GrumbleDook

It is a valid concern and this is what DPIAs are for. You have a clear purpose (engagement by families and support for possible additional needs of individuals), you know what is going to happen to the data, you know what data is being used … Have you checked if you are using any protected data that requires an art. 9 exception? Are there other examples of possibly sensitive information? Any members of staff who really need to protect themselves? Any protection orders? These are a few of the questions you need to look at. Realistically, the use of photos to introduce staff to children with additional needs is a really beneficial activity, and any staff objections (it is the right to object, not opt-out) have to be taken on a case-by-case basis as the right to object is not absolute. Schools can refuse, but this is a risk thing again. HTH.

It just so happens that this is one of the areas a DPO can help. I can't talk specifically from the viewpoint of the vendor in question, but as a sponsor and an EdTech vendor I can tell you what we do to help you decide if we are trustworthy. It is also worth saying that this is not just a task that gets done once. You can go and recheck any (all!) your Data Processors when you want and annually is a good option. Having a template Request for Information (RfI) may help to send to vendors, and your DPO may have a template for that. If not, there is an Open Source one available on GitHub that can be used. Some vendors might even have it pre-filled and available to customers as part of their DPA. If people would like to hear more about what good can look like, I am sure I can sort something out with a DPOaaS provider to talk with me, to get both school and vendor points of view.

This is a choice for the school, based on the needs. Is this something the DSL can help you with?

As @Roberto has pointed out, if you are the data controller, only you can really decide if it was a breach. If you believe it was, then raise it to the ICO, and you might even want to point out that your Data Processor has tried to insist that it is not a breach. This is a very serious thing and I know some school DPOs and DPOaS providers who have been pretty shocked by the approach taken.

Use it ourselves.

Afternoon all. I’ve finally bitten the bullet and joined our local Maker community, primarily for space to spread out on larger book binding projects. As part of this community, we all help where we can and a few of the other members have networking and sysadmin experience too, so it is nice to chat with them. One conundrum that has come up is around getting firmware for older, donated kit. I was wondering if anyone could help. For the Panasonic stuff we are after version 9 of the OS, as that removes the licence constraints, and any help with the HPE is appreciated. I’m aware that you have to do the upgrade in stages, but we cannot find all previous versions. I’ll also be having found with some door control mechanisms too. Which brings me to my second question. Using the EG app it is a bit hard to find, but how many here are involved in the maker space communities?

The product was commissioned by the Microsoft Education EMEA team, and was built by ITWorx (primarily by one engineer) with support from a few UK resources (folk like Andy Dent/Innovit UK).

Theoretically, it would be possible to recreate similar using PowerShell et al ... but as this is already covered by the good folk at places like SalamanderSoft ... who will bespoke things for you and support it ... it is probably just something to look back on and laugh about.

I have only just binned my DVD of it!!! And that was a serious blast from the past.

I know a few folk have picked holes in the question asked, but from an educational point of view, it is a valid one with a reasonable set of requested functionality. Yes, there are lots of add-ons to GWfE/Classroom and M365/Teams Edu, and the request for a one-stop shop is a fairly valid requirement too. Having all the required tools managed in and through a solution such as Classroom/Teams is a decent method but has some barriers to adoption unless you are will to work through it piecemeal. Are you able to counter the request with asking about how they expect staff to work with it? Make use of existing resources they have created? Provide access to lesson notes/annotations? Virtual whiteboard? Do they want guided learning as part of it based on a built curriculum or will it more towards ad-hoc tasks and assessments? Flipped learning? Curated resources (curated by the provider) or teacher-chosen/created resources? As silly as it may sound, it might be worth revisiting some of the old Becta articles on VLEs/LMSs to see if that helps pin things down. As with all these things though, pretty much any solution can work ... it is just about how much effort is put in, what the long term strategies are and where the people to setup/manage/create content/review results will be pulled from. As RFC 1925 states: (3) With sufficient thrust, pigs will fly just fine. However, this is not necessarily a good idea. It is hard to be sure where they are going to land, and it could be dangerous sitting under them as they fly overhead. (7a) Good, fast, cheap.: pick any two (you can't have all three).

