GrumbleDook

The reference to PCI regs is very pertinent. For many of us, ISO27001 and the risk-based approach to information management is the best and most relevant area to look at. It will be interesting to see what is covered on the webinar. Thanks for highlighting this, Mike, and looking forward to the feedback.

It seems that some folk are happy with asynchronous lines ... how many people feel that they could manage on asynchronous lines?

How dare you! Do you know how much effort it takes to get up at 4.30 in the morning so that the light is just right to take a picture of the focaccia I am baking, nor the cost of the summer rowing holiday I had to set up, just so we could row to Sicily to hand pick the olives! And it is people like you who portray us liberals as SJWs ... well, I'm taking this to my latest post in Medium and you'll soon be sorry!

Folk normally have it in their profile, if not in a sig or something, IIRC.

The Doctor has a history on mental health issues ... so we should forget the hidden disabilities.

I wouldn't rule out the CMDB ... just use it for asset management to start with and you'll be surprised how quickly you use it for other things

The use of a parent's NI number by a public body to check eligibility for additional funding and resources, and done so on behalf of that parent, is legal processing. Parents are able to do this check themselves but can pass the job onto someone else on their behalf. It is generally quite successful for schools, and that is partly down to parents seeing a benefit from the school obtaining additional funding via PP. this is one reason why some schools will offer the cost of one after school activity per term to be covered for learners eligible for PP. Yes, it is going to get harder to manage next year... and I can see schools losing some funds as a result.

Never mind GDPR, it should be there for DPA! It counts as BYOD, so you should have a BYOD policy and include things in there such as ability to remote wipe (if they lose the device either you or they need to wipe it), password/passphrase policy ("No, having a 4 digit code or a simple pattern are not suitable security methods!", etc.

Sorry folks ... cannot comment on this otherwise I would be breaching the forums' advertising rules. Give me a day to clear what I can say.

Is this a cmdb?

Paraphrasing something I put in response to someone on FB ... Considering what could happen during regeneration with whatever is used for genetic code ... we have no real idea about the true idea what sex the Doctor is anyway ... as any physical characteristics are subject to altering at regeneration ... and the Doctor has two hearts ... so $deity knows what goes on inside that body with respect to hormones! Realistically we have to think how improbable it is that a) the regeneration has never involved a sex change before and b) all the Doctors (including the upcoming one) have been white.

I think the next one needs more of an aura of malice ... so the niceness stands out more.

They are sub-contracting the storage. You already host on the cloud (someone else's computer) so check the contract to see if they are obliged to only host it on their computers or can they put it on a sub-contractor's.

I know I mentioned EMBC earlier as part of a joke but EMBC is still available in Northants. They are still a provider and never went. All that happened is that the LA, at the schools' request, did not sign up for a contract for the schools. Apologies for the thread hijack, but just wanted to clarify.

It frustrates me that some of the funding (30 hours for nursery) for some groups should not have to be checked every 3 months (adoptive parents) but you do ... it is almost as if the system is set up so that unless you do the work you automatically miss out and it saves some money! But that would be a cynical thing to say.

This is where you stray into the rules around automation ... You may have justification for this but I believe that advice from DfE would be needed before deciding what is appropriate and available (I have raised the question already).

Primary Technology are a good bunch of folk and a number of staff are members on here IIRC. I'm sure if there are any issues they will rectify them quickly.

They are a separate data processor and you would have to be happy with all of their data handling processes and that their DPO has everything covered ... which shouldn't be a problem because we know that schools are fantastic for information handling and data protection. [emoji6]

You could try emPSN ...

If you declare it in the privacy notice and can justify it (reviewing the approx location of posters as part of showing audience reach to learners) then it could be acceptable.

Notification if used within school only (justification is based on requirement for T&L), but if shared outside of school there would have to be explicit consent. As a parent, I would not agree to the latter (and have not where it has already been asked under DPA and would struggle to see how a Data Processor could even attempt to control the data when it is being shared with other schools). If someone is willing to approach Iris for a response about how they are going to handle GDPR it would be interesting.

The work is on open display for staff, students and regulated visitors (all visitors to a school must be authorised and controlled). The selection of that work by staff select appropriate work ... it is unlikely that an item where a student talks about what they did at the weekend would appear on the wall. When dumping work, it means you no longer have control over it. It can be seen by anyone who raids the rubbish. That means that should a student make a disclosure when writing in an exercise book and it gets out into the outside world ... then that is a clear breach of the DPA. Without sifting through all work it is hard to pin point any problematic materials, so risk management comes into play and you destroy it all securely.

Yep ... inspired from an original BOfH story ...

Does anyone remember Badger, Badger, Badger? Imagine sharing an office with two others and leaving it running in the background, too low for them to hear ... and then turning it a little every 15-30 mins ... And then come back from fixing a printer to see them nodding their head in time to the music and muttering it under their breathe. That earworm can then be reactivated at *any* point by just saying, "mushroom, mushroom" quietly under your breathe ... Imagine you did that every day for a fortnight. A person that did that must have a terrible mind!

Yes, consent is from that point forward (where consent is required) for any data you hold and process. If you don't have it, or if it has been opt-out rather than explicit (opt-in) then all the requests for consent have to go out again!!!