GDPRtopics

GDPRprocess

Monitoring

The Article 29 Working Party has produced new guidance on data processing in the workplace, to account for the very significant changes that have occurred since their previous guidance in 2001. Although the focus is on "employee monitoring", it is likely to be relevant to other situations where an organisation has significant power over those who use its premises and equipment. The guidance considers the requirements under both the Data Protection Directive and, from next year, the GDPR.

14 June 2017 at 11:30am

GDPR: Attendance Monitoring

A question recently arose about monitoring students' attendance at lectures and tutorials, and how this fitted into data protection law. Since the main purpose of such monitoring seems to be to identify and assist students who don't attend, and whose presence is therefore not recorded or processed, there seem to be a number of both practical and legal issues to think about.

27 April 2017 at 2:42pm

ICO request for feedback on profiling under the GDPR

Learning Analytics

We've just responded to the ICO's request for feedback on Profiling under the General Data Protection Regulation.

5 May 2017 at 8:48am

GDPR: Alumni processes

ePrivacy Regulation

Alumni

Most universities maintain databases of alumni, for purposes including keeping them informed about the organisation, offering services and seeking donations. These activities have a lot in common with other charities, so the Information Commissioner's guidance is relevant.

19 April 2017 at 9:38am

GDPR: Official CSIRTs?

incident response

A couple of organisations have asked me recently whether the General Data Protection Regulation (GDPR) requires them to get some sort of external recognition of their incident response team. Here's why I don't think it does. Recital 49 of the Regulation says:

19 April 2017 at 9:41am

Consent for Learning Analytics: Practical Guidelines

Learning Analytics

Data Protection Act

Recently I've been doing some work with Niall Sclater on how education organisations might inform students about the use of learning analytics, and when they might seek students' consent. The resulting blog post is at https://analytics.jiscinvolve.org/wp/2017/02/16/consent-for-learning-analytics-some-practical-guidance-for-institutions/

19 April 2017 at 9:43am

Incident Response and the GDPR

incident response