Data Protection Act Principles... Practical Examples/Breaches?

[Gongalong]

Hi All,

 

I'm putting together some training on the Data Protection Act.

 

I would like to provide some practical examples of Do's and Don'ts alongside the no-doubt-yawn-inducing 8 principles. Some principles are much easier than others and/or my creativity is drying up, because I'm stuck for providing examples for 1, 3, 4, 5 and 6. Can anyone think of something(s)?

 

Also, does anyone know of any ICO breaches in relation to schools which were specifically in relation to a principle? Again, I was thinking this would focus people's minds if they could see where other schools had failed.

 

Any assistance much appreciated.

 

TIA

[GrumbleDook]

Where to start ...

 

I am presently writing a report on this, and I was thinking about including a list of schools who have signed undertakings. This might be a tad harsh on those schools though, especially if they have changed where they went wrong. You would have to go through each undertaking which has been signed by a school and analyse exactly what went wrong. This can be gathered from the ICO, of course, by requesting the information via a FoI request ;-)

 

A good place to start on the training is the previously issued guidance from Becta ... still available via the National Archive site. (The last cut is available at [ARCHIVED CONTENT] Becta Schools - Leadership and management - Data management - Data handling security guidance for schools)

 

The ICO has also recently released a very good report aimed at schools which might also answer most of your needs. ICO news release: Report offers school data protection advice

 

I hope this gives you a good start.

[Gongalong]

Thanks for the reply. Ah yes, I have the Schools report (very useful!).

 

I was thinking that real world examples would (a) be more interesting than the rather dry repetition of the principles and (b) hopefully drive home in some staff at least that these things really happen ("would you like your school to have this headline, which people will forever find with Google?"). This was in addition to some general do's and don'ts, which is the other part I'm struggling. Perhaps sifting through the real world examples will liberate some more general advice for each principle. Googling "ico breach school" brings up a fair few to start with.

[pete]

Thanks for the reply. Ah yes, I have the Schools report (very useful!).

 

I was thinking that real world examples would (a) be more interesting than the rather dry repetition of the principles and (b) hopefully drive home in some staff at least that these things really happen ("would you like your school to have this headline, which people will forever find with Google?"). This was in addition to some general do's and don'ts, which is the other part I'm struggling. Perhaps sifting through the real world examples will liberate some more general advice for each principle. Googling "ico breach school" brings up a fair few to start with.

 

I just tend to screenshot the more idiotic school/local gov breaches when they pop up in the news and store them in my "useful images for docs" folder. Search El Reg / BBC for "breach" or whatever, follow the link to ICO / local paper website and screenshot.

Edited November 21, 2012 by pete

[GrumbleDook]

Thanks for the reply. Ah yes, I have the Schools report (very useful!).

 

I was thinking that real world examples would (a) be more interesting than the rather dry repetition of the principles and (b) hopefully drive home in some staff at least that these things really happen ("would you like your school to have this headline, which people will forever find with Google?"). This was in addition to some general do's and don'ts, which is the other part I'm struggling. Perhaps sifting through the real world examples will liberate some more general advice for each principle. Googling "ico breach school" brings up a fair few to start with.

 

I'll have to check whether I can release the info I hold (which I gained from the ICO) as I have to abide by DP / FoI with my info too ... it might be quicker to ask ICO directly.

[Gongalong]

Pete: yes, screenshots of newspaper headlines was exactly what I was thinking of. I had only got as far as ICO press releases, which didn't quite have the impact, but it was a start at least.

 

GrumbleDook: understood.