GrumbleDook

I didn’t catch the whole event but caught some of the comments involved. The stress is more on transparency and the fact that some parents don’t know what is going on or, and possibly more importantly, why ... and the importance of it. That is something built into the update of the regulation. The amount of checks involved and ensuring that tech is set up properly will always be a discussion point and if we are going to teach children to look after their data then we have to have some of the difficult conversations too. Nothing wrong with that ... Some of the emphasis of others there I do understand (Big Brother Watch as an example) but don’t completely agree with ... it that’s partly because I’ve seen both sides of it and err on the side of trusting the school (who often take far more care of the children online than parents do). I do look forward to the full report so that it keeps the discussion going, but would suggest that the media representation might be coloured a particular way.

We are waiting to see if the DP Bill updates EPIER at all to be in line and consistent. Remember the use of the phrase 15 school days ... you operate to whichever is the shorter. In the school hols, should a SAR come in then you are not counting days under EPIER, but you are under GDPR. I’m hoping some common sense will prevail here.

Mea Cupla! It has been a busy few weeks (and more yet to come) so I've not been able to feedback or update. I'm out of the office most of the week (I'll see those attending ANME North West on Thursday) so they will hear news first but we are in the processing of sorting something to make yours and suppliers lives even easier :-) I'll give a fuller update on Friday.

Thanks @steve_forbes. Just to clarify to others about the restrictions ... for Legitimate Interests it cannot be used for core activities ... which is extremely restrictive and every attempt I’ve tried with ICO on listing possible non-cite activities ends up with it being the school’s decision or speak to the DfE (which we are). For consent, it is about the clear, unambiguous consent for a given purpose for a set time by the relevant, competent person and/or their guardian (heavily paraphrased) ... and that is what we have been talking about.

To some extent, mea culpa. @rom1984 and I have been having a number of parallel conversations and this has fallen out into the thread ... We had been looking at independent schools and the application of the public interest test (recent amendment on DP bill refers to independent schools in NI so doing a bit of thinking on “what if” and extrapolating) and we hadn’t realised the conversation had bled into the thread ... apologies on that. Yes, you are right that Legitimate Interests cannot be used to cover core activities of a Public Authority.

It is and it isn’t ... over time more discussion and advice *will* come out ... and as people from different sectors discuss application and based on WP29 guidance too, things will be clearer. At the moment, it is clear that any item that is statutory or is affected by secondary legislation would be covered as Compliance with Legal Obligation. Delivery of the curriculum (either the NC or that chosen and set by the school) would be Public Interest (as it is a core activity of the public authority) and the method of delivery is part of this. The choice of tools should be those most likely to allow the schools to deliver the curriculum to the highest quality, but the delivery is the action, the tool is simply the method. When consent is used, it needs to be clear what it is being given for, that the data will only be used for the purpose under which the consent is granted and only for the duration set out. We also need to remember that the lawful basis for processing is not a hierarchical list ... with consent as the last chance on the list ... you choose the most appropriate basis for processing ... people want to avoid processing under consent because it can be difficult to manage, has less options on exemptions to data rights and so on. This is why people are starting to look at consent monitoring tools more ... to make life easy and manageable ... and I would rather see it become a bit more of a chore for schools than schools try to avoid consent as a reason and wrongly use a different basis to try to make their life easier.

The focus on consent will be a small area. It will be related to where legislation says you *have* to use consent (biometrics, etc.) or where guidance is to use consent. In general there will be other lawful basis for collecting/processing. Reporting to parents is a statutory obligation so would not be done under consent ... As for swapping consent, yes it will become ... interesting. Many of the MIS have or are bringing in ways to manage it, as some examples have already been mentioned.

