GrumbleDook

One of the questions that needs some expanding on, actually. Going back to basics, we have to first ask where the right to remove conflicts with the need to retain.

To be honest, it is more a case of refusing to allow a school to process the data because of lack of policy, failure to follow policy, inappropriate policy ... An example would be that school chose product A from company X, it wasn't on the Privacy Notice and it is known the the T&Cs of company x are not compatible with use for under a certain age. We all read the T&Cs, don't we? The importance of being cleared what we sign learners up for is an element to look at as part of your GDPR readiness.

The data is not being shared with Google (as a data processor, to re-use as they see fit) but as a cloud provider of services. If the school systems are based on Google (who have the EU model contracts in place, have been vetted for cloud services by U.K. Govt and it is being processed as requested by the school) then there is little ground for refusal. Saying "we don't trust company x" is not a valid reason for refusal.

First thing, if a company is changing a sub-processor then you need to be informed about this. Second, there should be clear comms about who is doing what work with any of your data. Finally, if *any* company contacts you to say that they are replacing x with y and they are *not* the company you have the contract with then you should do *nothing* until you get written confirmation (including electronic confirmation) that this is what has changed.

Or uploading to a cloud storage service ... which is fine, because you can control which one they use and still maintain accountability.

This was one of the problem with the use of the old Impact Levels. People would sometimes look at them in isolation. Full Name could be IL1, but add in the school name as context and it collectively goes to IL2 ... but the school name itself is not IL2 ... it is the context of the collated data. You don't say that a number of data elements that are all IL1 will remain at IL1 ... if the context when collated makes the uniqueness more obvious *and/or* the data elements increase in the sensitivity ... then the IL would rise. To some extent I can understand why they ditched them ... but it makes it more difficult to explain context at times to some folk.

Deployment with out asking for Apple ID needs the apps to be licences via VPP. This allows apps to be assigned via Device ID instead. MDMs may vary but that's still the best option.

At the risk of sounding like I am attempting to help you relax and not worry about it too much (but get thee to thy doctor!) .... Set up a webcam in the house ... at least you'll be able to make a fortune selling the video of the aliens abducting you!

Data being stored in the UK is not a GDPR thing ... Data being stored in the EEA is still likely to be fine as the local countries have relevant and equivalent laws around data protection ... it's called GDPR! Also, with the EU Model Clauses being used more (Microsoft and Google being 2 large examples), then it comes down to risk management rather than a legal requirement as to where data is processed. As for compliance and security measures ... you are not going to get a lot of detail on a number of areas here. Companies are protective of security information ... a large chunk of the response will be generic. The company will draw this up in their contract and T&Cs. Schools that want to draw something up and get companies to sign will need to pass it via Legal Services, and so will the company ... and that gets expensive on both sides. To be honest, a chunk of these questions are likely to be relevant to the DPA, so perhaps it is better to ask how they are updating their present contract, etc. in light of the changes the GDPR will bring.

Welcome. Good to see folk are still buying into FITS ... for many schools it can make a significant difference in support management. It would interesting to hear your experiences as you put elements into practice. Some examples are bound to need posting Behind The Red Door though ;-)

Quite happy with my 3T for most things. Having to use it in dual SIM mode right now after cracking my iPhone screen at the weekend, and it is fine with that. I miss the Apple eco-system for a lot of stuff and also want to get back to separating work from personal! As a work phone, does everything I need ... but is a bit big for a personal device.

Just going to tidy this up so we can see the questions in full, making it easier to see the range and depth of them. There are a lot of questions there and there is a lot of information already available to answer these. @jenatddm is it worth responding to questions where the answers are already known?

Thanks for making this a sticky thread. First of all, here are the slides from the presentation. http://www.edugeek.net/cms/attachments/43876d1497601349-edit17-mobileguardian-gdpr.pptx.html and the presentation too. The URLs in the presentation were ... gdpr reform ico.org.uk GDPR Wiki - Nicole Lamoureux it governance GDPR in Schools A link I missed out of the presentation is ... Protection of personal data - European Commission

You are a public body and cannot make a profit from doing your legal obligation of responding, so it has to be at cost. Because of that, there is no way you can set a flat fee, it will differ every time. If you over charge then you are at risk of complaints being raised and you being fined by the ICO. Your advice for charging in such a manner is incorrect and if others follow it they are at risk of being fined too.

It is a grey area at the moment, even for adults. On a recent GDPR session (with K2) they looked at how their system was being rejigged to allow for electronic consent and the tracking of it, but it was being questioned by HR. At the moment, the advice says "written" so we have to take as that until other guidance says otherwise. Part of the issue is ensuring it was the Parent giving consent and no one else.

@Fazza you mean one of the reasons that people used to gripe about LAs and RBCs? The fact that the WAN might be fantastic but the lines out where naff?

What?!!!!!!

Email sent over. Must chat again soon, btw.

You will eventually get someone who knows what they are doing who will report you to the ICO. Whilst schools are not getting fined for DPA breaches, they are getting rapped on the knuckles for being stupid on FOI requests.

Charging would be excessive for a simple query that requires no additional work and so could be trouble for you. Who holds the contract and expiry date is a reasonable request and they have not asked for anything commercially sensitive (I.e. What systems are covered, etc.) so nothing to block there. Give roles and not names, if you feel you have to, as to who looks after contracts.

I've just had a nudge on that too and was going to ask if anyone else is going.

I worked in a school for 5 1/2 years where they used admissions number and it worked well ... they only thing I would have changed is that the admissions numbers were based on year of entry ... not my choice as it was in use well before I started there.

So if the child uses the email account to sign up to something then they give their approx age and full name.

Hippy Bathday, young sir!

To be used when the floggletoggle is broken!