GrumbleDook

No, you aren’t over thinking ... you are thinking and that is perfect. What is the data collected for? Is it only collected for the return? (That’s before we get into discussion about whether the collection of the data is needed ... but that’s a different argument). If only collected for the return then yes, lock access. If collected for more then control access for who needs it. However, have the class teachers and SLT been including in the conversation about what the data is used for. There may be a need and until you as the question you can’t be sure about what the requirements are so cannot really complete your DPIA on it. Good work on asking the question.

Oh no ... not again. I would love to get every Head and CoG in a room and shout at them loudly, in a Harry Enfield shouty man style ... “Oi! School Leaders! Nooooooo! Whilst I respect your ability to lead schools and ensure that children are learning in an engaging environment I must point out that even the ICO clearly says that the IT Manager is a clear example of a role with conflicts of interest with regards to being DPO. By all means you should work with them to ensure the safety and security of data but you can’t audit your own work!”

Bringing it in line with existing school governance, but making it easier to bring in specialist support when needed... as happens at the moment in other areas of school life. Rather than say schools are doing it wrong (which many are) and then give them almost impossible hurdles, we need to support them. There are some good DPO services that are trying to be light touch once schools have gotten themselves into shape, and this is could be a really good model ... but it relies on using the existing governance structure to support it.

The demo site is on a staged area, so you only see example suppliers. On the live site we have several hundred listed, have just released additional editing tools as well as improving how you manage your own systems. We’ll work with partners on the video suggestion after BETT. It may be best to take other ideas to a new thread, as we are grateful for all feedback but I can see it spiralling and making this thread Off Topic. Let me chat with the mods on getting a group together where we can chat in depth. After all EG groups are a hand tool for this sort of conversation.

As mentioned, feedback greatly appreciated and happy to discuss when we catch up at BETT.

Evening folks. I’m more than happy to respond to questions and queries but please bring them directly to me as this is not really the most appropriate thread. We have been using demos rather than video introductions as most schools have wanted to ask a raft of questions at the same time. Because we also work through partners, it gives them a fair opportunity to talk with you as well. Partners also work on other aspects to support schools so if we can refrain from sharing quotes here ... it is not the best place to do so. We appreciate the feedback and I’m more than happy to talk to anyone who would like to know more about additional features we are adding. I look forward to seeing you all at BETT.

I hold my head in my hands and let forth a shriek if despair. Please find out who they got this advice from and PM it too me ... I will add it to the anonymous examples we are feeding back to DfE and ICO. Ask whether this was a result of a risk assessment and could you see a copy?

In days gone by EG, members, mods, admins and sponsors have sat in on a range of operational and strategic areas with folk like Becta and SSAT. Departments refer to BCS, IET, RA ... and now to EduGeek.

The DfE have covered the two most commonly raised roles that would have a conflict, and they could have spent more time on other examples, but the idea is to raise that there are conflicts and the school has to think what could be those conflicts. There *will* be more materials to come and we will feedback on anything to help give you more clarity.

Any request upon volunteers would still be on the basis on the required experience and knowledge. That should not be forgotten.

If you look at the sticky threads at the top of this sub-forum you will see a range of topics include links to further information and resources

This is where we help to fill in that gap. Whether people think it is better or worse, the days of the Govt producing everything is gone ... a large portion of what Becta would do is being picked up by companies such as GDPR in Schools or others. We try and give as much out as we can for free but some of the tools are part of our service. Happy to chat with you on it next week.

Whenever possible use the ICO chat service as you get the chat transcript with it. I’ve had the same chat as part of questions on liabilities. The school is *always* the Data Controller and there are times this is shared with a supplier. This is a judgement decision of the school. You may decide that they are just a Data Processor or that the design, decisions and requirements on data and how it is processed is *completely* controlled by the supplier, and that means they have to be considered as a joint Data Controller ... BSF is one of the few examples of this and it will depend on the implementation. You *will* needs this to be agreed by the Service Provider, and contracts updated. If they do not then don’t panic. They are still a Data Processor and under GDPR they now have liabilities too. There is no escaping it!

Ask the relevant department in each country?

Thanks for the reminder on this. Members need to note that this is in respect to use within English schools. Separate questions will need to be put to the other relevant home countries. (Ed? Would you help?)

Afternoon all Apologies for missing responses on the recent posts. Anyone would think that there is a trade show coming up and a change in legislation. We are in the process of reviewing the response we have received and will update in due course but we are going to wait until after BETT. This is because we have so many requests for catch ups at BETT it wouldn't be fair to put some responses up and not others. We are also about to release more guidance for Suppliers as well as hosting an event for Suppliers on Friday 26th at BETT, with DfE and ICO present too (unfortunately it is a supplier only event but a space has been reserved for an EG rep). Needless to say that some of the response we have had back are to ask for more time to comment as the number of amendments that are in and out of the DP Bill, whilst nothing that has had an effect on schools yet, there are still items which effect marketing and sales, so we can understand why legal teams are keeping it all bundled together. Others just want more time or to have personal contact (next week *will* be busy!). We appreciate your patience with us and with the EdTech Supplier community out there. It is proving to be a fraught time for some, but the feeling is still very positive that we will all make it and schools will too.

It is worth saying that we need to think about the difference between when we are given privacy notices by suppliers based on B2B (ie we are their customer) and when we are engaging with them as a data processor, following our instructions.

Send over and I’ll review.

But @russdev doesn't go to BETT anymore so you never see me and him together ...

And I'll be joining Russell Prue each afternoon around 2 to discuss areas on GDPR, responding to some frequently asked questions, talking about some of the benefits that NetSupport tools can bring and giving you all updates on where Information Security good practice can help you on your journey.

Looking forward to it.

I quite enjoyed the discussion on press freedom vs press abuse of other people's freedoms. Yes, there is guidance and we have started to see some come out ... and the team at DfE is working on it. This is where your feedback is going to, so the more input you give the more questions we can ask.

I won't be tigerfied until lunchtime on Friday as GDPRiS are running a session with EdTech suppliers first thing, and with DfE presence at it meaning I will be all professional looking ... I promise to get round as many people as I can in the few hours that will be left though.

Oh my ... that is a very InfoSec comment that has been sent over to you ... I can almost bet you have been told that you have to encrypt everytrhing too? In reality, the law says you need to do a DPIA. Based on that you may do a range of things to manage the risk. One of them would be to improve your User Access Control so that you only have access what you need, and should you have another account (a Domain Admin account) it is auditable so people can see when it was used, what was done with it, etc. This is actually part of Cyber Essentials and more can be found here. https://www.cyberessentials.ncsc.gov.uk/requirements-for-it-infrastructure.html

Would a parent take as much control or out on similar software? Yes. Are the school In Loco Parentis? Yes. And this is why boarding schools and safeguarding becomes .... interesting!