Love_Sausage

Print the sheet out with an address and use a window envelope. We had an issue with the wrong sheet going in an addressed envelope, self reported to ICO and they were happy with this being a straightforward, sensible solution.

A Handy guide on how to give the exam boards a little more work to do published by the ICO: https://ico.org.uk/your-data-matters/schools/exam-results/ Wise or not from the ICO?

If you changed the term to "monitoring students?" then it becomes much more acceptable. Any form of monitoring becomes sinister when you call it spying.

We spoke to AQA today - nice person there had never heard of GDPR but did suggest files on an encrypted USB stick was "a good idea".

No thanks, the question was simply polling opinion on whether we resend them in May or find an alternative.

That's the one

@MYK-IT did you get a chance to ask?

Last session at a Trust solicitor they used this as an example of legal basis for processing being contractual, the school needs to pass data on to that supplier to enable the school to offer meals and payments.

Back onto this, our BM had a letter insisting anything paper based is not GDPR compliant. That, coupled with websites like this one: https://www.proxyclick.com/subscription-gdpr?ads_cmpid=1001805055&ads_adid=52351302474&ads_matchtype=b&ads_network=g&ads_creative=249318249784&utm_term=gdpr%20visitor%20book&ads_targetid=kwd-387622852020&utm_campaign=&utm_source=adwords&utm_medium=ppc&ttv=2&gclid=Cj0KCQjwtOLVBRCZARIsADPLtJ1UYLywVOcXqZS9VzHsymwSZ-5RTw9XLNpXAPImErpF5PBdlzbv0JMaAjapEALw_wcB meant she was keen to press the button on buying something in. Interestingly, this is how the letter sells the system: 4 Reasons why paper-based signing in systems could cost you under GDPR 1: Right to Erasure If an individual requests that you delete their personal information, and you have no legitimate reason to keep it, will you be able to find it? How long will it take to redact the individual entries? 2: Data Privacy Visitors signing in on your paper-based systems can see the personal details of other visitors who have already signed in. 3: Data Security Paper-based systems are not robust and can be easily lost, damaged or end up in the wrong hands. 4: Data Disposal Legislation states that personal data must be disposed of in an appropriate manner and not simply thrown in the recycling. What is the solution? Electronic staff and student management system costing £3k! ...or a 23 quid book from Viking and some organisation

The same exam boards who only just moved away from Cassette tapes, colour me surprised.

So this is something either everyone already knows or nobody knows..

Any thoughts on whether we need to send out new Privacy notices in May or before, or can we wait until the new intake and do it in September?

Let's be honest here, Capita haven't met any deadlines or have almost dropped development of "old" SIMS so are fudging the issue. We were one of the (many, I suspect) schools who didn't really pay a lot of attention to retention guidelines in SIMS, so I made sure we went through and deleted all the records we should no longer hold one-by-one late last year. It took a significant amount of time and I kept being reminded of the promised bulk deletion tool that would be available "soon". Shows how long I've been using SIMS that I didn't believe for a moment it would be here in time.

Office manager yesterday asked me if I knew whether our perfectly capable cross cut office shredder had GDPR certification, because she was about to buy a similar one to replace with a certificate of GDPR compliance. The salesman who cold-called her convinced her this was mandatory for all shredders before May. Not a shredding service, just an bog-standard ordinary office shredder. I asked her not to but I suspect next week there'll be a new one sitting in the office, and the old one will be in the skip.

Contacted our closest school in the MAT about teaming up to help each other - "What's GDPR?" was the answer from the BM.