DropBox? Do they have plans to sign the safe harbour agreement, and would that be enough to satisfy the law? I'm looking at their team accounts, could solve a lot of problems.
GrumbleDook Posted April 1, 2011 Posted April 1, 2011 Nope, not a word. Now I have had a prod I will get onto it again.
LeMarchand Posted April 1, 2011 Posted April 1, 2011 One of the "creative thinking" people in our LEA has told teachers to get accounts so that they can access shared files. I'm betting that the level of thought that has gone into it is: "It's free, it should work" - i.e. no thought given to security, data protection or the T&Cs of Dropbox. Doh! Just noticed the date of the OP!
CHR1S Posted April 1, 2011 Posted April 1, 2011 You have to make sure that the dropbox servers are in the EU, else you'd be breaching data protection laws. This is a stupid rule, how many companies don't have a data centre in the US nowadays? The data is encrypted, what's the issue? All files stored on Dropbox servers are encrypted (AES-256) and are inaccessible without your account password The Amazon S3 service is part of the safe harbor programs, dropbox being an API for S3 should make no difference.
localzuk Posted April 1, 2011 Posted April 1, 2011 Its all to do with data protection and ensuring that data is held in compliance with EU privacy laws. If the company hosting in the USA can provide assurances that it will provide data protection to EU standards under their 'Safe Harbor' scheme then its fine, but most dont.
CHR1S Posted April 1, 2011 Posted April 1, 2011 But isn't this irrelevant if its encrypted? Unless they are decrypting your data and selling it off?
localzuk Posted April 1, 2011 Posted April 1, 2011 But isn't this irrelevant if its encrypted? Unless they are decrypting your data and selling it off? The fact still remains, that your private data is being stored outside the EU. Therefore it is not subject to EU privacy laws. What's to stop the company from changing its policy, unencrypting everything and then harvesting details from it? You'd have no comeback in the EU. 1
GrumbleDook Posted April 1, 2011 Posted April 1, 2011 Even though Dropbox use Amazon, there is nothing in your agreement with them to say they can't move to another provider who doesn't have a safe harbor agreement. If you fail to address this then you are not taking reasonable measures, are in breach of the DP principles and are the person who will carry the can should a complaint be made (not even a breach ... just a complaint!)
enjay Posted April 1, 2011 Posted April 1, 2011 Even though Dropbox use Amazon, there is nothing in your agreement with them to say they can't move to another provider who doesn't have a safe harbor agreement. On that note, what happens when a company who has signed Safe Harbor is bought out by one that hasn't? In some instances, the customer might not even know this had happened, which would see them inadvertently breaking the DPA.
vikpaw Posted April 4, 2011 Posted April 4, 2011 interesting discussion. what about alternatives tech_guy? like google, live@edu / office365 . . . these are then linked to other useful systems such as email...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now