Hedgehog13

Who was this email sent to? Was it to all schools or just SCOMIS schools?

So who did this email from SIMS go out to? Was it to all schools that use SCOMIS or all schools in Devon etc?

Surely there must be a better way to resolve this dispute? Education Software Solutions (ESS) has asked the High Court to intervene in a row that risks disruption at 1,100 state schools in Northern Ireland. Capita sold the SIMS software to ESS, set up by the private equity firm Montagu, for £400m in 2020 as part of chief executive Jon Lewis’s efforts to reduce a £1.1bn debt burden. The outsourcer continued to provide the software to schools in Northern Ireland under licence, but ESS claims that permission expired in March. Capita disputes this, telling the court it accepted “commercial terms” for an extension of the licence proposed by ESS during a phone call. ESS wants the High Court to declare that no valid extension was made and have threatened to apply for an injunction forcing the software to be deleted across Northern Ireland. Around 1,100 Northern Irish state schools could be forced to delete copies of the software provided by Capita, which ESS claims are effectively pirated. Further information on this dispute and the court claims/counterclaims can be found on the WhichMIS? website at whichmis.com

Surely there must be a better way to resolve this dispute? Education Software Solutions (ESS) has asked the High Court to intervene in a row that risks disruption at 1,100 state schools in Northern Ireland. Capita sold the SIMS software to ESS, set up by the private equity firm Montagu, for £400m in 2020 as part of chief executive Jon Lewis’s efforts to reduce a £1.1bn debt burden. The outsourcer continued to provide the software to schools in Northern Ireland under licence, but ESS claims that permission expired in March. Capita disputes this, telling the court it accepted “commercial terms” for an extension of the licence proposed by ESS during a phone call. ESS wants the High Court to declare that no valid extension was made and have threatened to apply for an injunction forcing the software to be deleted across Northern Ireland. Around 1,100 Northern Irish state schools could be forced to delete copies of the software provided by Capita, which ESS claims are effectively pirated. Further information on this dispute and the court claims/counterclaims can be found on the WhichMIS? website at whichmis.com

When I was at Groupcall we partnered with Parents Booking, which also has an Events Booking module too, and it was extremely well-liked by the hundreds of schools that purchased it through us. Great piece of software, very easy to use for both the school staff and also the parents too. They introduced video last year and that has been taken up massively too - and they also allow multiple parents/carers to join the video calls from different locations etc. which makes life easier for working parents or split families... Whilst it links with your MIS, you can also simply upload a CSV instead if you prefer. I heartily recommend it and they give full access and training so that you can try it for free with your next event without any commitment to purchase too! https://schools.tecl.co.uk/education...3d%3d-&CC=&p=0

When I was at Groupcall we partnered with Parents Booking and it was extremely well-liked by the hundreds of schools that purchased it through us. Great piece of software, very easy to use for both the school staff and also the parents too. They intriduced video last year and that has been taken up massively too - and they also allow multiple parents/carers to join the video calls from different locations etc. which makes life easier for working parents or split families... I heartily recommend it and they give full access and training so that you can try it for free with your next parent evening without any commitment to purchase too! https://schools.tecl.co.uk/educationcompany7lz/lz.aspx?p1=VArDA1MDUzMzM5NFM3MTgxNDQyMjo2QjY5RURGNENBM0MzRjMwRjYzN0QxQTczMDUxQ0RCOQ%3d%3d-&CC=&p=0

Just yesterday I received an email promoting exactly this - RecordLink - and offering a free trial too. This is the link if it is of any use to anyone. https://r1.dotdigital-pages.com/p/25N2-T6J/recordlink?utm_source=https%3a%2f%2fschools.tecl.co.uk%2feducationcompany7lz%2f&utm_medium=email&utm_campaign=RecordLink+-+Email+1+-+November+2021&utm_term=Document+management+in+SIMS+made+easy&utm_content=6482596&gator_td=2wdKQWbGawjfsWz3fgDHOrORmZ%2fTAgWM0GLW1C91CqaTlLCB%2bHnsiyWK0c172DQeRxInPj55GtyswXQPOhjuRIEhKhiAJBks%2bqOZs14kgn0VKas2ih4pbC43Zqqcye1sIYC2NcVT7UzmzSYIuCBs4m%2bfIb8eoyaqhmQ7m63gAUV%2buvI8i3R%2bSDi3zABx22WF

Link:

Hampshire Council were fined £100k for something very similar when personal information was found in waste being dumped...that was under the DPA, so 20% of the maximum fine was imposed. Wouldn't want a school to have to pay that, or worse - 20% of the 20m Euro max under GDPR...

