Gongalong

Guidance from our CC is 22 years from DOB for special educational need (SEN) files, same as a pupil record. 25 years from DOB for students with child protection file.

Hi folks, Having trained staff on this for several years, I'm at my wits end in trying to get them to take it seriously, having discovered the umpteenth unlocked laptop in a classroom, hardcopy sensitive data not locked away only days after repeated guidance etc. What do other DPOs do to try and get staff to follow guidance and take it seriously? Our approach so far: - staff training, including refresher training (annually going forward) - clear guidance including reference to it being a legal requirement, school policies, and inclusion in the staff code of conduct - repeated guidance between training sessions - penalties, including mandatory retraining for staff that are caught with unlocked laptops etc. Interested to hear your thoughts and suggestions...

There's another outage currently, since 2:30pm.

I would like to think that the government would end up supporting the bits that were crucial, as they do with defence contracts, but I suspect there's only one way to know for sure...

Looks like there's 8 of us so far that need to go I've got Fibromyalgia, if the GP is to be believed, so that probably isn't helping in my case. But still curious to see whether it's the norm, and so far it looks like it is...

Hi folks, What do you make of the recent issues with Capita and solvency? Anyone concerned? https://www.theregister.co.uk/2018/04/25/gov_grilled_over_huge_exposure_to_struggling_capita/ I appreciate there would be thousands of schools in the same boat if Capita went under. Thoughts?

(This is a poll, so might now show on mobile browsers) Just curious. I'm typically frazzled at the end of the working day, but just me? EDIT Those using the app can select this post and go into "Web View" to see the poll

Hi folks, We've been using SysAid (locally installed helpdesk solution), but they're changing the pricing model from £180 per year to £1,200 (!). Our Site Team have been using Spiceworks, which is fine as a cheap and cheerful solution, but is there anything better? (A lot of real estate taken up by adverts, and no paid cloud version without ads) Free would be great, but happy to pay £100-200 a year. Just need something fast and simple where we can log tickets and search. Something in the cloud this time (or web based, as we used to call it). End user portal, categorisation, and reports would be gravy. Thanks

Ah yes, which leads onto Data Protection Impact Assessments.

Hi folks, I was asked what the practical changes are for schools with GDPR, which I thought was a good question. Off the top of my head I could list the following: Consent = more care needs to be taken with data collected and ensuring that there is consent for it, which leads onto... Data Mapping = clear documentation on what data we have, where it is, consent to have it etc. Privacy Notice = a compliant privacy notice (which some schools at least would have a version of previous legislation) Policy = a compliant data protection policy (again, some schools may have had a version of this for the previous legislation) Data Protection Officer = required for public authorities What do others feel are practical changes? Thanks

It's the conflict of interest bit that has driven the poll. I'm the IT Manager where I am currently, and have effectively been the DPO for several years. I can understand where the conflict of interest comes from but to just totally dismiss it seems rather "baby + bathwater". I think there are equivalent if not greater benefits in having your IT Manager as the DPO, although it depends on their current role, personality, workload etc.

It gets weirder. The Receptionist said that she logged off the PC, and another staff member used it. When she logged back in the information had returned in SIMS...

Hi Folks, With the Spring update, was there a change in which group can see what? Our Receptionist can no longer see phone numbers, next of kin etc. for staff, but her group memberships haven't been changed. Wondering if this is a GDPR thing... Thanks

(This is a poll, so you might need a proper non-mobile browser to see it properly) Sod's Law says I've missed off a basic option, but you can't edit a poll once posted. You can always post in comments with your "Other" option.

My feeling also is that progress/achievement data should be treated as sensitive/special category. I wouldn't want other people to know my progress, yet it's common in schools to post progress on public display boards. What are other people's thoughts about this type of data?

What I've told staff previously as a rule of thumb is to think if that information were about them... would they want it locked away, or equally would they mind if it were just open to read, or illegally accessed? That's on top of giving them the defined sensitive/special category info, and some examples of other items that would be viewed as such in an education context.

I agree it's a case of risk management, but equally it's possible to overanalyse these things and blow the risk out of all proportion.

Hi folks, When reading around the topic of sensitive data, soon to become special category data, I was sure I'd read that equivalent protection has to be made to any form of data that would cause damage or distress if lost, illegally accessed etc. For example, Pupil Premium data is... well, sensitive. I would also think progress/achievement data is particularly sensitive. Any thoughts on how you deal with these types of data that are more sensitive than say a name and a phone number? Is it better to just err on the side of caution and treat it as special category? Is there clearer guidance on this somewhere? Thanks

I rang the ICO helpline, and the person I spoke to (Sarah) said there was no need to have to cover previous names, or use a special system. Bemusingly, she says the ICO have a visitors book that shows previous names!

We used to have that type of hardcopy system, but have apparently switched to a system which shows 10-15 lines of previous visitors. And yes, it transpires the source for the quote was a company selling visitor sign-in systems.

My thoughts exactly!

We checked this with the ICO, and the onus is upon the Controller (of course!) to make sure the information is looked after. They won't give any specific advice, which I can understand. We use hardcopy, and will continue to do so, but as part of the trip preparation it will be highlighted to staff that they must keep it looked after at all times i.e. not leaving a handbag unattended.

Hi folks, I've been passed the following quote. Not sure of the source currently, but perhaps from someone who provides a sign-in system! "If you are using Visitor, Staff, Contractor signing in sheets/book or tear out passes and you can see the data, it needs replacing with a system where an un-authorised person cannot see any of this data, whether they are a staff member, public, parent or governor. If they can see the entries, this is classed as a data breach." Thoughts? To me it seems excessive to class seeing someone else's name as a breach, even if coupled with company and car numberplate. Thanks

The three outages we've had have been around 10am for the last three consecutive days, including today, which have all coincided with the classes that wanted to use it. Needless to say it's meant chaos for the poor teacher. The first time it happened I put their home and login page into PRTG's web sensor, so it picked up the second and third outage (around 20 minutes a time).

Hi folks, Is anyone else using AppShed? We’ve only just started to use it in anger, and we’ve had outages of the site the last couple of days. I’m going to contact their support, but curious as to whether anyone else has used it for longer and had similar experiences? (I contacted their support some weeks ago re. their Unify app, and they weren't very helpful.) What are other schools using for KS3 programming? Thanks