How does the school protect children's data from Big Tech

[MotherGlasgow1]

My daughter has returned to primary school and we've been told the school has already signed us up to google classrooms and class dojo. We were sent home letters which showed the google one gave my daughter's date of birth as her password and the class dojo one was a list of random numbers.

Previously they have signed us up to Parent pay, Parent mail and tapestry, and expect us to be registered also with zoom and whatsapp - that's 5 big tech private companies the school has given her personal details to absolutely without my permission ( and ahead of my knowledge it was going to happen, so could not even try to prevent), and further two we're basically been arm-twisted into joining (missing key info if we don't).

I fully appreciate I am something of a luddite and some technology is probably inevitable but does anyone REALLY know what these private companies are doing with our kids' data? I was truly horrified they gave google her date of birth ( i would NEVER choose to do this, I have never even used her real name on facebook) especially as I already told them last year not to sign her up to anything without specific permission.

Thier explanations is "PANDEMIC" and my counter argument is you are giving our information now and these businesses will go on to retain it for a whole lifetime, long after the pandemic is forgotton.

I am particularly concerned as it sounds like the school office somehow grants google a back door into the school roll data and google will just "take what it needs" via this back door to function ( where are the checks and balances on this) I am astounded!!!

Does anyone know if I (or my daughter) actually have any rights in this situation? I have offered to use the platforms but using diminutive names etc and a fake DOB etc but am told not allowed. Head teacher will ( and has) automatically dismiss any dissent from parents.

I totally appreciate that some people will think I am being a fusspot but ultimately this is how I feel, I'm unlikely to change my point of view so does anyone have any idea legally where do I stand? Any suggestions what can be done? If you've got this far thank you so much for reading. Many thanks.

Do you have suggestions for how the school can deliver these same services that you do find acceptable? Will your suggestions be adding to school workload?

Are you sure ypi havent signed a consent form with your admission papers? It might have been a bit of a catchall statement.

What do you think 'Big Tech' is going to do with this data?

I don't think they need consent under GDPR but you could ask to see their privacy policy as a starting point?

Ultimately, I think the only way to stop it would be a political campaign so the DfE or devolved departments would prohibit their use in schools.

Your user name suggests you are in Scotland. If this is the case the google classrooms is set up via the national platform Glow

glowconnect.org.uk/g-suite-for-education/classroom-in-glow/

thank you al for your thoughts :-D

I have asked them to show me specifically where I signed up to agree it's ok :-D In any case I would have hoped I would have superceded any sort of catch-all statement by saying specifically 'you do not have my consent' - but apparently not.

I genuinely don't know where I could have agreed to it although I suppose I am vaguely aware they are allowed to share certain info in the case of safeguarding or welfare concerns. But obviously this is not the case here.

It just rings a lot of alarm bells for me as lockdown education means that the 99% of kids who go to state schools school are having their data handed to Big Tech without any proper safeguards in place and with no discussion with parents. As a parent I appear to have no rights. It's like my daughter and her data belong to the state to do with whatever they like.

Obviously I am out of my era but I find it really unsettling that young kids' info - attainments? behavior? is shared with businesses who may one day have a hand in social credit systems etc.

Path of least resistance - Of course I don't want to add to a teachers' workload but on the other hand I would be lying if I said I didn't value my child's digital soul more. I hope you'll forgive me but that's my priority as a parent. Also I've offered to use different sign-ins if necessary. so that would NOT add to their workload. Plus, surely the school cannot possibly benefit in any tangible way by insisting on her real d.o.b. etc. I find it really unsettling this is just presented to parents fait accomplait with no explanation of ts & Cs, privacy or choice. I would never n a million years give my child's personal information to google. Never in a million years. And now they have it, which makes me very concerned.

Lisa ( sorry I don't know how to bold up your name - thank you very much I'll have a proper read to see if it says anything about privacy. This kind of proves my point though if every school in Scotland is now giving student details to google :-0

They wont have any more than an Email address probably, what do you think they are going to do with the data?

Consent is only one reason data can be shared. I am having a memory lapse but i think its something like public task - so its ok to share if its part of the legitimate pursuit of education. Then the school will have privabcy statements from all the people they shate data with on a file plus their own statement and stuff about how long data is kept for. They will also log any data breaches.
I'll be honest and say i am alarmed by the amount of information stored about our children too.

Billy that's not the case unfortunately.

