This blog is a philosophical article. It is based on all the teaching and support staff in schools who are leaving their current positions at school (this term). It is also inspired by the story of Randy Pausch and his ‘Last Lecture’. Context: As I contemplate moving schools, I look to Pausch’s Last Lecture as … Okumaya devam et
Starting out as a teacher, I was terrified at public speaking in assemblies and staff briefings. However, when starting out in middle leadership just 2½ years later, I discovered I had no choice. I had to speak and present on behalf of my faculty. It was the expected norm and as with all things teaching, … Okumaya devam et
I attended my first ever school TeachMeet last year and during and after the event, the experience posed many, many questions to me as a school CPD leader. “critical peer reviews [academic papers] clearly cross the line between a vigorous critique and an unprofessional attack.” Context: My definition of a ‘school TeachMeet’ is this: A … Continue reading
It’s that time of the academic year that is known to some as, the ‘Silly Season‘. Context: Picture yourself 2 or 3 weeks ago before the Easter break … Just when you thought exhaustion couldn’t get any worse, despite a brief respite, you find yourself back at school with work ‘up-to-your-ears’. For the experienced teacher, … Continue reading
The idea for this particular 5MinPlan came about, when reviewing our school’s behaviour policy. When considering implementing change you need to think carefully if there is the need for change. The change plan is based on the work of Kotter (1996) and Blanchard et al (2009). Charles Darwin stated: “It is not the strongest of … Continue reading
As part of my involvement with the Scottish Government’s ICT Excellence in Education group I have been learning a lot about ‘Safe Harbor’ [sic] agreements and their impact on what we can and can’t do with data in schools. In addition, it has become very apparent that many people don’t know very much about the topic and that as a result, the default position is to block things rather than find out the reality. I don’t think it’s any secret that one of the services I really like for using with classes is Edmodo, but there have been questions raised about Edmodo and its safe harbor status so, in the interests of explanation and clarity, here’s a wee guide to what safe harbour is, how you can check whether a service is a signatory, and why Edmodo is safe to use.
We have a great responsibility in schools to keep pupil data safe and secure. However, in the ‘cloud’ computing age, it is becoming more and more common for our online data to be hosted ‘somewhere’, and it’s not always easy to know where. The relevant legislation and laws governing how this data is used lies within the Data Protection Act 1998 (DPA98). From a Scottish point of view, Data Protection is what is known as a ‘reserved matter’ — which means Westminster makes the law rather than the Scottish Government, so address any complaints to London!
Schedule 1 of the DPA98 lists its key principles as follows:
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
The UK Data Protection was a direct response to EU Directive 95/46/EC which was introduced in 1995 and had to be enacted by the end of 1998 (hence the date of the UK DPA). It is fair to say that the EU and by extension, the UK, have some of the most rigorous data protection rules in the world. This has had the knock on effect of meaning that it is expressly forbidden for pupil data to be held outwith the European Economic Area (EEA — ie: the EU for all practical purposes) unless the company has agreed to observe the same level of protection for the data as that provided within the EEA. Note the important point, an individual company can be approved to host data, there is no requirement for there to be an agreement with a whole country. That said, because of the importance for American businesses in particular to be able to work seamlessly with residents of the European Union, it was decided to create a US-EU agreement in 2000 whereby American businesses and service providers could adopt the principles of EU Directive 95/46/EC. In effect, they would agree to maintain the same levels of security and protection of personal data as that offered within the EU. This is the ‘safe harbor’ agreement.
In order to transfer data outwith the EU, Principle 8 of the DPA98 comes into play. This states that:
Personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
Sending personal data outside the European Economic Area (Principle 8)
The ‘safe harbor’ agreement is overseen by the EU and the US Department of Commerce. As long as a company is signed up, we do not have to worry about the fact that data will be held in the US. There is, however, one very important condition to this which I will mention when talking about Edmodo in a minute or two.
In short… as long as a US company has agreed to observe ‘safe harbor’ environments — which they need to re-accredit themselves with every year — there should be no legal reasons why you should not use them. So… how do you check whether a company is a ‘safe harbor’ signatory?
How do you know?
The obvious place, and the first port of call, is the US Government’s Department of Commerce Safe Harbor site which you can find at http://export.gov/safeharbor/. However, you need to be aware that this site is not fully up to date… in fact, it really does need to get a serious overhaul! You can search, but you will struggle to find some really obvious companies thsat are signed up to the safe harbor agreement… which brings me to Edmodo and TRUSTe.
Is Edmodo a ‘Safe Harbor’ company?
One of the most popular sites that teachers have been adopting for using in class is Edmodo. It looks like a very well known social media site, but is designed from the ground up to be a virtual classroom with lots of whistles and bells. It also has the advantage of being popular with classes as they ‘get it’ from the word go. Chuck in the mobile Apps for iPhones, iPods and iPads, as well as the new Android app, and you begin to appreciate that Edmodo are really on to something (Disclosure: I am a fan!). There is, however, one particular fly in the ointment that needs to be addressed. I have seen a very snippy response from someone that Edmodo is not a ‘safe harbor’ company and so should not be used. The basis for this assertion was that Edmodo does not (yet) appear on the US Gov’s ‘Safe Harbor’ listings, but, as I mentioned above, the ‘official’ site is notoriously slow at updating, and does not have all safe harbor companies listed. Fortunately, there is TRUSTe. This is the online privacy company used by Microsoft, Apple, Disney and many, many others to ensure data and privacy legislation compliance. In short, they are in the business of keeping companies secure, and also in the business of ensuring that all their data is entirely up-to-date and relevant.
If you go to the TRUSTe search page (http://www.truste.com/consumer-privacy/trusted-directory/) you can enter any company or service name and will be given a list of all the relevant certificates or seals that the company holds. A quick search for Edmodo returns this:
Edmodo are indeed an EU Safe Harbor company… but I decided to bite the bullet and ask them why they didn’t appear on the US Gov Safe Harbor list. I dropped them a line and got a wonderful reply from Lucia who, amongst other things, let me know that their lawyers are working on speeding up the US Gov list. What she also reminded me of, was the condition I hinted at earlier. It is essential that in order to comply with the legislation, every learner who signs up for Edmodo completes a consent form. There are some samples available through Edmodo itself, but you will need to customise them for your school and to include a space for parents/carers to sign their agreement. Once you have received these, you should be good to go… unless, of course, your LA decides that Connected Learning is not a desirable thing.
In conclusion, here are the sound bites that I should have just tweeted!
- You can use a service/solution that hosts personal data outwith the EU as long as the company/service are signed up to the Safe Harbor agreement.
- You should use TRUSTe as well as the US Government to check the safety credentials of a site.
- Edmodo is a (rather awesome) ‘safe harbor’ company.
I hope this helps clear up some of the confusions I’ve been hearing about. Feel free to post a comment if you have any questions or wish further clarification.
[UPDATE — Meant to mention this in the main body of the post, but Google are also a safe harbor company which is great news if you wish to use Google Apps with your learners! ]
What did we do today?
Some science with the wee ones - into the hall to throw (or attempt to throw) some paper about in the hope of learning a little about aerodynamics. Success rating? 5 out of 5 - all engaged, loads of good questions, answers and theories from the little people.
By investigating forces on toys and other objects, I can predict the effect on the shape or motion of objects.
By investigating how friction, including air resistance, affects motion, I can suggest ways to improve efficiency in moving objects.