pcstru

I'm getting emails about courses, training etc on an almost daily basis. You could say the current law is designed so that we fail - at least if you look at it from the POV of compliance. Schools are rubbish at DP (part of the reason why GDPR is such a hill to climb), many of us live in a "everyone does it so it must be OK" cloud of false security.

In terms of liability arising out of any breach, you are likely to face questions of competency. You could look at use of an MIS as essentially managing the risk by offloading it to the MIS supplier. As experts in the field of both developing and the use of a vertical market MIS, it is likely to be seen as reasonable that they should have such competency. A tech in a school, a couple of developers in a MAT - with the best will in the world - probably not so much. As with all 'risk' - it's only a problem if "stuff" happens to you. Mostly "stuff" happens to other people so folks don't worry. It's almost ... Bayesian. The real problem for everyone is very simple. Technology is a bit rubbish - the miracle isn't that it comes with built in machine learning driven BI cube sharding & partitioned to deliver Value insight straight to the executive dashboard, the miracle is that any of it works at all. If you expect an MIS to allow you to manage the information that is needed by a school in a vaguely reasonable fashion (if you squint a little - it helps a lot), your expectations might be met. If you expect an MIS to put on a plate, everything you need to meet the expectations of a typical large secondary schools SLT, right now, that is probably unrealistic. A bit of work is needed to make the reality of an MIS and the needs of the individual customer meet in the middle. Usually, quite a bit of work.

I've read through a lot of the detail now and I don't see anywhere where they supply information on the data they hold; we are assumed to know and be able to work it out via the tools in the domain control panel. If you know different - please say. I'm concerned about data which can be grabbed by google when (say) setting up a new device. So if they use their android tablet and set it up using their school GAE account and have the device set to back up settings to the cloud, is that data that we control as the data controller of the service?

I agree with a lot of what you say but the bit I've bolded is not obviously true. Being able to record assessment data and analyse that data is so fundamental to a school in the performance of their duty that I doubt it needs explicit consent other than the choice to come to the school or not. It will need to be notified and tracked which will be an unwelcome constraint in most schools.

Can students not submit work to a shared area (surely less work than a teacher ploughing through 30 student shares trying to find which folder has the homework)? What do they mean, "mark work"? How old are the students? How good is the AUP agreement? Are there other paths TPTB are trying to get people to use - google classroom, show my homework etc? Technically, it should be a matter of having suitable OU's, Groups and then setting permissions. Perhaps the requirement is getting mangled? "Mark" sounds like write access - which can be problematic (even if you can audit every write). In a primary that may not be an issue, in a secondary, it starts to be an issue and in a 6th form, even read access should be unnecessary. As with all 'oversight', there is likely a need to do some kind of Risk Assessment and Privacy Impact Assessment that covers the access at some level (how good is that AUP). Even with read access, a really paranoid geek (hi there!) might worry about : students storing code which teachers run and which potentially allows privilege escalation and/or compromise of the endpoint. That should just be a matter of everyone understanding the risk but sometimes that is ... tricky.

The key difference between a user owned device using 4G and that device using our network is that when we are providing a connectivity service, we have a duty of care involved. Do we have a duty of care to someone using their own equipment and their own connectivity? If we do, I'd be interested what makes that so. I agree. Here we have a little committee that can deal with any difficult blocking decisions but that is a different issue than allowing access to extremist content specifically so it can be monitored - which is what you seemed to be saying.

Sorry, but I can't parse that. "It is not Sufficient to Block" suggests that you should block and do something else. If the something else is monitoring, then in order to monitor, you would have to leave the site unblocked. It cannot be right that we leave such sites unblocked so that we can monitor who is looking at the content.

It does not address the points I made. SIMS have an 80% market share in England and Wales, as much as anything because they were early to market. That also encumbers them with supporting a legacy that is both broad (people pushing the database functionally right now) and deep (people with historic data which it is difficult to cater for in any migration while retaining quality and utility). So any claim to the product being overpriced has to speak to the particular challenges they face and the costs of supporting that. Most people underestimate the relatively simple challenge of developing a new MIS from scratch! SIMS have the horror of having ~20,000 customers to maintain, move on and eventually, migrate. That ... has to be a whole new level of difficult. ETA - I'm not saying anyone is or is not providing value, what I am saying is that value is not evidenced just by market share or the product cost.

Yes it will bypass SIMS permissions. I do not know of any MIS that enforces user permissions at the schema level, it is all application driven so any direct access to the tables will simply ignore any permissions set in the application.

