Effect of Coronavirus on our Data Protection obligations

Electronic Records

The preferred method for home working is for schools to use cloud-based systems such as one drive and google drive (as the data can be easily accessed and controlled remotely). For those that do have this system, it may be useful to start thinking about who will need access. Where staff have school issued laptops and iPads that they are taking home with them, those devices should have complex passwords on them to limit the risk should they become lost or accessible to unauthorised individuals. In addition, where possible, laptops should be encrypted.

Other good practice measures for electronic devices include: [1] having staff sign acceptable use agreements or statements (and if you have these in place already you may want to remind staff of acceptable use statements prior to them working from home) and [2] implementing two factor authentication to log onto emails or Microsoft/Google networks (this normally means that the user will need to type in a code sent to their mobile device in order to identify it is in fact them who is working from home).

Memory Sticks

There is nothing preventing schools from using memory sticks but they do cause a security risk as they regularly go missing and if there are no security features on the stick this could risk exposure of that data. If you do need to use memory sticks, we would suggest issuing them to staff and ensure they are encrypted. Staff using their own memory sticks should be actively discouraged as there can be no guarantee that they are encrypting them.

Paper Records

If paper files need to be taken off site there should be a heightened sense of security as it is more difficult to keep that data secure as opposed to data stored on cloud-based systems. There is no set guidance on what paper files staff can and cannot take home but you may want to ensure that staff only take the paper files that are necessary for them to complete the required work. Where possible you may also want to limit sensitive data being taken home such as medical and safeguarding data. You could consider getting staff to sign out files they take off site (so you have a record of what has gone off site).

We would also advise reminding staff that they need to exercise caution when taking these files home, not to leave them in their cars and where possible to secure them away (for example in a lockable draw or filing cabinet) at home.

Subject Access Requests

It is possible that if your school closes for a period of time this may affect your ability to comply with a subject access request within the required legal time limit of one calendar month. For the moment this should be judged on a case by case basis – please let us know as early as possible if you are likely to experience any difficulty in complying with the time limit so we can inform the requester in good time for the length and reason for delay.

Do email dataservices@judicium.com should you require advice on subject access requests or remote working.