Education and the Data Protection Problem
For many years I’ve worked as the subject matter expert on all things data protection within higher education. Since the GDPR came in to force in May 2018, this has either been as the appointed Data Protection Officer, or more recently as a consultant brought in to help get GDPR programs on track.
As the ongoing apocalypse continues to generate endless news stories, the HE sector is getting a fair bit of attention. From a GDPR point of view, a lot of what is being covered suggests that overall, the sector is struggling to meet its data protection and privacy obligations which is:
a) putting student and pupil data at increased risk
b) decreasing the trust that people have in education establishments (which could impact the ever important NSS scores, student retention and applicant conversion figures); and
c) increasing the likelihood of data breaches which could lead to significant reputational damage, increased numbers of OIA complaints and negative news stories of which there is a growing number that you can read for yourself with a search for “university data breach”
Behind the headlines, evidence that there are some deep-rooted issues within HE and the education sector in general is not hard to find. The ICO carried out a compulsory audit of the Department of Education in February following the brilliant work of Defend Digital Me who have long raised concerns about the misuse of student data within state education.
While only the Executive Summary is available publicly, it contains enough information to show that GDPR is very much seen as a box ticking exercise by the Government department responsible for education in the UK. The 32 urgent findings and the 57 high priority findings seem to support this view. What is equally concerning is that several points raised in the summary are common across the HE sector. Poor oversight and escalation processes limited or missing documentation, unenforced retention periods and a lack of consideration for Privacy by Design and Default when new initiatives and projects are commissioned are the bane of many an education DPO’s existence.
The Blackbaud ransomware attack and their decision to act well outside their remit of a Data Processor highlights the issues with enforcing data processor obligations under Article 28 and raises questions around how education providers can effectively ensure that data protection elements of contracts are appropriately risk assessed and due diligence is carried out to make sure that when things go wrong education providers can have the assurance that the contract is worth the paper it is written on.
Increasing surveillance of staff and students including the collection of medical data without a specific and limited purpose, tracking of emails and monitoring of productivity and engagement has been legitimised by Covid and the need for a robust DPIA process is more important than ever but many organisations still struggle to complete these properly in a way that effectively identifies and mitigates risks.
As a departing University DPO, I understand the challenges faced by institutions and want to help increase the level of assurance around GDPR in the HE sector by offering practical common sense advice and support including auditing, document and contract review, data sharing advice and training for either Data Protection Officers or frontline staff. If you work in HE, and want an informal chat about how I could help, feel free to get in touch.