Quote Originally Posted by GrumbleDook You are aware that the method of response creates additional work for the school to save you time on your analysis. A proportion of the information you have requested will be gathered as part of reports and exports from the MIS. These reports can be easily attached and returned directly to you with no additional effort on the part of the schools. The time taken to prepare these reports will vary from school to school, be dependent on the staff involved and their experience with the systems, vary slightly depending on the MIS involved and so on ... If we were to give a generic time of 4 work hours (which would be spread out over a periods of days) as the request filters through the various members of staff, advice is sought on whether to respond and whether the information is already published ... and then finally all the schools face that last bit of transcribing onto your webform. Let us presume that this takes an additional 10 minutes, allowing for schools to double check and make sure the correct responses are going, taking screenshots of their entry, etc. Now here is a very rough estimate, based on some example figures sent over to me ... 10 additional minutes, 23,000 schools. 230,000 minutes. 3,833 Hours. Then considering the people doing this will be admin staff in general and working an 8 hour day ... that makes 479 working days. If you consider the standard working wyear, holidays, full time ... that is 1.8 working years. A typical office staff salary for someone with decent MIS skills (this is not including the SLT adn other staff that have been involved ... this is purely the time of someone to transcribe to your form, double check, screen shot and submit) then a person on Grade B perhaps (£15k a year, depending on location and experience) equates to £27,000 in taxpayers' money that has been wasted. So for each FoI that is sent out to all schools and then insists on a webform response, it could cost English schools a classroom teacher with 3 years of experience ... give or take. Perhaps that might seem like a drop in the ocean, but with schools hard pushed on money right now I, as a tax payer, would prefer to see requests go into schools in a manner that has as little operational impact on schools as possible. Perhaps it is just that you do not see the other side of what it takes to prep these responses in the manner that makes life easier for you and your analysis ... I'm not discussing whether or not your request is a valid one, I'm saying that there is an ethical way of doing things and pushing the burden onto schools is not the way I would see that happen.

Quote Originally Posted by GrumbleDook View Post You are aware that the model by which you demand a response does not allow schools to point you to where information may already be published Is this available for each and every question and each and every part of the question?

Quote Originally Posted by GrumbleDook You are aware that some of your request is flawed around the question on numbers for parents. But you also said So which is it? Schools can't add up or schools don't record the information? 3+4+5 does not have to equal to 2 ... it could be more or it could be less. Do you accept this?

Just to confirm ... You are aware that some of your request is flawed around the question on numbers for parents. You are aware that the model by which you demand a response does not allow schools to point you to where information may already be published You are aware that the method of response creates additional work for the school to save you time on your analysis. If you can confirm the above and also point out any actions you are taking to rectify these it would be appreciated.

I think this is about only migrating the data you need to retain and not all the historic information that may be around.

I would heartily recommend the IRMS Schools Toolkit for the base of your retention schedule. Based on that, make your choice about what you need to retain, but remember that some could go into a pupil record as hard copy.

The problem you have is generating that random sample in the first place. It is almost impossible to make a sample random. You can aim for statisically representative so that when scaled it shows equivalence, but that would mean defining what are typical schools ... and then choosing the schools that match that fit ... and at that point, the matching, it is not longer random. This is why most surverys are not aimed abeing random but at targetting demographics. in FoI that is not a good thing to do as it introduces sway and uncontrolled variance into the statistics. For FoI you go big, or go home. It is worth considering the work hours spent on this though. Does anyone here have an approximation of time spent responding to this FoI? I suppose I could always request that of you all as an FoI? ;-) Realistically though, it would be interesting, based on the feedback of the number of schools that have responded, to understand the work hours spent on this. As a school governor I am interested. Whilst an operational issue, strategically I need to know that we have policies that cover it and that we understand impact of requests. - - - Updated - - - Noted, but there is some justification on this which I will explain in due course.

Having used that link before to teachs NMs about how to phrase things to SLT ... I didn't really want to bring it up again ;-)

The problem with only asking a sub-set is that you risk profiling and that alters the basis of the analysis. One of my favourite books that I have kept from Uni days (boxed up somewhere at the moment due to shelf shortage) is on Resaech Studies and how to run them correctly. It truly can be a fascinating area, and not just for mathemeticians and statisticians. The political, psychological and ethical areas that it brings up are astounding ... and I wish more about it was covered with children in schools ... it helps prepare you for how you manage questions you are asked in surveys, to understand and spot nudge tactics ... with manipulation of information so crucial to modern life it is digital literacy more than Maths now.