Data Processors need to inform data controllers of the breach. Class charts have done this and so it is the responsibility of the data controller to assess the implications, choose to report to the ICO or not, choose to report to data subjects or not. It is moot as to whether ClassCharts decide whether it is reportable at this point. The disturbing thing is that someone in the ICO is feeding back that it *is* up to ClassCharts. As for notifying schools, data processors will have commitments within the DPA to notify the data controller. This should be something you check during due diligence.

Erm .... no. I've avoided stepping in on these discussions for a range of reasons but the above needs calling out. 1 - It needs to be made clear to the ICO that Classcharts are the Data Processor and not the Data Controller 2 - This is because the Data Processor *cannot* make a full assessment about the risks to individuals who may be affected *as they do not know enough about any context*. 3 - If Classcharts are saying there is no risk, then they need to be challenged on that as to how they have reached that conclusion without discussing it in detail with *all* the Data Controllers affected. If ICO is saying it is Classcharts' decision then I would ring back for a second, third and fourth opinion as this differs greatly to advice I and others have had in the past. I would also suggest that you contact ClassCharts to get them to make the ICO understand the relationships in this.

Yep, this is exactly the issue, and why anything that is the result of direction or instruction from the school has to be risk assessed. One problem, linked with KCSiE and Prevent, is that you still need to take care about what sites and tools children are using. This is the difficult aspect of Filtering and Monitoring that varies from school to school. You know something could be a problem but don't do something about it? What exactly is the problem? What risk could it introduce? Is this an area already covered in how the school operates? It does open more questions than provides answers, but that's the whole point. Encouraging folk to question rather than just letting it ride through with no checks (n.b. I am not say that you or any others on the site would let things just ride ... it is a general observation about what can happen).

Erm, you care because the ToS gives some of the details about whether the school is the Data Controller or the provider is. If it is the provider, then consent is needed ... if the ToS says no to under 18, you can't get consent anyway. The provider would also be classed as an Information Society Service, and so also fall under The Children's Code.

Pretty irrelevant, to be honest. It is more about who is the Data Controller ... the school or the provider?

A quick one from me. I know I’ve mentioned it before, and it might come across as pedantic (yeah, I know … me … pedantic!!!) but please be careful how you refer to other organisations who you use to process your data. A Data Processor (DP1) is a data hub product (lots of terms could be used, substitute whichever you prefer) that is used to shuffle data to lots of other vendors (DP2-10), and to pull it back in where needed. This is where the school is giving an instruction to a data processor to work with a second data processor. Sharing data with the DfE or LA is sharing it with a third party. You might get DP1 to do the work, but this is sharing with a third party. The recipient will have their own purpose and lawful basis for using the data. This is what makes them a third party, in data protection/privacy terms. However, you (the school) still have to agree and give the instruction to DP1 to do the work. Nothing should just be passed around or taken “just in case”. Getting your staff to understand the difference between these two (DP and 3rd party) is core to getting them to think about what data they are sending over and why. The expert is right to say that the platforms need to be vetted. This is nothing new.

Why are you filtering off-site? Is there a recorded need for it? How do you cover where the device might be used by a range of family members? Is it school-provided devices or BYOD? Lots and lots of questions to chuck towards the risk assessment.

It is worth mentioning that the Privacy Notice/Privacy Policy on a website for a company is usually just that, their notice to you what they do as a company, running their business. This is not a contract or agreement. The Data Processing Agreement is where the relationship between the school (data controller) and ClassCharts (data processor) is set out.

The standards are not linked to the devaluing of IT roles. In many cases the standards are reworking areas from the old FITS 1.5 and v2 guidance and levels. Yes, some of it is dumbed down in language (as already pointed out in this thread), but it all comes back to establishing good working practices… something that has been worked on since 2001. Salary and terms of employment are always going to be an issue, as they are for many other roles outside of teaching, but the standards are simply part of establishing good practices.

