EduDataPro

I'm working on a DPIA for some schools looking to migrate to SIMS Connected but have yet to see it first hand. With it being cloud hosted I'm concerned about the additional risk of accounts being accessed due to weak or found out passwords. Is there an option for 2FA/MFA? I know it is available with SIMS ID but I'm not clear if SIMS ID is used to access SIMS Connected or if it is an separate product/optional extra. As well as security and the connection and speed issues I've read about here, any other additional risks/issues specific to 'Connected' that first hand users have come across we should include in the DPIA?

Thanks both, useful information. I didn't know that about being allowed to continued to use SIMs without paying for a license, although there would be a cost and risk of hosting a legacy SIMs box for 10+ years and expecting it to power up in the event of needing to access historical data. In this event I was partially right about the limitations of the import. I spoke again to the new MIS provider, and they confirmed that they are using CTFs to transfer student records, and whilst it doesn't include all the raw attendance data, it does transfer a summary of historical attendance. For the purposes of GDPR and potential future SARs I consider this to be sufficient. They won't be able to confirm if child X was at school on a particular Tuesday 5 years ago, but they will be able to provide attendance percentages if required.

Thanks, I'll check with them again, I understood that not 'everything' was going to be transferred, I may have misunderstood.

I am working with a primary school who is moving away from using SIMs. The CTF files that will transfer to the new MIS are only partial data records and they don't include all historical data such as attendance data. Because of this the school should be able to access the full historical data records until 25 years from DoB (longer for SEN data). I am looking for a way of being able to access the historical data without them continuing to hold a legacy SIMs server and presumably have to pay for the license. How easy would it be to write a script to extract all users PDO reports and store them securely in accessible .DOCX format in case of any future SARs? Ideally the PDO filename would contain year of birth so they could be sorted into folders for future deletion.

Thanks guys, some clarity from the Google UK Edu team would definitely be useful. I'm surprised it's 'Under 18' not 'under 13', as COPPA applies 'Under 13'. Also for the 'additional services' they say the standard Google privacy notice applies which would infer it was useable by those 13 upwards like most other Google offerings.

Picking up on this thread from last year, is anyone using 'CS First', and if so are you getting parental consent? It's an 'additional service' outside of Gsuite so according to Google, schools should 'get parental consent before allowing these users to use CS First' however according to this help page https://support.google.com/csfirst/answer/7476833?hl=en&ref_topic=7477412#privacy_policy the data sharing required to use it sounds to be restricted to their Gsuite creditionals (see below), and even this has a workaround if you use the option for creating anonymous logins. Bearing in mind in theory schools should be gaining parental consent to use any 'additional services' including Google Maps, does anyone know of any UK school that does this? But similar to CS First I would expect the user data shared with Google Maps is pretty limited, so it's less of a GDPR issue and more of a breaking the Google agreement issue. ------------- Our website is governed by the terms and privacy policy listed on our website (bottom of each page). Additionally: Students may sign in to CS First using a G Suite for Education account or they can create a CS First account with a randomly-generated username and password, but they cannot use a personal Google account. Google does not ask for any personally identifiable information from students through CS First. To preserve student privacy, names added to CS First accounts in your teacher dashboard are stored on your computer and browser rather than on Google's servers. source: https://support.google.com/csfirst/answer/7476833?hl=en&ref_topic=7477412#privacy_policy The agreement info from CS First: CS First is an additional service not covered by your organisation’s Google Workspace for Education agreement. This means that this service may collect and use information for the purposes described in our Privacy Notice and the terms that apply to this service. You can learn more about the differences between core and additional services in our Help Centre. If you have end users under the age of 18, your institution is required under its Google Workspace agreement to get parental consent before allowing these users to use CS First. More information that your institution can share with students and parents about Google’s services and privacy practices is available in our Help Centre. You acknowledge and agree that you will comply with all laws and regulations that apply to your provision of CS First to your end users, including, as applicable, the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA).

Has anyone seen any updated guidance on this subject? I've seen this release from the 'Exams Office'. Makes interesting reading, they aren't quite right around SARs, e.g. SARs can be informal and don't always include all the data you hold on an individual. https://www.theexamsoffice.org/wp-content/uploads/2020/07/Article-12_Sharing-student-data_grades-and-rankings_updated-7-July-FINAL.pdf

Yes Enterprise accounts including 'Enterprise for Education' users. Good point on the lack of UK data centre, I thought there was one in London but it's Dublin only. https://www.google.com/about/datacenters/locations/

Message going out to all admins shortly:

Similar to Office365, Gsuite Education accounts can set their 'geographic location for your data' in the admin settings https://support.google.com/a/answer/7630496?hl=en. Settings can be 'no preference (default), Europe, United States'. No option currently for 'UK'. I understand that Google will be sending out a message to all admins shortly confirming that Gsuite for Education core services are not affected by this change of jurisdiction.