Using proxy sites or other means to subvert the school’s / academy’s filtering system x x x x Accidentally accessing offensive or pornographic material and failing to report the incident x X Deliberately accessing or trying to access offensive or pornographic material x x x X Receipt or transmission of material that infringes the copyright of another person or infringes the Data Protection Act x x x x Actions / Sanctions Staff Incidents Refer to line manager to Head teacher Principal Refer to Local Authority / HR Refer to Police Refer to Technical Support Staff for action re filtering etc. Warning Suspension Disciplinary action Deliberately accessing or trying to access material that could be considered illegal (see list in earlier section on unsuitable / inappropriate activities). X X X Inappropriate personal use of the internet / social media / personal email x x X Unauthorised downloading or uploading of files x x X Allowing others to access school network by sharing username and passwords or attempting to access or accessing the school network, using another person’s account X x x Careless use of personal data e.g. holding or transferring data in an insecure manner x X Deliberate actions to breach data protection or network security rules x x X Corrupting or destroying the data of other users or causing deliberate damage to hardware or software x x X Sending an email, text or message that is regarded as offensive, harassment or of a nature x x x X
Using personal email / social networking / instant messaging / text messaging to carrying out digital communications with students / pupils x x x X Actions which could compromise the staff member’s professional standing x x Actions which could bring the school / academy into disrepute or breach the integrity of the ethos of the school / academy x x X Using proxy sites or other means to subvert the school’s / academy’s filtering system x x X Accidentally accessing offensive or pornographic material and failing to report the incident x X Deliberately accessing or trying to access offensive or pornographic material x x x X Breaching copyright or licensing regulations x X Continued infringements of the above, following previous warnings or sanctions x x x x Appendices Pupil agreement policy Parent agreement policy Staff agreement policy Community user’s agreement policy Responding to incidents of misuse flow chart Recording of misuse incidents form Reporting log Training needs log
Training & awareness All staff will receive data handling awareness / data protection training and will be made aware of their responsibilities, as described in this policy through: Induction training for new staff Staff meetings / briefings / Inset Day to day support and guidance from Information Asset Owners (Risk Assessments Information risk assessments will be carried out by Information Asset Owners to establish the security measures already in place and whether they are the most appropriate and cost effective. The risk assessment will involve: Recognising the that are present; Judging the of the risks (both the likelihood and consequences); and Prioritising the risks. Risk assessments are an ongoing process and should result in the completion of an Information Risk Actions Form (example below): Risk ID Information Asset affected Information Asset Owner Protective Marking (Impact Level) Likelihood Overall risk level (low, medium, high) Action(s) to minimise risk Impact Levels and protective marking Government Protective Marking Scheme label Impact (IL) Applies to schools? Not Protectively Marked 0 Will apply in schools Protect 1 or 2 Restricted 3 Confidential 4 Will not apply in schools Highly Confidential 5 Top Secret 6 The school will ensure that all school staff, independent contractors working for it, and delivery partners, comply with restrictions applying to the access to, handling and storage of data classified as Protect, Restricted or higher. Unmarked material is considered ‘unclassified’. The term
Users must protect all portable and mobile devices, including media, used to store and transmit personal information using approved encryption software; and Particular care should be taken if data is taken or transferred to another country, particularly outside Europe, and advice should be taken from the local authority (if relevant) in this event. Disposal of data The school will comply with the requirements for the safe destruction of personal data when it is no longer required. The disposal of personal data, in either paper or electronic form, must be conducted in a way that makes reconstruction highly unlikely. Electronic files must be securely overwritten, in accordance with government, and other media must be shredded, incinerated or otherwise disintegrated for data. A Destruction Log should be kept of all data that is disposed of. The log should include the document ID, classification, date of destruction, method and authorisation. Audit Logging / Reporting / Incident Handling It is good practice, as recommended in the “Data Handling Procedures in Government” document that the activities of data users, in respect of electronically held personal data, will be logged and these logs will be monitored by responsible individuals. The audit logs will be kept to provide evidence of accidental or deliberate data security breaches – including loss of protected data or breaches of an acceptable use policy, for example. The school has a policy for reporting, managing and recovering from information risk incidents, which establishes: a “responsible person” for each incident; a communications plan, including escalation procedures; and results in a plan of action for rapid resolution; and A plan of action of non-recurrence and further awareness rising. All significant data protection incidents must be reported through the SIRO to the Information Commissioner’s Office based upon the local incident handling policy and communication plan. Member of staff is not communicating on behalf of the school with an appropriate disclaimer. Such personal communications are within the scope of this policy.