Shocked to have been secretly recorded at work.

[Whataninvasionofprivacy]

I work as a TA in school, and last week at the end of a lesson, the teacher called me over and indicated (behind the kid’s backs) to the class cupboard. She then whispered “Will you turn off the iPad?” I wasn’t sure what she was on about, but she then whispered that she’d just recorded the entire lesson, but didn’t want the kids to know. She had been told to do this by a senior staff member.

Am I being ridiculous to feel annoyed by this? I’m sure I should have been told beforehand. Also what about parents who don’t normally consent, they had no choice in this case.

Have the people defending this never heard of hacking. What is the security like on this school iPad holding all these recordings of children. What platform is being used if any to record? Where it is it hosted?

if I was a parent I’d be quite concerned about this lack of basic knowledge or concern about protecting children’s data.

I would also be interested to know how many of these schools coaching teachers to break gdpr because their policy says so are academies. Total law unto themselves it seems.

So if the system is hacked and someone accesses a short clip which may show the back of 30 kids' heads and hears some voices they don't recognise, what damage is actually done?

If one rogue individual hacks a system and views a video of persons unknown to them and doesn’t do anything else with that data, no real damage is done to the data subject. But this would be an unusual scenario.

most hacking is performed for profit, it’s sophisticated organised crime, often performed by state sponsored entities. Large tech companies are routinely the subject of hacking attempts (successful or otherwise) stolen data can be combined with additional data sets, shared and sold on the dark web.

the potential for damage is considerable. It’s never about just one video and even if it was the fact that you don’t see and cannot anticipate what the risks might be does not negate the fact the law applies.

Thank you @RunningOverTime for your contributions to this thread. Voice of reason very much needed.

Right, so we want everything that applies to 'large tech companies' to apply to a primary school classroom, even though it doesn't? But teachers are arrogant for thinking they can use technology to get better and do as much as possible within the constraints of a poorly funded system.

Zoom / meet / teams lessons were fine by parents when they wanted their kids to log on and be occupied at a distance by a teacher all day, despite this having no research based evidence as being better for their learning than anything else teachers could provide asynchronously. Anyone could have listened in or recorded any part of that. But I doubt snippets of phonics lessons were sold for profit on the dark web.

I don't think their voice responding in a classroom would constitute personal information, no.

OP did not say this was just an audio recording.

Well then you don't know very much about data protection laws.

Right, so we want everything that applies to 'large tech companies' to apply to a primary school classroom, even though it doesn't?

Large Tech companies do not generally have consumers who are small children. I would expect primary school classrooms to be required to have even tighter safeguarding.

No we want teachers to adhere to the laws that have applied to them in one form or another since the 90s. We want them to uphold data safety and prioritise child safeguarding.

I referenced large tech companies in the context of hacking because if large tech can be hacked so can smaller less sophisticated organisations. And they are. In spades. Often without even being aware that an incident has occurred. And of course IRIS and iCloud and all of the other platforms on which data is stored ARE big tech.

and if you think videos of primary school classrooms have not been sold on the dark web then I am grateful that your life has been so sheltered.

Then you are wrong. As you have been with all your other comments on this thread.

@Whitak the laws on data management apply to all organisations or institutions, large or small. Including primary schools, tiny charities, massive businesses etc etc. I’m involved in a volunteer run community charity and we have just as much responsibility to handle information legally as a big tech company.

A school is unlikely to be hacked for valuable data, but there are more relevant reasons for protecting children (and staff). As has been described above, in detail. Head teachers and governors are legally required to uphold data protection. It’s not subject to being properly funded, or a choice depending on how teachers want to run their classes.

I wonder if my voice responding my name, date of birth, NHS number, medications or medical history during a 'calls are recorded for training and quality purposes' phone conversation with my GP receptionist means I shouldn't access medical care if I don't consent, or whether they're wrong for using technology to get better in difficult circumstances, or it actually isn't as important as people screaming 'but GDPR' makes it seem.

It's entirely likely that permission has been sought for images, audio and video within these contexts at school and teachers are acting in loco parentis. If a parent can judge it's fine to hold images of their kids (or allow them to make and share them on their own devices!) a teacher who is teaching them should be able to do so within the institution's policy.

Images of young children and their voice can be (and have been) used together to create deepfakes. It surely doesn’t take much imagination to realise what those deepfakes are of, the size of the market for them or the devastating affect they could have on the child’s life?

Thanks @Byjimminy ironically I’m having a day off from work today, but I’m a bit geeky on this topic and if one person goes away with a better understanding of privacy related issues I’m delighted 😊

And of course IRIS and iCloud and all of the other platforms on which data is stored ARE big tech.

Which country do they store it in?

A better analogy would be if your GP recorded your entire medical appointment on a hidden camera and didn't tell you.

It's the covert nature that is so deeply concerning here.

Re IRIS I have no idea.

Apple have made great efforts to ensure cloud data is stored in data centres that correspond with regional physical location although this is obvs dependent on availability.

It's entirely likely that permission has been sought for images, audio and video within these contexts at school and teachers are acting in loco parentis. If a parent can judge it's fine to hold images of their kids (or allow them to make and share them on their own devices!) a teacher who is teaching them should be able to do so within the institution's policy.

Wow! Do you honestly believe teachers acquire parental rights and responsibilities when children are in school!??!? Loco parentis just means you have a duty to care for a child as a reasonable parent would. It does not give you any of their rights.

In loco parentis is a legal position. It's the responsibility to take on the role and responsibilities of a parent. Act in place of, in their absence. That does give the same authority and decision making, in caring for a child.

It's deeply concerning if you are a teacher and don't understand all the parameters to the in loco parentis role

JFC !

the 1989 Children Act provides that teachers have a duty of care towards children in their care. It doesn’t mean they can abrogate the rights of child and parent as and when they wish.

its worrying that you’re a teacher

It is absolutely not that. It is purely a duty of care towards a child. You do not take on either the rights or responsibilities of a parent. You definitely do NOT have the same authority as a parent.

The school should have provided a photo and video consent for parents to sign and be recorded on the MIS, explaining typical usage, at some point pending or after admission. If they've already done that, then filming is fine from a student POV.

For staff, it's often less effectively done and assumed that everybody consents. This doesn't make it right at all, though. You could formally ask what the video is being used for and on the basis of their response, either accept or refuse consent.