The Coronavirus Covid-19 pandemic is having a huge impact on schools.
With closures happening this week, we thought it would be useful to provide a brief overview of the data protection implications.
Home Working
If any staff are going to work from home, you need to consider first whether they will be taking any records home. The legal requirement is, when handling personal data, to put in place “appropriate” security measures – by following the steps below this should help comply with this requirement and limit the possibility of a data breach occurring.
Electronic Records
The preferred method for home working is for schools to use cloud-based systems such as one drive and google drive (as the data can be easily accessed and controlled remotely). For those that do have this system, it may be useful to start thinking about who will need access.
Where staff have school-issued laptops and iPads that they are taking home with them, those devices should have complex passwords on them to limit the risk should they become lost or accessible to unauthorised individuals. In addition, where possible, laptops should be encrypted.
Other good practice measures for electronic devices include: [1] having staff sign acceptable use agreements or statements (and if you have these in place already you may want to remind staff of acceptable use statements prior to them working from home) and [2] implementing two-factor authentication to log onto emails or Microsoft/Google networks (this normally means that the user will need to type in a code sent to their mobile device in order to identify it is in fact them who is working from home).
Memory Sticks
There is nothing preventing schools from using memory sticks but they do cause a security risk as they regularly go missing and if there are no security features on the stick this could risk exposure of that data.
If you do need to use memory sticks, we would suggest issuing them to staff and ensure they are encrypted. Staff using their own memory sticks should be actively discouraged as there can be no guarantee that they are encrypting them or that they are free of malware.
Paper Records
If paper files need to be taken off site there should be a heightened sense of security as it is more difficult to keep that data secure as opposed to data stored on cloud-based systems.
There is no set guidance on what paper files staff can and cannot take home but you may want to ensure that staff only take the paper files that are necessary for them to complete the required work. Where possible you may also want to limit sensitive data being taken home such as medical and safeguarding data. You could consider getting staff to sign out files they take off site (so you have a record of what has gone off site).
We would also advise reminding staff that they need to exercise caution when taking these files home, not to leave them in their cars and where possible to secure them away (for example in a lockable draw or filing cabinet) at home.
Subject Access Requests
If schools close for an extended period of time this may affect your ability to comply with a Subject Access Request within the required legal time limit of one calendar month. For the moment this should be judged on a case-by-case basis. If you are likely to experience any difficulty in complying with the time limit; please ask your Data Protection Officer to inform the requester in good time for the length and reason for delay.
Whilst this may not be high on your priority list at present, you may consider outsourcing your DPO role to a professional DPO organisation that deals with schools and has the legal knowledge, scale and capacity to deal with al aspects of DPO and GDPR.
We will be happy to put you in touch with our recommended provider if you wish. Just ask.
Many thanks to Judicium Education for the update.
Comentarios