[sims] Teachers sharing SIMS logons

[Theblacksheep]

Excuse my ignorance, is this against the DPA?

 

I was under the impression it was and would like some clarification.

[Jamman960]

Wouldn't have thought it was against the DPA as I assume they all have a good reason to be accessing the data unless they are using other accounts because they hold more access rights than their own accounts.

 

This sort of thing would should probably be dealt with via AUP's etc really

[pete]

It's an offence under the Computer Misuse Act if they're using it to gain additional access.

 

Computer Misuse Act 1990

 

Otherwise it's a HR/AUP problem.

[GrumbleDook]

It is also in breach of DPA too - principle 7.

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Each account on SIMS is allocated to a user based on their need to access (process) data and to use the account of anyone else would be unauthorised. If they have been told by the SIRO / Head to use teh account of someone else then this could be counted as authorisation, but it puts into question the organisational measures, which can (and will) be challenged by the ICO in the event of a breach.

[vikpaw]

It could be okay, if they have the same level of access, as they aren't gaining extra access, which as above is not allowed. The problem is ensuring they have the same access, as it's too easy for someone to be given extra access on request, or if their role changes slightly.

 

To just gain access to basic data, i would say it's okay, and if it's a time saving thing, it could be worth setting up a generic account with the basic access. We did this in the staff room of a previous school, set to auto-login to windows and via AD to SIMS. To save staff needing to log in themselves. This had physical security in place and would be locked or off at night.

 

In a classroom environment, my concern would be the auditing; anyone that can edit data, which even class teachers can do for basic data, there is little auditing of who did what. So if two people use the same account, then how do you ensure the data is safe, and if it gets botched, who is responsible? This would then be a breach.

 

Also, for attendance recording, the system needs to record who took the register and any subsequent changes. I think this is a legal requirement. I have suspected for some time that SIMS doesn't record accurately when a register is taken by someone else, but haven't been able to confirm. So this would be something to be aware of as well.

[vikpaw]

Read on supportnet about a school in southampton area being in breach of DPA for using SIMS single sign on. Anyone explain that one...?

[GrumbleDook]

Read on supportnet about a school in southampton area being in breach of DPA for using SIMS single sign on. Anyone explain that one...?

 

Already covered in http://www.edugeek.net/forums/general-chat/80614-if-we-havent-seen-coming-some-time.html thread ...

[Davit2005]

We got told by Capita that we could not use Generic accounts probably because of Data Protection and tracebility issues. I something dodgy is put on a students SIMS profile the tracebility has dissappered. I would highly advise against generic accounts or sharing of SIMS logins.

[creese]

We got told by Capita that we could not use Generic accounts probably because of Data Protection and tracebility issues. I something dodgy is put on a students SIMS profile the tracebility has dissappered. I would highly advise against generic accounts or sharing of SIMS logins.

 

Logging who did what is limited in the extreme, except in the Dinner Money module.

[Roberto]

I think its incredibly bad practice but, as has been mentioned already, it need not be "illegal" in itself. It contains the potential for bad stuff to happen though.

 

The question I would ask is why are they sharing? Is there a problem there with one person's access or with a workflow that would currently be too awkward otherwise that needs to be fixed.