ir0n_jaw

I think this case will potentially set a precedent in our sector - but I fear our schools are too ill-prepared to want to hold Capita to account. I'm stunned by the apathy around this issue. RE contracts and small print - this is exactly what they do and exactly why we renegotiated data protection clauses with Capita around GDPR go-live as they work very hard to avoid any liability. I would urge all of you to check your contracts - not that it would hold up in law necessarily.

As data controller, the school has responsibility to report the breach, if affected. We're filing our report today.

I think it would be the school's responsibility to make sure that Capita only operated under their instructions. Therefore, allowing them to connect whenever they want without adequate checks in place would be the school's failing. Regardless, they are not currently demonstrating themselves as a fit and proper data processor - so we need to hold them to account IMO.

My experience mirrors yours. Only now where I have a fuller picture, do I see the significance of it and I'm horrified at how long its taken to get some action. Just one of our schools has 1200 affected records where the Data Manager will have to manually compare paper records to SIMS ones. Even then, where the students have left the school, we're left with incorrect records that will be difficult if impossible to correct. It's a total mess.

Hi all, long time lurker here. Quick straw poll on this issue: Out of those schools affected, how many of your school or MAT leadership teams are aware genuinely tracking this issue? Also, how many of your organisations (where affected) are treating this as a proper data breach? I'm the IT Director for a large MAT and am intending to illustrate to our Board just how significant this issue is and the resulting action has been. I get the feeling reading this thread (unless I'm reading it wrong), that most schools are resigned to taking it on the chin and simply fixing any errors as opposed to taking significant action. In my view, this is a substantial failing by a major data processor and the way they've handled the issue is pretty appalling. Keen on finding out what your situation is.

I'm hiring for this role: https://www.indeed.co.uk/viewjob?jk=ae2ee3df867fa5af&tk=1cikd5mea94kkcva&from=vjnewtab It's a new position based in Chelmsford and is part of a shared service model we're implementing at the Trust. Please feel free to share the link with anyone who might be interested. Note, I'm looking for someone who is as skilled at communicating as they are at finding solid technical solutions! Cheers!