There are a number of reasons why not - they may or may not be surmountable for you. Video of students will count as personal data, so will need to be processed and controlled accordingly. You will obviously need permission from the students/parents. I've not recently looked at the T&C's for YouTube but I'd anticipate some potential issues there if the usual rights are granted as part of accepting the T&C's - I'm not sure how granting other parties substantial rights over distribution and use of that content sits with the need to have them act as a third party data processor (how would you get them to sign any data sharing agreement?). It is all very murky and difficult so probably most schools just stick their heads in the sand and just do it anyway.

Search for : range heating stove. Is that the kind of thing? What fuel type? The big ones tend to be somewhat inefficient, a bit of a pain to cook with (although if you like slow cooked stuff and make your own bread they might be quite useful - and perhaps in the end you just get used to the constraints), and leave you with a toasty kitchen. I've two small wood burning stoves with single hot plates on them, one of them does hot water. I've never cooked on either of them, it would look cute but probably just be a pain!

I sort of of understood that - but it is wrong. The reason you are processing their data is to communicate about a (say) fund-raising event. That processing and the fairness of it does not change just because you communicate via email, rather than letter. You can't say the processing becomes fair because the cost goes down (or even if it went to zero). What processing costs you does not impact the rights of the data subject and there is no basis to claim that such processing could be justified by claiming "public interest".

AIUI A "Public Interest" as it relates to GDPR will need to be backed by law, i.e. your bring and buy sale or other event is somehow enacted in EU or UK legislation.

I think it is a good start but I think we will need to get down to field level in some instances. If aggregating into collections, I'd look at people entities - Staff, Students, Parents, Contacts, Members of the Public and then start to break down into functional chunks like Contact Data (Addresses, emails, telephones). There is an issue that the same data might be processed in a number of different ways, requiring different basis - for example you will process contact information to send reports which might be "legal compliance", but if you also send out invitations to events then that is just marketing and will need to be done with consent.

Ah, right. Could you link to that price/feature comparison? It would no doubt be of interest to a number of people here and anyone thinking of changing supplier. I'm not sure how it will evidence the production costs but it would be interesting nerveless. I'd have to say that when we did a comparison during the supplier selection phase of our MIS replacement project, it wasn't obvious that any supplier was providing significantly more or less features than any other - especially when it comes to reporting. Our choices were more about usability ease of use. In terms of cost, it is not surprising that (say) Bromcom with a web service is cheaper than SIMS delivering multiple technologies all of which have to talk to a single database, so saying one is overcharging on the basis that they both deliver the same broad feature, is likely specious.

Your original point said "My point at present is you have a premium price wihtout the premium functionality". The BECTA report does not evidence that, rather it says that LA's were not procuring MIS systems in a way that complies with EU competition law. I think to say that MIS systems are overpriced and under deliver, you would need to know about the cash flow of the MIS delivery process. You are basically saying they are charging too much. Having worked in similar large scale software development, I think people (including MIS providers (CMIS->Progressso, or how about SIMS 7?)) hugely underestimate the effort required for the delivery of those products to an acceptable quality.

BECTA saying LA's are not doing procurement correctly, is quite different to saying the providers of the MIS are not providing products that give value.

I think my point would be that suppliers need to help us to understand the consequences of the technology their are supplying. It was not obvious to me that using Impero in a school to monitor our chromebooks (as I saw the use case) actually involved the possibility of Impero software downloading and installing itself on a users computer and then, functionally causing them an issue using their equipment. I appreciate there are functional constraints with GAE that mean everyone can happily say "well, YOU should have known" or toss the blame ball around between google/impero/school. I find that a little odd. You have no problem advising schools on Safeguarding, Prevent and other matters involving compliance with their legal obligations where your software enables that compliance. AUP's are essentially something we need to comply with legislation that is common to all of your customers simply for them to be able to use the software legally. I'm curious as to what exactly prevents you from offering such advice? I believe you have a duty of care to your customers to help them understand the normal consequences of their use of your product, especially where it might lead them to be in breech of legislation that might involve criminal offences. I would not envisage it doing that in a lesson (unless the software has yet to be properly configured and no one has turned that particular warning off or set it to occur (say) once a term). It needs to figure out where it is and who is using it - can it talk to the GA domain to query the info in the OU? It is only where it is unable to phone home and in an indeterminate context that the default needs to be intrusive. If it can phone home and figure out if it is running on a managed device then we can have it make sensible decisions about what it should do and how that relates to what users have agreed to in any AUP. Thanks. I did have a look and I could not see anything. Compliance with things such as The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations should be/is part of a good implementation at any school. Privacy and snooping in schools is a sensitive issues and have a lot of potential to blow up. IMO it is probably cheaper to put together a few guides than deal with the cost of managing the impacts those guides might prevent, let alone the costs involved because the brand gets tarnished and impacts sales. It's not just good risk management for you, it would actually add value for your customers.