Given that the ICO use Wordpress for their own blog....

The school should have a privacy notice that explains what data they store, process etc. and where it is used. If the teacher has set this blog up themselves, I doubt it has been included in the current notice...

might be worth noting this section of the Wordpress 'terms of service' as a starting point... 'Our Services are not directed to children younger than 13, and access and use of our Services is only offered to users 13 years of age or older. If you are under 13 years old, please do not register to use our Services. Any person who registers as a user or provides their personal information to our Services represents that they are 13 years of age or older'

This is correct under the DPA and under the GDPR in terms of definition of controller and processor, but under the new GDPR the data processor will have direct and enforceable obligations to comply with the GDPR themselves. Under the DPA the Data Controller (school for example) are responsible for ensuring that processors keep data secure but under the GDPR the data processors themselves have to maintain appropriate technical and organisational measures to ensure appropriate levels of security for the personal data they are processing. They will need to provide evidence in some form to the data controller to allow the data controller to assess this and agree/disagree before they allow the processor to process the personal data and there will need to be a legally enforceable contract that sets out in detail what personal data is to be processed, how, where, for how long, by whom etc. Under DPA, data processors are fairly well protected from penalties/repercussions from data breaches or other compliance issues as the responsibilities lie with the data controller. Under GDPR, they each have responsibility and are both liable for any non-compliance issues. Processors have an obligation to assist the ICO on request. The ICO will have its enforcement powers extended to processors as well as controllers, enabling them to fine etc. processors in the same way as controllers as well as being able to halt processors from continuing to process data, enter their premises to investigate non-compliance etc. This is a major (and much needed) shift that will make sure that data processors have to take just as much care of personal data as controllers or face the consequences.

Unfortunately, when it comes down to it, the decision on the legal basis (if challenged) will be made by the ICO and not by educators...

I have to agree with maturelady here - the 'public interest' legal basis will definitely cover a great deal of the personal data processing within schools, but not all of it. Think about it more in terms of 'could the school/this task within the school, operate/be done WITHOUT processing the personal data or sharing it with another party? Parents buying uniform can easily do that by going into the suppliers premises and buying it there, without need for the school to share data with the supplier... Looking at homework software etc. - many schools manage without using this kind of software, so it is difficult to argue that this is necessary under the public interest basis. Equally, as schools are classed as 'public authorities' they cannot also use the final legal basis of 'in the legitimate interest of the controller etc' as this is not allowed to public authorities to processing carried out by public authorities in the performance of their tasks.

Home security systems don't fall under DPA unless they extend beyond the boundary, in which case any images captured beyond the boundary DO fall under DPA etc... I wonder how many home owners know this/care about this etc.? And the likelihood of ever having a complaint made against you for your home security system is pretty small too :-)

ICO guidance states 'Both permanent and movable cameras should be sited and image capture restricted to ensure that they do not view areas that are not of interest and are not intended to be the subject of surveillance' If the camera happens to capture an area just outside the school premises, that may well be acceptable, but if the camera captures an area further afield (say the opposite side of the road outside the school gates, or extends into the gardens/grounds of the properties opposite) then that would not be within the guidelines... One of those 'greyish' areas where the actual siting is going to be down to you, but the later interpretation of the siting will be judged by someone else entirely if a complaint is made...

You have to ensure that anyone entering the area covered by the cameras is aware of this by putting up clearly visible and readable signs at any points of access to the area covered (entry gates/doors etc). The signs have to state that the area is covered by CCTV, why it is used (to protect from theft/harm etc.), the details of the organisation operating the CCTV system along with basic contact details such as website, email address or phone number for queries relating to the use of the CCTV system. Also, you need to ensure that the range of the cameras is only sufficient to cover the area of your/the school's boundaries. If you end up recording beyond that you could fall foul of breaking data protection and privacy rules as people passing by would not expect that they are going to be recorded etc. especially if that includes car registration numbers etc. that identify people easily.

I asked a similar question at the BESA event yesterday where they had a panel of experts discussing school funding. Only one authority had taken any action (Essex) and most worrying was the fact that it was simply ignored by the majority of the panel - including the Chair of the National Governance Association who advise school governors etc...I had expected them to reply that they had worries about funding and support etc. but the question was simply ignored completely instead.

I suspect that the query about data controllers and 'suitably qualified and an expert in DP law' is actually asking about the Data Protection Officer role rather than the Data Controller...

The current iPhone version of Emerge runs perfectly on the iPad in any case, but there will be a native iPad version in September.

The Android version of Emerge is being worked on already and should be rolled out during the second half of the Autumn Term