GREED

Hi Would you be able to get in touch directly so we can schedule a session with you to look more closely at this? Drop me an email at [email protected] and we'll go from there? When reviewed/resolved, I'll post the analysis here (any Xporter fault that is!), for others. Thanks

All fair points. What is being said here is that the UPN is an attribute of a student (record), not an identifier - unless the DfE or LA, or another school is involved, and then they have legislative power to use that attribute as an identifier. With my professional hat on, I care little which schools want to share, or what third parties want/ask for - Groupcall (and I am sure the other data integrator) can provide UPN, MISID, 'Graham's made up ID' just as easily. School switching MIS - now there is a fun time, with all the local IDs changing!

In other news, we have has a (sort of) response from the Scottish Government on this: "Pupils in publicly funded schools in Scotland will be uniquely identified either by their Student ID which is allocated within the schools’ MIS or by their Scottish Candidate Number. The schools’ MIS is operated by SEEMiS Group on behalf of Scottish local authorities. Scottish Candidate Numbers are allocated by the Scottish Qualifications Authority." Scotland does not have the same UPN as the UK. I should also note, not specifically mentioned in their response but eluded to, that the SCN is printed for the students to see and use on papers and in schools, school IDs etc.

Great discussion - no closer to any difinitive answers but good conversations! There is something that does confuse me - the UPN is an identifier, like the ULN, the Admissions number, the MISID, the NI number, the NHS number, the 'Graham has just made up an identifier' number. OK some have greater scopes than others, but all identify an individual just like their name does - only an ID number (depending on the scope) uniquely identifies them against other people of the same name in the same location/class/school/area/country. Lets disregard for the moment that all (or we hope all) the companies that want the UPN follow DPA now, GDPR next year, and so the information is secure and is only being used to match Johnny A from the MIS to Johnny Adams in their system, which they are providing to the school and only the school. Lets ignore all that for the moment. So the concern is around the UPN being against the person's name - whereas another ID is perfectly fine. Unless between systems we do not want to match, or want to purposely not be able to match, that Johnny A is Johnny Adams, to provide a single record collection about their progress... What makes the UPN a no no but another ID - an ID (whether is be a single number or compound value from several) that does uniquely identify that individual, acceptable? Take this further, someone rolls out another ID, say SIMS - their MISID and all providers use that (which most do actually) - then the proliferation of this ID now matches or over-takes the UPN. My point - is the concern here about the identification of an individual via the use of the UPN (which, sort of, is what the DfE is talking about), or because the DfE 'said a thing'? And to be fair, said that thing long before 2013 and when systems that want/need to talk to each other were in their infancy... Which their clarification does seem to take into account, and that some seem to not be...

Please do. We are interested to hear experiences as well.

I will get this looked into. To be clear, is this the database upgrades or the application upgrade on the server? How long has this been 'a thing' for?

That's great news, thanks for letting me know. Always happy to converse publicly these things will always help others, and we have nothing to hide!

OK I have had responses (quicker than I thought!) - Xporter should not be locking files in SIMS, it technically doesn't touch these. Can you confirm you are on the latest version of Xporter (5.6.0.1610)? You can always try stopping the Groupcall services (Groupcall SIMS Server), however you should not need to do this, and so if it does keep happening we'll probably need to have a closer look for you.

Hi, sorry I completely missed this. I have put this to my dev team to respond to and will get you something as soon as I know.

Yes, see post #4 in this thread

I completely agree. Plus, much like the UPN conversations that are floating around right now in relation to GDPR, the NI number has legislation around what is can and cannot be used and stored for. I honestly believe you will get very little buy in from parents to supply this, just so you can do regular checks about their income and situation, just so the school can get some more money. I would check very carefully whether you can legitimately store the NI number, and use it for your purposes, both now and under GDPR from next year.

Thanks for this. Please get in touch with our support team and they will be able to take a look at this for you. For information, the Emerge service (connected to Groupcall Emerge) does not directly connect to SIMS and so should not affect anything to do with SIMS issues, it is likely a coincidence more than anything. However, the support team will be able to assist you to see why our services have stopped working.

Is there a field in Progresso to store NI number against a parent?

Let's us know as soon as you know anything and we will jump on it. Always possible something slips through but we'll get on something as potentially big as this asap. Also happy for transparency for discussions here (as always) - for the benefit of all. For information around the possible corruption, our source code for the integration with SIMS is checked and verified each year by Capita as part of the process of being a partner. Doesn't guarantee anything of course, but it does mean we always used the approved data access paths.

Please get in touch with me and/or our support team right away, if not already. Which product is this - Emerge or Messenger? There should be no way for either to corrupt SIMS as both use established SIMS interface routes, and always has. We have tested both products against the Summer release of SIMS, without any issues. Email me on [email protected] with any details.

Would you, not being the parent/person, be allowed to check that eligibility given they need to enter their details into a system? Not sure you would. Given GDPR coming, you'd need to gain consent from parents to allow this, to check on their behalf... What are you going to do with that information if you were to get it? The better thing to do would be to have a system that does the check for the parent, sends them off to the appropriate place to sign up for FSM, and then to also inform the school.

So firstly, one would assume that unless they are completely isolated databases/storage location/encryption keys/etc, if hackers do breech the table, they will have access to the related tables and the relationships to find what they need. Secondly, what about the MIS - if someone breaks into SIMS for example, that is all in the same database...

But this is fine under DfE, because it is with a bona-fide education department. OK we might sit here and say it is probably excessive (not to mention inefficient!), but is basically the same as the DfE demanding the census.

I think the point here is legally, the UPN CAN be used (assuming following the above guidance), that is point 1. If school is happy to use it, then great. SHOULD it be used, probably not. Can it a company pressure school to allow the use of UPN, very much not. A question that has not been raised - if we ignore the previous advice from DfE for the moment, what issues to schools have in using the UPN over any other ID number?

Understand what you are saying, and you are right. The school has to authorise the use of the field - like any field. If the school wishes to, or is happy to, then all great (follow DSAs etc) - software suppliers can ask for that field of the school, but it is unreasonable to say they HAVE to. The guidance says the schools can share the UPN, for the purposes outlined above... that is the limit of the advice.

Just as well we do Oh the joys of working in the data industry...

I refer you back to the statement given to Groupcall yesterday which states the decision is down to the data controllers...

From my understanding, the guidance suggests that if a school is using a system to 'do things in school', and they need that same data in another system to 'do things in school', then it is fine (assuming the usual DSAs and all that). The DfE is un-clearly saying that the data cannot be used for a purpose that is not the school/LA/etc - e.g. using the UPN to create a national database, giving it to a local sport centre for their records, etc. These softwares are provided for schools to use, and in that analogy is no different to having the data in the MIS or any other database. The need is nearly always to have a consistent identifier for the child, so that one system the school is using has a consistent link to other systems. This is pretty good justification for need. The fact that there are alternatives is somewhat irrelevant when sticking to the one point.

Update: Today, we have had the following response from the (English) DfE on the use of the UPN: We at Groupcall have reviewed this, and we interpret this thus: Provided appropriate DSAs are in place, and that either Groupcall (with Xporter, or other data aggregator/extractor with their respective products) and/or the third party (direct or via Xporter/other product) are acting as the data processors on behalf of the school, then the use of the UPN is, and I quote, "admissible to share data in accordance with the usual transfer controls."

Surely the hint is in the name - admit.