Use of UPN by third party sites

[localzuk]

I'm trying to figure out what the rules on use of the UPN as a unique identifier are within the context of third party sites (eg. hosted services such as I Am Learning, Sam Learning etc...).

 

As far as I can see, the rules/guidance classifies the UPN as a sensitive piece of information and also states that it should simply not be routinely used, except in the cases of transferring pupils to new schools and for passing information up to LEAs and central departments.

 

So, it all leads me to believe that we should not be using the UPN if sending information to sites such as those mentioned? Thoughts?

[Linfit]

There is a policy document about UPN's here:

UPN policy and practice guidance - The Department for Education

which gives detail about what it can and can't be used for.

[localzuk]

I've read that, it isn't clear on this situation. It only specifies how a school should use it internally, and how it should use it for communicating with researchers, third parties who are not parents and the LA/DfE.

 

Service providers don't fall within any of those situations really!

[X-13]

I had a quick look at the guidelines, and it isn't that clear to be honest. But that just may be the lack of coffee talking.

 

You could contact the DSG helpdesk and see what the official stance is on it.

 

Depending on whether it's possible to accurately identify the pupil from the UPN I would say no. It it's impssible, then check with your Child Potection officer to see what they think from a CP standpoint.

 

 

DSG Helpdesk:

 

Data and Statistics Division (DSD) Helpdesk

1st Floor Mowden Hall

Staindrop Road

Darlington

DL3 9BG

Telephone: 01325 392626

Email: [email protected]

Website

Edited November 25, 2011 by X-13

[Linfit]

We have always taken the view that this line from the guidance is pretty clear:

 

"The Information Commissioner advises that the UPN should only be output to other schools, LAs, the DCSF and other central agencies".

 

so it shouldn't go to hosted services etc.

We had quite a debate about this with our intended Managed service provider when they wanted the UPN as an identifier on our proposed new VLE and we would not

provide it. I also remember dicussing with QCDA officers at intial meetings about the Diploma (I am also our Exams Officer) why ULN's were introduced for Diploma learners

when UPN's already existed, and the reason given was that UPN's could only be used for tracking learners through the school system and could not be used for anything else, so thats

the line we have taken ever since.

[localzuk]

See, that sentence uses the somewhat weak 'should' though. It is therefore a guide and not a rule. If it said 'must', then that would be different.

[rpwillis]

Best response I've seen to this question, which comes up again and again, is from @GrumbleDook at http://www.edugeek.net/forums/security/27074-external-vle-wants-our-upns.html#post264887.