If you think about it, they have ( at the very least) the child's name as it appears on the school roll, their school, their school's address, their year group, their date of birth, it's not a big leap to group kids alongside the names of their peers, the name of their teacher, they will then (when the parent signs up) have the name of the parent, and at the very least an IP address for the parent. I have yet to sign up as a parent (the school signed up my daughter) so I don't know what else.

That is a lot. We're talking about google. Google classrooms keep track of educational attainments and behavior. How do google make a profit? Data.

Well realistically that’s how the school have decided it’s most effective to operate, so if you don’t want to participate in that you need to find another school or home school.

Equally, when are you going to be happy for your daughter to hand her information over to tech companies? When she makes a social media account? When she registers for UCAS to apply to uni? When her secondary school use online platforms to prepare her for public exams?

It’s 2020, this is how things work. In the nicest possible way, I think you need to get a grip.

Also google classrooms don’t track behaviour. Class dojo might, if your school use it in they way. Have you thought about considering the benefits of online resources before just wildly panicking?

You are naive if you think any of your data is private anymore. Have you ever mentioned your child's name on social media, posted that it's their birthday, their first day at school?

Suggest you post in 'Geeky stuff' to get some facts rather than blowing up at the school. I strongly suspect that no big tech company has your kids data at all - it'll be stored on the school server and access granted on a yes (kids details match)/no basis.

Pizza Pasta whatever - there is no need to be rude. Do you have any insight into how you know digital sharing in schools works in practice?

ChaChaCha - genuinely, no I have not. Ihave never mentioned any of those things about my family. I appreciate the cat is out the bag with regard to my identity, but I have protected the next generation from Day One. No photos. Nothing.

Titchy, thank you you may be correct I don't really use mumsnet much so may be better to post in another place.

Regardless of whether or not i am correct in my thinking, as a parent I should have certain parental rights regarding the management of my own information and my children's information.

I'm not wildly panicking but I do think it would be prudent to ask some questions as a parent before giving carte blanche on an action which CANNOT EVER BE UNDONE. it frightens me a little bit that so many people are like, 'oh well, not to worry, what's the point, its 2020'. If you know of concrete checks that are in place in real schools, or if you yourself have received proper justifications from your childrens' schools, please please let me know because I'd love to have one thing to fewer to worry about!

I have asked the school what checks etc they have in place and these have been unforthcoming. This does make me worry that they have signed up, only because other schools have signed up, etc etc - who has actually done the checks in the first place?? If they haven't actually gotten the legal reassurances themselves they shouldn't be giving away my child's digital identity, and they should always ASK parents for the right to do so. If they are going to give away my child's information they should at least be able to provide a decent case for doing so; on balance - for's and against.

I feel really exhausted that the answer to any criticism of the school is 'move schools'. Of course you are probably right - but you are not told any of this before you enrol them so its reasonable to expect something other than 'my way or the highway.'

We should not have to move - she's worked so hard to settle and make friends. Actually if its true in Scotland that every school is signing up to it it is pointless moving schools, isn't it?

Which brings us to 'give google your child's digital identity or you may not receive a state education' (that you have taxpayer funded, along with everyone else). SURELY this cannot be right.

I am thinking abut becoming Amish :-D

Does anyone know for sure how the practical sharing of information with these organisations in schools actually works? An insider's point of view of the actual mechanics of it?

Scotland and Wales have nation wide digital platforms for all schools.
It might be better if you think about what an amazing opportunity this is and how it will benefit your child.
Schools are designed to run using these systems.

Your child's information will also be held on other digital platforms - for registration/lunch orders/any form of online assessment.

Interestingly in Wales at the start of lockdown the government overrode the requirement for parental consent to ensure all pupils had the opportunity to access digital content that was being provided for remote learning. According to the press release at the time the decision was made after taking legal advice and informing the ICO.

The school is the data controller for GDPR purposes for ParentPay, ParentMail and Tapestry. The suppliers are not allowed to do anything with the data unless they have specific instructions from the school. As the school is the data controller, they have not broken GDPR by using these suppliers and they do not need your consent.

Zoom doesn't need any personal details other than an email address and a password for users with accounts. Users only need accounts to arrange their own meetings. If you simply attend meetings arranged by others you don't give them any personal information at all.

WhatsApp knows your phone number, mobile service provider, type of phone and operating system. It does collect other data but you can stop it from doing so in the privacy settings.