External DPO services come in a variety of flavours and that is usually explained at the beginning. There is a balance to be had as some schools get simple SARs and some have more work to do or get them more frequently. That said, where redactions are needed, it is the people using the data on a regular basis or those dealing with the strategy of what is being used (DSL, etc.) who know what needs to be redacted. Even if you do outsource, those members of the school staff still need to be involved.

I've been doing a lot of the "what do you call?" name jokes recently .... What do you call a man with seagulls nesting on his head? Cliff ... those sort. So yesterday it was ... What do you call a woman with hair on her upper lip? and instead of waiting for the correct response from me (which was Tash) the youngest goes ... "Granny" *sigh* I tried not to laugh too much.

Gamification, when used incorrectly, can affect attention spans and there are some good folk out there talking about the good and bad of it all. https://donaldclarkplanb.blogspot.com/search?q=gamification Has a number of posts from Donald Clark, going back some time now as well. Then you have folk like Richard Van Hooijdonk - https://blog.richardvanhooijdonk.com/en/game-on-the-power-of-gamification-in-education/- with interesting thoughts from research. Like all tech, used well it is good, used poorly ... not so good. Curation has to be facilitated by educators. Either through creation/co-creation or via discovery/review. The tools to enable it can come from a range of places, but if YouTube is being used then the possible limitations/harms need to be clear from word go.

https://www.bbc.co.uk/news/entertainment-arts-67646607 I was lucky enough to meet him when younger and his passion for language was so inspiring.

As already mentioned, this does fall under the remit of the DSL now but that doesn't mean that they are the only people to do things. The most important things to be done during setup and review of any product or tools you use should be based on what you want to filter, monitor, put as priorities to be checked and the school's decision tree around risk. To some extent, when we cover training on classroom.cloud, we try to make sure that the messages around how you tweak what gets reported or what alerts can be sent. A lot of products can have some level of this and so deciding where the risk is should be the first steps. Yes, the IT might know the product better from when it was set up, but it truly is a whole school thing under the remit of teh DSL now.

There are three strands to looking at this. Education Safeguarding Data Protection/Privacy Yes, there are lots of things on YouTube with educational benefits. Smarter Every Day, Physics Girl, NileRed, and so many more. Don't forget the hours and hours of archive stuff that is out there (Royal Insitute, RSC, CBeebies). Like all things within education, being able to identify and curate these is part of what a teacher does. The difficulty of managing this curation is the sticking point and one that becomes an administrative pain in the backside. That is not to say it cannot be done, just that you need to think about how it would be done and how it would be managed. Librarians, learning platforms, content caches ... all sorts of things have been tried over time, so if staff want resources on YouTube to be available, then this is part of the conversation that must be had. The curation is also part and parcel of the safeguarding element. Depending on the age of the children and young people involved, the old examples of walled gardens ('allowed only' content) are key for younger ages (look at Education for a Connected World for expectations against age). As children get older, they should have their limits expanded, but there is still a duty of care. A balance needs to be struck, so you start to find filters to stop access or solutions to monitor access, which become important. Applying restricted/moderate settings is a common approach, but forcing no comments or subtitles (there are reasons) and such become more prevalent. Then we have schools tying this to the different types ages or levels of competency of children and young people, and this is where things come a little unstuck. YouTube is not part of the core Google Workspace for Education solution. It never has been and probably never will be. This and any other 'additional service' are in place as the school and Alphabet are joint controllers of the personal data or separate controllers of the personal data. This means Alphabet can do what they want with the data provided to them through YouTube. The Google Education team have been clear about this, have lots of stuff about managing accounts so that they cannot access non-core services and how to use the additional services in a non-tracked way. If you tie in the level of restrictions on YouTube to a child's school account, then you cannot use Public Task as the lawful basis. Alphabet requires it to be consent. It then falls into the category of an Internet Society Service and the Children's Code applies. It is not to say that you cannot use YouTube. Just don't enable it on student accounts without thinking long and hard, but also don't think that you *have* to block it because of this. You don't, you can work around it ... I would love to see all of the above as a complete breakdown of the usage of YouTube, and maybe one of the Google Ambassadors on here could suggest a case study or guide?