maturelady

Just something light hearted and an attempt to humanise data protection! Make sure you get to the 12th Day of Christmas Please share https://vimeo.com/487153501 MERRY CHRISTMAS

You are right tj2419 to be looking for different data protection training for your staff. Your kitchen staff may handle biometric data, dietary needs and medical allergies, whilst teachers in the classroom might only manage curriculum data, names and classes. The important thing is to train each group using scenarios which mean something to them. How often do we experience 'generic' training which becomes totally irrelevant and boring? ICO is clear about training https://ico.org.uk/media/about-the-ico/disclosure-log/2018/2259541/irq0742288-disclosure-8.pdf I'm sure you all know about it but just in case - the 2nd generation of the DfE group which wrote the GDPR Toolkit for Schools has a website which has loads of free resources and more added daily. There's some good stuff here. Education Data Matters Doesn't answer your question but I hope something helps.

@Nausing well done Make sure you get sight of the report when it arrives. Be aware that first glance will shock you by the number of their suggestions. However, nearly all will be happening or high on your list and it really will help you focus.

@Nausing - let us know how you got on today with the visit

Stop panicking - they are not random visits. I have spoken to ICO and the schools that have had visits and all had contact with the ICO - asking them questions or for advice. ICO does suggest they might visit but the school can say No. Someone has said Yes in your case @Nausing I have been in contact with 1 school through the whole process from notification, completing the pre-visit questionnaire through to the final report. I am currently putting together a document to show the experience of this school. The visit focuses on best practice. ICO will probably find things wrong but you can learn from it. I'll share what I have learned as soon as its finished

Rockstars Ts&Cs are very good indeed. Their SCHEDULE TO GENERAL CONDITIONS, DATA PROTECTION WITH SCHOOLS is very clear and easy to understand. The only issue is that which you have identified, in section 2.6. In this they are telling you, the data controller, which legal basis for processing you must use. This is wrong. As data controller it is your responsibility to ascertain which legal basis for processing you are relying on. That section should be asking you to warrant that you have identified a legal basis for processing. I will personally contact this company and share my thoughts with them. I can't see enough about Educator to comment but it looks similar. My belief is that these companies have correctly taken legal advice. However, as soon as these legal advisors see the word 'child' they presume consent is the only route. Lawyers such as Michelmores, who specialise in education law would not have given this advice. They understand how schools work and how the law applies in this sector. I am now starting to see a lot of confusion with suppliers. Many simply do not recognise that they are data processors. As we said sometime ago this is a long journey we must take together, my company GDPRiS will help wherever we can but we're not magicians!

Well your system suppliers are wrong! I was part of the team that helped write the DfE ToolKit. I hope we made it very clear throughout to avoid consent whenever possible as it can be withdrawn at anytime. Use another legal basis for processing and in most cases this can be Public task/interest. I am happy to take this up with any supplier. Point them to our website https://www.gdpr.school or ask them to drop us an email [email protected]. We have produced free resources for suppliers to help them help you.

Sorry meant to say systems which include special category data need clearer justification than 'we use this to improve the way we run our school', ie finger prints - Biometric data - can the system run without using this? Yes - thus consent required allergies - Medical data - can a kitchen feed this child without knowing this data? No - public task Again you have considered the processing and have recorded your decisions and justifications

It's about asking yourself: "By processing this data am I carrying out the task set to me by the 'public' to educate kids in the best way we know how?" If you say 'Yes' to this question, and your school has decided that by using Show my homework or any other system allows you to run your school in the best way you can, you may use public interest. Students are allowed to object, but you can give a reasonable and clear answer as to why you cannot meet their request of not sharing the data. Schools must be united on this otherwise we'll get swathes of kids and parents objecting because they can see it happening in other schools. The most important thing is you have considered the data processing, you are satisfied that it is being used for a public task, and YOU HAVE A RECORD OF THE CONSIDERATION

Yes I think @Gongalong is right. There's been quite a few knuckles wrapped in education but this is the first fine that I can recall. I hope it brings home what constitutes a data breach. This is not about data collected today, this data was collected many years ago and just forgotten, left 'somewhere' online. How many teachers or even ex and retired teachers have very sensitive data still sitting on their laptops, data sticks, DVDs, or even floppies? You can argue that you can't be responsible but you are - the school is the data controller. This university was fined under the CURRENT DPA introduced in 1998 not GDPR. If you, as standard practice, ask staff to clear out information they don't need or not entitled to, as part of your current DP process you are in a better position. We are a profession and expect employees to carryout instructions. This is a very good example to use as part of your whole school GDPR training.

Yes, we all know that it would have been better if it had come sooner, but I'm sure most of you that are already complying to the DPA will be reassured that you have been doing the right thing. The document has been passed by lawyers and ICO so it's a very good foundation now. The message is clear - May 25th is the start, not the conclusion. Compliance is subjective and by demonstrating that you are doing something is a huge step towards this. Feedback is invited. I hope you will help. Sorry - I posted too I've remove mine

We have in excess of 100 data maps for major suppliers ready for uploading. We've held back uploading them until we have had details about the structure DfE expects from suppliers' maps. I have that now and our files are good to go. That's our job over the Easter holidays and we will publish the list at the beginning of the new term to our users. In addition to that we have a full mapping structure for EVERY supplier type, eg payment, cashless, curriculum, trips, etc We are not too worried about MIS suppliers; all major suppliers including SIMS have published their GDPR preparation plans. The maps will be very large, these suppliers need to decide how best to present them. Reports are now available on the platform and will be evolving as you tell us what you need. You can report on all your maps for things such as - where is sensitive data, who uses it, and why.

Yes I think you are right It should read as you suggest or: "particularly as legislation is now passing through the parliamentary process." I'm sure its just a typo

As promised here is the DfE open letter addressed to school suppliers outlining GDPR expectations. PLEASE DIRECT AS MANY OF YOUR SUPPLIERS THAT PROCESS PERSONAL DATA TO IT https://www.gov.uk/government/publications/data-protection-changes-letter-to-the-supplier-community GDPRiS is offering a free service to suppliers to map their data whether their schools use our system or not. Ask them to contact [email protected] for further details.

No it has to be signed off by the DfE I assure you Edugeek will be first place we'll put it - I'm hoping sometime this week