I've held off on further responses as it has been interesting to see how the conversation and attitudes have varied throughout the thread. Below are a few constructive items to helpfully make and updates to this request more relevant and accessible to schools and to help focus on what the requests are for / should be about. Like others, I still have reservations about the approach and the use of the webform. As already mentioned, I am a firm believer in using https://www.whatdotheyknow.com/ but can understand the difficulties that could cause a bulk requestor in their analysis. When the creator of the software behind the site presented at the Information Commissioners' Internaltional Conference late last year I did listen to a few comments in a post-session discussion talking about how the site could support bulk requestors, but I am not sure how ... personally i would suggest that should be an area to follow up ... for the simple reasons of expediency for other requestors. As a tax payer, I would prefer to see schools only have to respond to requests once, rather than multiple times ... by responding in a public way, subsequent responses can point to the previous response. This is a better use of public monies. If the focus is on better use of public monies, then the requestor should have that in mind when making the request. Any comments about "I am a tax payer and so am entitled to answers" should always be done under the mindset of that those taxes should not then be wasted purely because it makes the requestor's life easier. The focus is on making sure taxes are well spent! Which leads me into my main problem with web forms. They are restrictive. If someone has previously provided answers or the information is already in the public domain, then not allowing for the response to include that means that the response cannot be given. This is often the basis for why responses that take you to web-forms get knocked back. By changing or adding the ability to respond with where information is already published it will make a world of difference. It also allows people to explain about why questions don't work. The request about natural parents is deeply flawed. You cannot make the numbers add up as you have missed that some children have no records of their natural parents on the school systems. Trying to enforce the use of the webform to automate the analysis for you misses out that unless you are clear with the exact information the school needs to define in the MIS report (taking into account all the variances of guardianship and custody of children) then you will get errors in the responses. This is generally not intentional by the school, but based on the flaw in the request. A similar request was made sporadically back in 8 years ago, and had similar issues. I hope these comments are helpful.

Try not to overthink it. They can make the request but if you have a legal basis for processing still then you have grounds to retain the logs. If your retention schedule is clear when logs are deleted (e.g. after 6 months) then this could be considered reasonable. The authenticated bit, in this case, doesn’t become important at that point as all data (remembering IP address is considered personal data) will not be kept for long. If only retaining IP then you need to think about what would be needed to make that Personal Identifiable Information... normally you would have to cross-reference with the DHCP server (MAC address) to identify the device that had the lease (unless you retain that on the filter, of course) ... and so you need to think about how long those logs are kept. If only 4 weeks ... then the IP address is effectively useless after that point ... and you might not consider it personal data, but pseudononymised data instead.

And this is where the use of cloud storage to hold and control files works best. No files should be emailed around. Ever. Hard copy handed to the relevant Governor, or made available online to download / review.

And breathe and relax ... 1) by using a system not under the control of the school, the school would not be able to control what happens with personal data that goes to it. Whilst ICO will explain that it is the school’s decision ... this is on the understanding that a true risk assessment is taken and recorded ... and this would clearly by very high risk ... and hard to show compliance. 2) safeguarding wise ... stop!!!! Protect yourself from possible allegations. This is not where you want to be. I think most people have covered off the issues you face but I would echo @elsiegee40 that this would raise significant safeguarding concerns should Ofsted ask ... raise to your DSL, and the relevant governor working with DSL.

Feck!

There is a *lot* of useful information in there, and the customer actions give a seriously good breakdown on a per article level what you need to think about ... but you may end up feeling that unless you know GDPR and the technical implementations inside out ... you may struggle. I would give it a go and make sure that you truly consider the additional data fields that *you* have put in, not just what MS need to create / manage accounts and services.

An interesting take ... I’ve heard this argument before, usually based on the idea that you should do it prior to reading and handover notes / documentation ... the problem is that the school would probably prefer you focus on the priority of ensuring you are supporting the school with a working system rather than trying to break it. Happy to take to another thread to discuss what are the priorities when moving into a new job (I’m sure this was talked about about 6-7 years ago but can’t find a thread on it ... about time to revive perhaps).

True, but the point has always been that some schools have wanted to make sure that if something happens to you, then your replacement can get into the system to sort things out. No one wants passwords floating around so a common suggestion in many threads has always been write it down, seal the envelope, sign it and laminate it, then stick it in the safe. So when we say that if you *have* to write a password down then you must keep it secure, then this is the sort of example we would be talking about.

Marketing is governed under PECR, and there needs to be Legitimate interest or consent ... Right to erasure, restrict processing etc come into play and this is where GDPR come in to support PECR.