djrscally

My interpretation of this is; they have the right to withdraw their consent, but any given under their parent's authority is still valid without that withdrawal.

Probably fine unencrypted, likewise PCs. I did in the end encrypt my PC because we were getting a lot of break-ins, but ordinarily non-removable machines in a locked, controlled environment don't need encrypting.

100% nonsense, go tell whoever mentioned it to think before they spread.

I think they're an important part of safeguarding; particularly in a big school it's not likely that you'll know all the staff, so ID cards are an easy way for you to be confident that the people you see are authorised to be there. edit: context; my school has about 400 directly employed staff on site, not counting contractors or whatever. So no way you can know everybody.

That's fine.

Yeah they wipe everything. Although if the user installs the Microsoft Outlook App, you can then selectively wipe just account data...it doesn't work on downloaded files and stuff though. I too just go through the browser now.

Well connecting to the network is ok. I find it mad that they actually install something onto the kid's devices though.

How is this even achievable? I would die laughing if my kid's school asked to install some kind of filter on my home network. How do you persuade the parents to let you do it?

True although you wouldn't expect it to be common. I wonder if the ICO has ruled on this before somewhere.

Well not a total free pass through, but if your email is filtering out legit FoI requests on the grounds they're just spam, I'd say that's a problem. You still have to reply to those.

Well, see what you get back. I think that for the demographic data items (but not the biometrics) 9(2)(g) applies, and the DP2018 bill does seem to back that up.

Can't really have mail filters that block FOI requests. If anything you should white-list them. If someone reports you for not responding and your excuse to the ICO is "Well our mail system blocks those" you're gonna get a smacked hand.

To be clear; the processing is not consent based; it shouldn't be recorded as such in our data logs. Rather it's just that whatever a person gives as their ethnicity or whatever must be accepted, and they have the right to give "refused" as that value.

Yeah I think that will probably be a nightmare. I think it would "work" in that if the call happened perfectly you could probably get some json data into the report or something, but parsing it would be horrendous and you won't be able to do error handling properly and stuff. Honestly I think matt is right and if you're determined to do this, using SSIS to dump the data to SQL from Google and Progresso's API, and munging it there is probably your only hope. Yeah, I was doing this at one point. It works pretty well and helps get past some of the limitations of the report model in Progresso, and lets you hook up stuff like PowerBI. Oh yeah I forgot about all this...well I thought for 20 minutes and I still don't have a bright idea on this one. I'll ask around a bit...

I hope they never respond so I can have an excuse to get rid of AR...

https://developers.google.com/sheets/ I doubt that you can do it with Progresso directly. My expectation would be you'll have to set up your own SSRS server onsite (super easy), and populate a database pulling info from the Progresso API (super easy) to get students data and also via the Google Sheets API (never tried but how hard can it be right) to get the stuff from there, and then write your reports against that database. Frankly though, I'd try to think of something else if I were you EDIT: Like maybe this: https://www.google.com/analytics/data-studio/features/ Obviously will hook into the Google Docs anyway, and you could still do the Progresso API thing to get it to pull student info. 2nd Edit: What's your problem with the access rights?

tl;dr, but yes you absolutely can reject any FoI request regarding your preparations for a zombie apocalypse as being obviously frivolous.

Collecting the data takes longer, but the form itself doesn't, really. But you could already reject this FOI as obviously frivolous.

Yeah. Also, frankly a lot of the emails for the secure systems kinda look dodgy. "HEY, YOU'VE RECEIVED AN IMPORTANT MESSAGE. CLICK THIS LINK TO READ IT". It probably is a bit of a nightmare for orgs that will receive a lot of this sort of thing to teach their staff how to deal with them appropriately.

Where's the notice? I don't see it. In any case I would suspect it's just because plain email is not secure and in the past few if any schools bothered with a secure email system. There's functionally no difference between a message form on a https website and how systems like Egress/GalaxyKey/Office 365 Message Encryption work to keep emails secure, and I would expect those systems to become more common rather than a thingy on each site you access.

Doesn't the new XoD require full permissions also? I got told it does.

I think they're just assuming that people will move their data sharing barriers to Wonde and control who has access to what from them rather than at the MIS level and are a new enough company that they don't get the message right when talking to schools. I got the same thing from Groupcall actually, just not so slapstick.

OK, so choosing things in the Advanced Filter has no impact on the fields that appear in the report - it only affects the students (or staff or contacts) that are brought through to it. You'll have to edit the report in report builder and add the Ethnicity field into (a) the dataset, which will probably be called something like DS_Attendance or DS_Learner and then (b) into the actual table that defines the body of the report. SSRS (the reporting engine) has a bit of a learning curve. If you don't know how to do the above, say so and I'd suggest On Screen Reporting instead, which will involve some VLOOKUP in excel. edit: or if you tell me what fields you want in the list, I probably have a report that'll do the trick anyway I can send you.

Yeah, I did the same. Just found out what the company actually needs and only granted Wonde access to those things - has been working without a hitch since setup (the Wonde part anyway).

Oh yeah, of course. I have no idea. Who runs the PTA? Parents or Teachers? If Teachers I'd guess the website is a processor for the school as the controller. If Parents and signing up to that site is on an entirely individual basis (I.E. their services are not retained by the PTA, it just recommends them to parents) I'm leaning towards the site being the data controller and the school and PTA being nothing at all.