EdWhittaker

In principle, yes. You would be advised on the basis of current legislation. However, one would have thought that, were things to be radically different then the advice would include the phrase "However, under GDPR ..." I think the important thing to note, though, is that there is no reason to believe that the ICO will not continue to take a reasoned and pragmatic approach to the issue of archived data when GDPR becomes law.

Here is a link to the full document: https://ico.org.uk/media/for-organisations/documents/1475/deleting_personal_data.pdf

I have spoken to the ICO about this and they do take a very pragmatic approach to the issue of deleting data from backups. Here is the advice: Putting information ‘beyond use’ "The ICO will be satisfied that information has been ‘put beyond use’, if not actually deleted, provided that the data controller holding it:  is not able, or will not attempt, (my emphasis) to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;  does not give any other organisation access to the personal data;  surrounds the personal data with appropriate technical and organisational security; and  commits to permanent deletion of the information if, or when, this becomes possible. We will not require data controllers to grant individuals subject access to the personal data provided that all four safeguards above are in place. Nor will we take any action over compliance with the fifth data protection principle." Again my emphasis at the end there. So, as long as the backup is held securely and you undertake not to retrieve personal data deleted from the live system and the data will be overwritten at some point in the future, then no-one is going to jail.

Good point! We have a few schools in Wales. Can't see the advice being much different though? (help? How?)

Following on from a thread started some time ago by GREED regarding the use of UPN by third party providers, DFE have finally come up some explicit advice on the subject. I'm afraid I'm a bit late coming to this, the new guidance was published middle of December. Anyways, if you've not seen it it's here. The relevant section is 2.2, which opens with "Where a school (or local authority) has entered into an agreement with a third party for the provision of an education related service or system then it will be permissible for the UPN to be used within those systems in accordance with the usual transfer controls." Hopefully this now puts the issue to bed.

Here is some clear, up-to-date advice direct from the ICO. I found it useful. https://ico.org.uk/media/about-the-ico/consultations/2014789/draft-gdpr-contracts-guidance-v1-for-consultation-september-2017.pdf

I found this a useful read. https://ico.org.uk/media/about-the-ico/consultations/2014789/draft-gdpr-contracts-guidance-v1-for-consultation-september-2017.pdf

@GrumbleDook @GREED and everyone Ha, Sod's law in action. Shortly after I posted the above comment, I received this from DFE: "Thanks Ed and your comments below are useful. We are hopefully that an amended UPN guide will be made available on GOV.UK shortly and this should hopefully contain the clarification you request. The guidance has been updated and is currently undergoing final review and sign-off before publication." I have asked if they would be kind enough to give us a heads up when it's live. Hopefully can put this thread to bed, one way or another, soon.

I emailed Gary Connell at the DFE a week ago asking if he could make his clarification more widely available through, say, an update on the DFE website or something. No response so far.

okay, will do (not holding breath waiting for reply!)

No, indeed that is true. However, what we have received from the DFE is a very clear clarification of that guidance. If anyone chooses to disregard that clarification, which to my mind is unequivocal, then that is of course their prerogative.

@GREED and everyone: Further clarification from DFE has been received by a colleague as Follows: "I do not believe the advice above contradicts the currently published guidance but do accept that specifics about sharing UPNs with software suppliers is something which is not explicitly covered within the current guidance. The Department have already planned during the coming months to review the current UPN guidance in collaboration with sector representatives (particularly concerning the advice about adopted and looked after children) and therefore we will feed your concerns into that process to provide a coordinated single update to the overall guidance. From a legal perspective, it should be noted that currently there is nothing specifically set out in data protection legislation which specifies how the UPN should be used other than the usual provisions of the Data Protection Act 1998 that apply to all personal information and therefore the UPN guidance provided by DfE is driven by policy for which I am the owner. I therefore have the authority to confirm that, from a DfE perspective, it would be permitted to make UPNs available to a third party who are processing data on your behalf for the purpose of providing your school with an education service / system in accordance with the usual transfer controls. However DfE have no involvement in the particulars of agreements between individual schools and third party software suppliers and therefore, ultimately, it would be a matter for you as data controller to make an informed judgement as to the appropriateness of sharing in this circumstance. So, in summary, as owner of DfE UPN guidance I can confirm that there is nothing in there that would prevent sharing UPN with a third party software supplier who are processing data on your behalf for the purpose of providing your school with an education service / system. However, ultimately, it would be a matter for your school as data controller to make an informed judgement as to the appropriateness of sharing in this manner." Gary Connell Head of Operations Education Data Division (EDD) Department for Education So, now we know.

Well, it's not actually as simple as you make out. When there is a commonly agreed alternative with a consistent format across all MISs then we'll use it. And... er, you effectively have a UPN by another name so, as Grumbledook noted earlier, doesn't that put you back to square one? Anyway, not being rude or anything, but sounds like you don't want the responsibility of making a decision. Not everything in life is cut and dried; sometimes we have to use our skill, training and judgement.