There are a lot of potential benefits to decoupling reporting from transactions. You can then build intelligence in that makes access to information easier - an example would be partitioning & sharding data in MAT so that users in individual schools only see data for their context (potentially then reports etc could be shared without anyone needing to dip in and alter filters). However good the MIS, it's application in a particular environment will be particular to that environment. Some schools make really good use of their MIS, some ... less so. The software provider will never be able to cater individually to all of those needs (they must cater on mass to meet ALL of the needs), so there will inevitably be bolt on products you can buy that can add value. The existence of those bolt on products doesn't mean the MIS providers are giving poor value to their customers. You would surely need to have a good handle on their cash flow to evidence that?

Thanks for the response. I appreciate you may be constrained by Chrome in terms of deployment. Part of the reason this came up is they were then prevented from changing user. We reproduced that and quickly found a workaround (which I can't remember - it's been a long day!). I think it would be useful for Impero to have supporting documentation that helps schools manage risks associated with privacy, monitoring and data protection legislation. Mention of that while running an installation would be good but the crown would be supporting documentation on systems implementation - i.e. all the the stuff like AUP's and policy that have to be in place to minimise risks which are associated with using monitoring software on students and potentially staff (the two are quite different, you need to be much more diligent to use the functionality on staff). If this kind of thing already exists, please point me at them. I'd hope, given the fact that we are not monitoring students on their own property and that deployment is constrained by ChromeOS/GAFE, that we aren't at much risk - other than than looking silly, what with all the egg dripping off our cheeks. I am still a little concerned that there is some way for this to bite us all. I'll be happy to be wrong. A potential help in the longer term would be for the app/extension to figure out it's context and perhaps offer some information to the user, on why the software installed, what it does, whether it is operating, who to contact for information etc.

There is nothing in the Data Protection Act that compels you to delete data simply on the request of the data subject, they would have to show that processing causes unwarranted and substantial damage or distress. This will change somewhat under GDPR but the right is still not absolute. Data held on backups is data under both - so if the circumstances warrant deletion, then backups will be in scope. It may be reasonable to actually handle the deletion by disbarring further processing and allowing the data to expire naturally.

Yes I've used Crystal. It is the same issue - the MIS will be 1000 tables - figuring out where your data is and how it all joins together can be ... err ... fun. I've so far done Bromcom and CMIS from scratch, SIMS and ONE I had sneaky inside info on so a huge head start. The other thing that will also happen is that if you report directly off the tables, upgrades are likely to break your creations (and that will of course become apparent at the most inconvenient times!). I write SQL and query directly using VBA and powershell. It is possible - just a matter of someone having the right skills and the time to investigate how the tables hang together. It is not trivial, has lots of got-cha's and is costly (in expensive expert time).

Really? Chrome apps have no ability at all to be controlled at the device level rather than the user level or a combination of the two? If so I guess then there is no way to stop the app deploying but the app itself must be able to make a determination, it just needs to ask should I be running for this user on this device rather than just should I run for this user? Without notifying students and parents that this could happen and having their agreement, there is potential for someone to make a complaint under the computer misuse act. That's potentially a criminal matter.

Impero offer monitoring of chromebooks via a chrome app and extension. The instructions for install say that the apps need to be applied on users not devices, so we apply to our student OU (we do not monitor staff). Students logging into chrome at home are finding the impero app and extension installing itself onto their home machines when they log into google as users of our GA domain (we have reproduced this). This is causing issues - it can prevent them from changing user (which is a software defect) and obviously they and their parents are right to be concerned that we might be monitoring them on their home computers (we are not but we are causing them an issue when they then can't change users). Anyone encountered this and have a solution? I've spoken to Impero support but I'm not entirely sure they understood the problem or why it might blow up as a bit of a thorny issue. So far I have no solution or workaround.

Any direct access to the schema of a modern schools MIS will be problematic. Typically, the schemas are many hundreds of tables and finding the tables you need and their relations is not a simple task. Ideally, if using a 3rd party reporting or analysis package, you want a layer of abstraction that removes unnecessary detail and is well documented. Otherwise you are into reverse engineering a complex schema, which even if you have the skills to do it, is time consuming.