Jump to content

Crowdsourcing information on suppliers - Can you help?

GrumbleDook
 Share

Recommended Posts

  • Popular Post
GrumbleDook

GrumbleDook

Posted
  • Popular Post
Posted

As with all things, you can guarantee that when someone says to you, "I wonder if supplier x is doing anything on GDPR?" then someone, somewhere sets up a list.

 

And this is no different.

 

After having had a good chat with a few EdTech consultants, it is obvious that there are still a lot of suppliers / data processors out there that don't know that they are going to have some difficult conversations with schools when it comes to asking what are they doing with data you have passed to them to process. Mark Anderson (

) has even looked at his Periodic Tables of Apps and started cross checking which are doing things in prep for GDPR, as one example.

 

@jenatddm has already started the process of gathering a list of suppliers together and there are still lots of other things to be raised on there. We at GDPR in Schools want to keep that going and go further.

 

But we are only touching the tip of the iceberg right now .. Below is a link to a Google spreadsheet that we are asking you to add additional details to.

 

https://docs.google.com/spreadsheets/d/1w0ObwB5jdg2NVKnxvTEqXP4GwHk5qyBJqQFnuj4TGRo/edit?usp=sharing

 

We are looking for a supplier name, URL, product name and we will fill in the rest from public information. We will then send our standard question to them of whether they will have a data map available (the response to the questions, "What are you processing on our behalf, what are the common legal reasons for processing it, how long will you keep it for and how will you get rid of it?"

 

There are more things we can ask, but this is a start. The idea is to have pretty much every EdTech supplier that is handling data contacted and with a response by the end of December. And there are *a lot* of folk out there. Yes, we are already chatting with systems integrators. Yes, we are already chatting with RBCs. Yes, we are already chatting with DfE, stakeholder organisations, groups like BESA, and pretty much everyone is saying the only way we will capture it all is we have a strong grass-roots push too.

 

We are grateful for the large number of EdTech firms who are already coming to us and working with us (we can't pre-fill their details in until we have been asked to "ask the question" … ) and also very grateful for those resellers who are also raising the profile of what must be done around GDPR.

 

There are many suppliers and data processors out there that have been working on this for some time already, and anyone with ISO27001:2013 will already be doing a chunk of what is needed … but sometimes it take a bit of time to pull everything together. Some are holding back a little as there is still some advice and clarifications to come out, so we do need to be patient at times. Some already have their data maps out there, but they are only partial (i.e. they cover a lot of items under the DP act as it stands) and we are working with them to update them for GDPR.

  • Thanks 11
enjay

enjay

Posted
Posted (edited)

I've added quite a few (I pulled up our list of third parties from our data protection statement, and added them all). Can I suggest we keep the list sorted alphabetically, otherwise a company is going to get added multiple times.

 

Do you want the likes of Google and Microsoft on there? Also, what about awarding bodies?

Edited by enjay
  • Thanks 1
  • 3 weeks later...
GrumbleDook

GrumbleDook

Posted
  • Author
Posted
I've added quite a few (I pulled up our list of third parties from our data protection statement, and added them all). Can I suggest we keep the list sorted alphabetically, otherwise a company is going to get added multiple times.

 

Do you want the likes of Google and Microsoft on there? Also, what about awarding bodies?

 

If they process personal data, or they provide you a solution that allows you to process data (think about in-house filters and tools).

  • 2 weeks later...
jmak

jmak

Posted
Posted
I know you want to send a standard set of questions, but wondered if there's any scope for something specific to market sectors? I think we might need to keep separate lists for emergency, school info and marketing contacts. Could we ask MIS providers of they're planning to implement a feature to allow that and parental comms/engagement providers of they'll be utilising it?
  • Thanks 1
GrumbleDook

GrumbleDook

Posted
  • Author
Posted
I know you want to send a standard set of questions, but wondered if there's any scope for something specific to market sectors? I think we might need to keep separate lists for emergency, school info and marketing contacts. Could we ask MIS providers of they're planning to implement a feature to allow that and parental comms/engagement providers of they'll be utilising it?

 

For marketing contacts, they are the data controller and you are the data subject, so that is a slightly separate (but interesting) conversation.

 

For where the data processor is asking you to share parent / guardian contacts so they can have a direct relationship too (I.e. they become the data controller and the parent becomes the data subject), then that would be part of the data sharing agreement they have with you and subsequent agreement they have with the parent.

 

The list is principally concerned with companies that are the data processor on behalf of the school, or where they provide you a system to allow you to process data yourself.

enjay

enjay

Posted
Posted
For where the data processor is asking you to share parent / guardian contacts so they can have a direct relationship too (I.e. they become the data controller and the parent becomes the data subject), then that would be part of the data sharing agreement they have with you and subsequent agreement they have with the parent.

 

We've always refused that in the past, as we don't want suppliers contacting students or parents directly.

 

Guardian notifications in Google Classroom changes that, though. I'm not sure, in that instance, Google do become the Data Controller though, as they're only sending emails we've "authorised" (as in, they are in response to some activity within Classroom). What is your take on that?

GrumbleDook

GrumbleDook

Posted
  • Author
Posted
If they are doing it on your behalf, then they are the data processor. If they are forming a direct relationship with the parents (children at multiple schools) it is a service between parent and the company that you have shared data with.
jmak

jmak

Posted
Posted

I am thinking about where they are the processor and we are the controller, but we hold contact records for different purposes and they're all in the same database with a single link (the child). Eg, we collect contact information for parents, grandparents, next door neighbour. All of them are emergency contacts, some will get reports and homework information, others will receive promotions about events at school or things we're selling to raise funds. Of course we will now be asking them to actively opt in, but we can't currently differentiate the permissions granted/reasons for holding data.

 

I've now taken us off topic - not sure if there's a better thread or if we've come to an end anyway...

enjay

enjay

Posted
Posted
If they are doing it on your behalf, then they are the data processor. If they are forming a direct relationship with the parents (children at multiple schools) it is a service between parent and the company that you have shared data with.

 

I'm honestly not sure which you would classify it as! So, the process is this:

* teacher adds parents' email addresses to Google Classroom

* Google sends activation link to parents

* Parents accept and choose frequency of notification

* Google starts to send automated emails on a daily or weekly basis summarising activity in Classroom

* Google also send reminders as homework deadlines approach or are missed

* No promotional material is sent by Google, only summaries of activities with our Classrooms

 

Is that a direct relationship between Google and the parent, or are they acting on our behalf?!

ARMSchools

ARMSchools

Posted
Posted
I'm honestly not sure which you would classify it as! So, the process is this:

* teacher adds parents' email addresses to Google Classroom

* Google sends activation link to parents

* Parents accept and choose frequency of notification

* Google starts to send automated emails on a daily or weekly basis summarising activity in Classroom

* Google also send reminders as homework deadlines approach or are missed

* No promotional material is sent by Google, only summaries of activities with our Classrooms

 

Is that a direct relationship between Google and the parent, or are they acting on our behalf?!

 

A Data Processor can still be a Processor if contacting the parents directly as they are doing so under your (the Data Controller) instruction only

  • 3 weeks later...
mwnci

mwnci

Posted
Posted
I have been through this spreadsheet and updated it with some of our suppliers. I will aim to fill in some more of the blanks when I get a moment.
  • Thanks 1

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...