Gongalong

Hi All, Presumably others are getting a 50% increase on their RM Unify contract? We have gone back to [email protected] and complained about this, and asked for it to be fed back to whoever is setting the contract cost, and the Product Manager. Those who also think it's a problem do do this without significant warning may want to do the same.

Digging into this again, and it seems Spotlight was removed from the Enterprise and Education versions from 1703 onwards. The implication is it wasn't very "professional", could contain advertising etc. - - - Updated - - - There's a Windows Store app called "Dynamic Theme" which gives similar/same functionality.

It's been offline since the 20th.

I don't think there can be any other way than spot checking staff "manually".

The ICO have got this useful site which seems to have data from Nov 2015 onwards, and no edu orgs here, except for the University of Greenwich and two they've miscategorised https://ico.org.uk/action-weve-taken/enforcement

I believe there were 12 edu orgs between 2010 and 2015 that signed undertakings, not sure about after that. These are the ones I've looked up detail on: Bay House School (Gosport, Hants) – hacking attack on website, student data potentially compromised. Staff member used same password for two different accounts. Cherubs Community Playgroup (Coventry) – onsite out-of-ours theft of unencrypted laptop with data on ethnicity of children. Laptop left under desk. Surbiton Children’s Centre Nursery (Surrey) – offsite theft of an unencrypted memory stick and paperwork. Freehold Community School (Oldham) – unencrypted laptop and paperwork on 90 pupils stolen from boot of car while parked at home. Norwich City College of Further and Higher Education – student files put in insecure waste and disposed of in skip. Godalming College – staff email containing sensitive attachment accidentally sent to lower sixth-form students. Media publicity resulted. Phoenix Nursery School (Wolverhampton) – lost unencrypted backup tape containing SIMS data. Holly Park School (London) – onsite theft of an unencrypted laptop containing data for 9 pupils. Stored in locked filing cabinet in unlocked office.

There's the embarrassment factor, and also the procedural undertakings that the ICO can force, or try and force. It would be pretty heartless to fine a state school, but...

The Redstor link? I think that's just talking about potential fines, rather than saying edu orgs have been fined. This is a list of all orgs that have received fines, none of which are edu. Obviously the University of Greenwich are to be added, once the amount has been paid https://ico.org.uk/media/2014859/civil-monetary-penalties.csv

First that's been *fined* though? I know there have been several edu orgs with undertakings.

I suspect they take various factors into account when sizing the fine, although this is data on a very large number of people.

If I recall correctly, this is the first fine of an educational organisation i.e. nursery, school, college, uni https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/05/the-university-of-greenwich-fined-120-000-by-information-commissioner-for-serious-security-breach/ (University of Greenwich fined £120k)

Today's BBC Click is all about GDPR, and even includes a very brief segment at a school https://www.bbc.co.uk/iplayer/episode/b0b3q4qf/click-gdpr-what-is-it-good-for

As follow up to the OP and following discussion here, after three infringements e.g. PC unlocked, staff will now be called to see the Headteacher.

Hi folks, Is there such a thing as a report audit log in SIMS e.g. who ran a report, the title of the report? I'm guessing "no"... Thanks

It's been offline since 9am yesterday. It was great while it lasted, but they need to provide a resilient service. A great shame.

We've advised staff to be careful what they right down for this reason. It's all too easy to fire off an email that's rude about someone, which my understanding was they could read if they made an SAR!

Hi folks, I was interested to read this article from The Next Web, as per the subject: https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-read-your-bosss-emails-about-you/ Essentially they interview a lawyer who says you are not able to get emails about you from your boss because they contain "personal thoughts". Yet reviewing the ICO's Subject Access Code of Practice, they mention that you would be required to provide emails - no mention of "personal thoughts", nor under Exemptions. Is the requirement for Subject Access Requests changing under GDPR? I'm not spotting anything easily. Interested to hear people's thoughts...

We use a shared spreadsheet in Office 365. I didn't think it would work, but it seems to be. Best option out there that I've found is Room Booking System from School Cloud Systems. Syncs with SIMS. But it's expensive.

This is the last 30 days of downtime, shown as red:

It's been down for a varying number of hours for the past few days. It was down for a couple of days between the 5th and 7th. I'm glad we ditched it...

Our county legal team have said SEN data retention is the same as a normal pupil. It's slightly longer for children with child protection file.

We thought we had the same issue after installing Promethean touchscreens, but thankfully found they have freeze. We have unwittingly bought some projectors without though, which causes great upset.

Good idea! Currently we contact those who were caught by email, and that's CC'd to some of the SLT.

Freeze they know about (and love!) although definitely worth a reminder. It's just remembering that Win+L, and taking it seriously enough *fume*

Locked screen. Yes, 15 minutes. That's been the setting for a while, and inevitably it's a compromise between staff trying to use their PC and data protection. Changing it to 1 minute might make them think! Even so, that's 1 minute the PC's unattended. Definitely reduces the risk, but still a risk. Thanks all for the comments so far. I agree that tougher sanctions, and recording and flagging up the incidents, are the way to go. I'm doing the latter.