ClassDojo is a data controller. They are fully compliant with GDPR.

Google Classroom is part of G-Suite for Education which is also fully compliant with GDPR.

The school does not need your consent for what it has done. There are six lawful bases for processing personal information. Consent is only one of them. Several of the others are likely to be available to the school - contract, legal obligation, public task and legitimate interests. If they can show that any one of these applies, they can process information without your consent and can continue to do so even if you make it clear that you do not consent.

We use Seesaw. We signed up to the fully paid version in order to provide out home learning remotely.

Seesaw is fully GDPR complaint, as well as being part of the EU-US privacy rules (also a GDPR compliant service.) We don't ask for specific parental permissions for the individual software but it is covered under other permissions we ask for. Parents can also choose to have their children exempt, though we do have to make them aware that as a result they will be unable to access certain services provided by school. For example during lockdown they would have only been able to access PDF versions of remote learning, with no option of submitting with feedback. They could have emailed but this would be subject to delays and feedback would have been limited compared to using the app/website.

When signing up as a school the information provided us the school name and address, an email address for school and - as now fully paid up - they have some bank details of school.

Regarding the children we enter their first name and initial only. All of the access is password protected - we have a class blog on there with a password for the class. Children have individual accounts and they have a password or QR log in which is specific to them.
As part of our photograph permissions we add photographs of children and/or their work, as can parents. If a parent has declined photograph permissions which covers this we do not add them.
Parents can access their own child's work which they set up themselves using their own details and own password. They can only view work and photographs which their child is tagged in to.

Out of all the time we have used this, and before that the free version for years, only 1 parent has refused access - this was nothing to do with GDPR reasons and related to other issues between the school and the parent. The other hundreds of parents have had no issues with its general use. Currently we have 2 children across the school of 270 who are not allowed their photographs added to their password protected accounts.

Sympathetic to OP's concerns. Use of children's birthdates as passwords for Google Classrooms seems really unnecessary and an added security risk.

Requiring WhatsApp bothers me most. Lots of personal info collected by Facebook (which owns WhatsApp) and many security issues with their group chats in particular. Signal is a more secure messaging platform but most schools/PTA/parent groups are still defaulting to WhatsApp for convenience. And many people misuse it (e.g. to spread 'copy pasta' and forward fake news).

Info from @prh47bridge provides helpful context but I wouldn't stop being vigilant about how children's data is used via the school. We had an incident (pre-Covid) of our primary oversharing children's data (unintentionally/unwittingly) with Kidzania which they visited on a school trip (first name, last name, date of birth so that they could get their own 'bank cards').

Are you sure ypi havent signed a consent form with your admission papers

Consent is not a suitable grounds for processing data in this situation (due to the balance of power between the school and the pupils) so it will never be one a school will be relying on - indeed I would argue it's impossible for them to obtain.

Zoom doesn't need any personal details other than an email address and a password for users with accounts. Users only need accounts to arrange their own meetings. If you simply attend meetings arranged by others you don't give them any personal information at all.

This is not entirely true, if you use the Zoom app, the Zoom app collects all sort of personal information tied to the user (configuration data, meeting metadata, feature usage data, performance data, service logs, they are using legitimate interest among other grounds for the processing and are data controllers - the school would need to inform you of that. Now it's very pseudonymised and not obviously negative or tied to you or your child beyond via the connecting IP address, but it is processing it for their own purposes.

So whilst the actual risk from the collected is minimal, because it is legitimate interests, then one of the obligations on the school using zoom is to inform you of the right to object to those legitimate interests - which of course applies to any other legitimate interest use.

The phone or SIP/h323 interfaces to zoom collect significantly less data and are essentially fully anonymised, normally make those a suitable option for those people who choose to object to zoom's processing.

What bothers me too about Zoom is that there is no guarantee that the people using it are fully informed/trained to avoid classes/meetings/workshops being hijacked or 'zoombombed' by malicious trolls... Many examples of failure (e.g. Singapore temporarily banning Zoom for teaching due to attacks, large social gatherings where porn was streamed much to the horror of the original hosts).

Google don’t have access to the passwords as it’s done in house via the school or IT department.

The DOB with only be used as the first sign on and they are asked to change it.

It’s a great system and used well into secondary school to keep track of homework and assignments.

If you sign up on your phone as well you get the alerts for homework and key messages - DS is dyslexic and I can help him keep track.

Your child's future will technology based wether you like it or not!