The problem is that the DFE have NOT said no. They say that the decision is ultimately down to the data controller, provided they are satisfied that suitable conditions and precautions are in place. Third party applications can viewed simply as extensions of the school MIS. Ok, the data may not actually physically be on the school premises (but then neither is it with some MISs); but data security aside, to all intents and purposes it might as well be. I say this because the service provider has no rights on the data, they can't just do with it whatever they want. Data is coming out, being processed in a defined way, then returned. Because the the guidance from DFE is not explicit and concrete it can be interpreted, and indeed misinterpreted, according to whatever axe you have to grind. If you really don't want providers to use the UPN, then you could argue that; if you don't mind, then you can argue that as well. However, for my money, any disinterested, impartial reading of the guidance would come down on the side of there not being any specific interdiction on the use of the UPN. There, see, I said it.

I'll be interested to see what they say. When I have contacted the ICO in the past their advice has usually been along the lines of 'Well, it depends ...' and 'Well, that's up to the data controller ...' so it'll be interesting to see if they come with something more concrete.

That guidance on p17 refers specifically and explicitly to use of UPN and associated data in educational research and so is not really relevant to the current discussion. A discussion that, as has already been noted, is a result of the DFE guidance being somewhat open to interpretation. I suspect that the DFE 'clarification' as received by GREED is deliberately fuzzy because they don't want to get involved and are basically pushing the buck back to the schools. One could argue for ages about the precise interpretation of each word or phrase in the September 2013 guidance, but you could end up just dancing on the head of a pin. For me the two key things for a 'sensible' interpretation are; first what is the context of the discussion and secondly what interpretation would a 'reasonable' person (the Man on the Clapham Omnibus) put on it? Context: a school wishes to share personal data (including UPN) with a SAAS Service Provider with whom they have a clear data processing / sharing agreement. The school is satisfied that the service provider has taken all necessary steps to keep the data secure. Now, given that context, how do we interpret this para on p7 of the 2013 guidance? "The UPN must be a ‘blind number’ not an automatic adjunct to a pupil’s name." 'Blind' in this context means not routinely displayed i.e not visible to the casual user and not printed out. "It must be held electronically and only output when required to provide information to the LA, central government or another school/academy to which the pupil is transferring." Well, it's clearly held electronically; but what does 'outputted' mean? In the context of the statement, it implies either printing onto paper or into an electronic file (CSV, CTF) from where it would be visible. As this would not happen in our scenario, is this caveat relevant to the discussion? "Under the Data Protection Act 1998, the UPN is designated as a ‘general identifier’ making its use for any purpose unrelated to education illegal." If the school's interaction with the service provider is not for the purposes of education, what is it for? "A pupil’s admission number, rather than the UPN, should be used as the general pupil reference number on the admission register or paper files." In other words, if you are printing out an exam hall seating plan, and you don't want your 3 John Smiths mixing up, print the admission number, not the UPN, on the sheet. When interpreting any sort of guidance, context is of paramount importance.

Doh! Sorry, I misread that as a quote from elsewhere. :-/

Hi Graham Have you received any official feedback from the DFE yet?

Ah! I'm using Chrome. I'll check Edge and Firefox. Cheers!

Yes, online pdfs. With previous versions of Windows you could just right-click to print. With W10, if you right-click the 'Print' option is still there but if you click it you are prompted to save rather than have it print. I've had to put a 'Temp PDF' folder on my desktop to save them to. In 90% of cases I don't want or need to save the file, just print it. I'm assuming there must be a pressing reason for this change rather than some guy at Microsoft saying 'Hey, I've got a great idea ...' ? :-/

This is driving me mad! Am I missing something or can you no longer right click to print pdf files? With previous Windows versions you could just right-click the page, choose Print and there you go. Since upgrading to W10, I now have to save the file, then navigate to file location then print form there. Any suggestion guys?

Got delivered in the end after wife called Yodel and asked them to point out the bleedin' obvious to the driver - which, to be fair, they did - so got it last Monday (Just in time for my birthday, which was nice :-)

My wife has stuff delivered to school as we're both out all day. The address is clearly 'at XXXXXX High School' yet last week Yodel tried to deliver a parcel twice; once at 8:30 pm and again at 10:30 Saturday morning! Doh!

Hi One of our customer schools went with Progresso at the start of term. They've had what they describe as 'a nightmare' and have hurriedly reverted back to CMIS. I don't know any details.

Another reason to withhold teacher comments is that very often they are written in the heat of the moment and things might be written that the teacher doesn't really mean, just venting their anger and frustration. Whatever the legal or other arguments, my advice would be don't send teacher comments out unmoderated.