out for safeguarding purposes. The completed form should be retained by the group for evidence and reference purposes. School/college actions It is more likely that the school/college will need to deal with incidents that involve inappropriate rather than illegal misuse. It is important that any incidents are dealt with as soon as possible in a proportionate manner, and that members of the school/college community are aware that incidents have been dealt with. It is intended that incidents of misuse will be dealt with through normal behaviour/disciplinary procedures as follows: (the school/college will need to agree upon its own responses and place the ticks in the relevant columns. They may also wish to add additional text to the column(s) on the left to clarify issues. Schools/colleges have found it useful to use the charts below at staff meetings/training sessions). Learner Actions Incidents Refer to class teacher/tutor Refer to Head of Department/Head of Year/other Refer to Headteacher/Principal Refer to Police Refer to technical support staff for action re filtering/security etc. Inform parents/carers Removal of network/internet access rights Warning Further sanction eg. detention/exclusion Deliberately accessing or trying to access material that could be considered illegal (see list in earlier section on unsuitable/inappropriate activities). X X X Unauthorised use of non-educational sites during lessons Unauthorised use of mobile phone/digital camera/other mobile device Unauthorised use of social media/messaging apps/personal email Unauthorised downloading or uploading of files Allowing others to access school/college network by sharing username and passwords Attempting to access or accessing the school/college network, using another learners’ account Attempting to access or accessing the school/college network, using the account of a member of staff Corrupting or destroying the data of other users Sending an email, text or message that is regarded as offensive, harassment or of a bullying nature Continued infringements of the above, following previous warnings or sanctions
a plan of action of non-recurrence and further awareness raising. All significant data protection incidents must be reported through the SIRO to the Information Commissioner’s Office based upon the local incident handling policy and communication plan. Use of technologies and protective marking The following provides a useful guide: The information The technology Notes on Protect Markings (Impact Level) life and events School/college terms, holidays, training days, the curriculum, activities, events, displays of pupils work, lunchtime menus, extended services, parent consultation events Common practice is to use publically accessible technology such as school/college websites or portal, emailed newsletters, subscription text services Most of this information will fall into the NOT PROTECTIVELY MARKED (Impact Level 0) category. Learning and Individual pupil/student academic, social and behavioural achievements, progress with learning, learning behaviour, how parents can support their child’s learning, assessments, attainment, attendance, individual and personalised curriculum and educational needs. Typically schools/colleges will make information available by parents logging on to a system that provides them with appropriately secure access, such as a Learning Platform or portal, or by communication to a personal device or email account belonging to the parent. Most of this information will fall into the PROTECT (Impact Level 2) category. There may be learners whose personal data requires a RESTRICTED marking (Impact Level 3) or higher. For example, the home address of a child at risk. In this case, the school/college may decide not to make this pupil/student record available in this way. Messages and alerts Attendance, behavioural, achievement, sickness, school/college closure, transport arrangements, and other information that it may be important to inform or contact a parent about as soon as possible. This may be particularly important when it is necessary to contact a parent concerning information that may be considered too sensitive to make available using other Email and text messaging are commonly used by schools/colleges to contact and keep parents informed. Where parents are frequently accessing information online then systems e.g. Learning Platforms or portals, might be used to alert parents to issues via “dashboards” of information, or be used to provide further detail and context. Most of this information will fall into the PROTECT (Impact Level 1) category. However, since it is not practical to encrypt email or text messages to parents, schools/colleges should not send detailed personally identifiable information. General, anonymous alerts about schools/colleges closures or transport arrangements would fall