jenatddm

Don't forget that the UPN has been designated as a General Identifier (as in the DfE 2013 guidance) so it's See Para 4 (1) Data Protection Act 1998 While that “general identifier” might be a bit woolly, however the UPN guidance suggests the only bodies it may be shared with, would exclude third party developers: "it is only possible for UPN data to be shared by CTF between schools/academies, LAs, DfE and other prescribed government departments (OGDs).” Let's get the ICO opinion. Should be befotre the holidays. Out of curiosity, how many UPNs does Groupcall currently have stored / interface with? (Can chat offline if you prefer - @theabb DMs open)

Note also though that in Scotland, "the dataset that we hold at a national level doesn’t include pupil names." It's not a national ID in the same way that the UPN held by DfE is stored agsint pupil names and contact details. (See FOI.)

The DfE UPN Guidance is only from 2013, and was not just a nice-to-have. I don't know its origins but it *might* be that it was when DfE changed national laws 2012/13 and started handing out identifiable pupil data to third parties from the NPD, so was the first time that the UPN was potentially a national identifier, for non-direct education purposes (assuming every use at local level is for the purposes of a child's schooling, care, or direct school purposes) compared with say, national academic research, or tutoring website heatmaps, or journalists. It's not the ID that's not acceptable, it's some people's use of it, for purposes it was not designed for. Someone 'rolling out a new system' now requires a privacy impact assessment, so *in theory* (as you might say, let's ignore that for the moment?) the risks should be identified and the data subjects made aware of them, and data collected with consent and/or mitigating secure procedures. The NI number, the NHS number, the 'Graham has just made up an identifier' number - are (in most applied contexts) considered personal data. They must be protected as such, must meet the requirements of common confidentiality law (not only DPA) and can't just be sent around the system by others, unless with direct or implied consent with legitimate interests ie. for purposes that children/parents reasonably expect and are fairly and legally processed. Where *that* boundary lies, is pretty clear in health, and what needs tightened up in education. The current issue is often more generic. Pupils and parents don't know all these third party uses exist, or how their data is used by them at national or local level. Or tracked across systems, jigsawed with other sources by providers, or sent to an app provider because the school thinks they need it, when it is the schools that needs the information and may have the legal obligation to collect, but not the system provider. Companies make no effort to give school audit reports and schools don't fairly process meet data controller responsibilities - responsibilities that processors share from next May. If schools don't tell kids what happens to their data, suppliers in the chain are liable too. "Lets ignore all that for the moment," is the fun stuff we're advocating to help fix for everyone in that chain. UPN was never intended to be part of it and other local identifiers exist for local purposes.

You're right that context matters - however it apperas that the UPN has very specific purposes (namely information to the LA, central government or another school/academy to which the pupil is transferring) which have since been overly broadly interpreted as "useful" rather than "necessary" in an educational context. For example, is educational purposes any purposes as defined by a school? No. So there needs to be precision where it is given out to a third-party payment provider, or for admin purposes which are indirect, rather than direct educational purposes. We have asked the ICO to make a clarification, and aligned with Scottish and Welsh practices. I hope this will help and we'll have it before the end of the summer, and that will help interpretation by third parties and schools alike.

We've asked the ICO for an opinion. Will let you know as soon as it is received. And ideally, it will be public.

"The UPN must be a ‘blind number’ not an automatic adjunct to a pupil’s name. That's quite clear. We've asked the ICO for specific advice on this point. Will reply as soon as we hear back.

I believe comon practice suggested is too broad, compared with guidance. DfE UPN Guidance is clear that it should be a ‘blind number’ and ensure that personal data is only transferred to those with a genuine right and requirement for its receipt. See page 17: "the data protection restrictions associated with UPNs mean that it is only possible for UPN data to be shared by CTF between schools/academies, LAs, DfE and other prescribed government departments (OGDs)." https://www.gov.uk/government/publications/unique-pupil-numbers

Yes name and email address are both personal data. So is IP address. What matters as well is the legal basis for the collection, so while all that data may be personal, the context in which it is collected, the purposes it is used for, and where it is shared (for what) all matter too. Have you seen this yet? It might be helpful: https://www.youtube.com/watch?v=RZUlsdyREvg&feature=youtu.be

Yes I agree there is, but I'll gather up weekly and do a bunch at once if OK with you. If we gather questions over time here, and I do the leg work to get the answers and collate the materials into a decent format, could someone help me build the behind-the-scenes structure of an open and free at-a-glance searchable FAQ on GDPR-in-education on a single page here? I believe it would be helpful for you. I'll get and post answers to all questions asked - including the basics - and whereever possible signpost the answer to official definitions, rulings, opinions and make clear where there is fact, or different opinions (as some GDPR is imprecise). The risk is that there is a lot of misunderstanding - and poor quality materials even from commercial GDPR providers out there don't help. Much of the concerns will be addressed by clear understanding of the legal basis for data collection. Is it a census need? Is it a requirement or nice-to-have? How can schools make something 'required' where must they offer an alternative (apps for health and absence reporting for example). A good starting point is to look at current policies and sharing practices which should already be in place. But that starts with a data audit and 'fit-gap', first recognising what the future (GDPR) process model should look like, what today's is, and targeting the gap in between, to identify what needs to change. One good place to start is the ICO presentation for education: https://youtu.be/RZUlsdyREvg

Mike thanks for the questions. I need a little help to understand these two better: 1. Come school fete - book a stall - make sure that you emphasise one or two particular features of your offering, or at least make sure that the general theme of your presentation actually matched the holes. 2. Heres a second interesting question .. a head of key stage signed up to that facility. Are they now the data controller for that part of the school adherence?

If you have any questions (as regards for schools /public sector/ GDPR in general as applies to you) please feel free to post them here. This week GDPR meetings offer us an opportunity to ask questions of the ICO regulators and a cross sector of child's rights' acdemics, technologists, industry and NGOs. We will be considering consent, profiling, and age verification, among the broader issues. I will gather the questions up, and respond in bulk next week as a post, after the discussions. I can also offer to repeat on a regular basis after that, based on need.

Thanks. Attending GDPR meetings this Friday and Monday in Brussels and London with regulators and cross sector of child's rights' acdemics, technologists, industry and NGOs. We will be looking at questions of consent, profiling, age verification. Any questions (as regards for schools in public sector/ GDPR in general)? Please feel free to post them, and I will gather them up and respond next week after the discussions.

Hi, I'm Jen at defenddigitalme. Great to meet so many of you today, and thank you for the warm welcome and interesting talks and discussion at #EDIT2017. I'm an independent member of the Department for Education National Pupil Database Steering Group, and have a current special interest in GDPR and its implications for children. I coordinate the NGO defenddigitalme. About defenddigitalme defenddigitalme campaigns for fair, safe and transparent use of school pupil and student data. Founded in 2015, the non-governmental organisation addresses privacy and ethics in national education data policy and practice in England. Our work 2015-2017 has had a special focus on challenging the fair collection and expansion of the school census. We are non-partisan, and funded in 2017 through a single grant from the Joseph Rowentree Reform Trust. In autumn 2017 we will publish a report on data privacy policy and practice in schools. We will offer a free resource under Open Access / creative commons, to support GDPR readiness with easy steps to review and action. I'll raise your questions and bring info to the forum where we can. And I look forward to getting answers to open questions, such as age verification, parental consent, and schools' legitimate interests as soon as we can.