Reference has been made to data protection professionals having ‘Stockholm Syndrome’ for the law. That applies a hundred times over to me in my personal life and I am proud to claim that. I am the mother of two girls. They are young and they have a say as to whether their picture gets taken and whether it gets published or shared with others, especially in the home setting. When I was in my final year of law school, I wrote my thesis paper on the criminalising of grooming online – so very specifically on the practice of psychologically manipulating a child into a place where they would be compliant to the will of another. While the subject matter is distasteful to some, the principle applies for any and all activities that may affect the privacy and development of the child. Don’t mess with their rights! This morning at breakfast, I had a paper dropped in front of me to sign ostensibly for permission for a student teacher to be in the classroom. I will not include a copy of the two page letter for various reasons but I include my response. Please, take privacy seriously.
Dear Ms XXXX,
I am a parent of two girls who attend XXXX. I received an Information Sheet this morning regarding your teaching practice with a consent form to sign.
In the interests of full disclosure, I am a lawyer that works in the privacy and data protection space. I am not merely being cranky. I take my children’s right to mature without undue assault on their privacy very seriously. They in turn will have the right to question me as their parent as to the measures I took to protect their right while they were in my care.
While you provide some basic information about the project, you have not provided a sufficient privacy notice.
On that note, there are fundamental flaws in your approach to the matter of recording classes that display either a lack of knowledge of the subject matter at hand or an absolute disregard for the principles of the law. We are not dealing with supporting students on their teaching practice. Rather, we are dealing with an intrusion on the privacy of the children in the class. The law requires you to put yourself in the shoes of the child. The law does not require us to put ourselves in the shoes of the teaching practice student. I am very interested to see a copy of the Data Protection Impact Assessment for this exercise and your justification of the right of the student teacher to see themselves teaching trumping the right of the child in the classroom to not be recorded whilst learning.
You mention a ‘minimum’ of three lessons. Where does this end? Every lesson they’re involved in for the full six weeks of their placement at the school? Of all that is wrong with your approach, this highlights the disregard for the principles of the law the most to me. Is your student teacher a professional athlete, dancer or golfer that they need to review endless hours of their teaching practice? By stating a minimum of three lessons, you are attempting to assuage the concerns of the parents involved. This is unacceptable.
You mention a ‘type of digital camera’ with no information about the software and interplay of technology. This information is likely being stored on the cloud. Further, this camera is a physical device being moved around by a person who should be acutely aware of the risks involved. Has this person been trained on these matters? What steps are you taking to secure the device physically as well as technologically?
You refer to research and the ‘focus’ of the research in the midst of attempting to reassure parents that the student is merely reviewing the way that they teach in the classroom. You later on in the communication refer to XXXX researchers by name. You provide no information whatsoever on the relationship between the XXXX and yourselves.
You then double back to the technology part of the exercise with a reference to finding out information in relation to video storage. And, then state that videos are permanently deleted. Permanently deleted from where? From the camera? From the presumed cloud storage? From every single device the student has saved a copy onto? From the cloud storage their devices are likely syncing too? From the devices the researches have saved a copy onto? From the cloud storage their devices are syncing to? I could carry on, but I am sure my point is made.
You state that ethical approval has been granted. I would like to know if any of the data protection matters raised above have been discussed by your ethics committee. Has your ethics committee received data protection related training?
You refer to the researchers involved by name as mentioned herein. The consent you seek is not consent to share with third parties. Your consent statement does not pass muster in this regard. You mention points of contact, yet no data protection officer? I trust that the agreement covering this relationship addresses these points and I look forward to perusing a copy.
I do trust that my concerns, each and every one of them, will be dealt with in a sensitive manner, thank you for your assurance in this regard.
I would imagine that it is fairly obviously at this point that I do not give my consent for a video camera going anywhere near either of my children until I am assured that each and every one of these points has been addressed not just adequately but excellently.
I am a mother and I am answerable to my daughters in the future for the safety and care of their right to privacy. If you take anything away from this communication, take that away. Together with the fact that I hold specialist knowledge and I am held to that very high standard. It is my duty to them to address concerns.
In that light, in order to make an informed decision on behalf of my children:
- Please provide me with a response to the points above.
- Please provide me with a copy of the Data Protection Impact Assessment for this exercise – XXXX Students recording video footage of children in classrooms.
- Please provide me with a copy of your data protection policy for your organisation.
- Please provide me with a copy of a privacy notice for the student teaching practice exercise.
- Please provide me with a copy of the data processing agreement between XXXX and Swivl with full detail of any international data transfers that might be occurring.
- Please provide proof of training records of student teachers involved in teaching placements at XXXX.
- Please provide me with a copy of the security measures you have instituted for this data processing activity covering each of the data storage points along the processing chain.
- Please provide me with a copy of the agreement between yourselves and the XXXX governing the joint research project.
- Please provide me with a copy of the data protection impact assessment in place for the joint research project.
- Please provide me with a copy of the retention schedule for this exercise stating every data asset where video footage might be stored.
Once the above has been received and once I have had time to go through each in detail, I would be delighted to reconsider giving my consent on behalf of my children to have them filmed during teaching practice.
Further, student teachers have survived for centuries now without observing themselves on video doing teaching practice. It is not an impossibility to imagine teaching practice without the intrusive presence of a camera in the room.
Philipa is the lead consultant and auditor at ProPrivacy. With clients as far afield as Canada, South Africa, Kenya, Germany, Spain and other such exotic locations, besides Cork and elsewhere in Ireland, Philipa enjoys a broad view of the state of data protection, privacy and cyber security worldwide. Philipa’s passion is manageable data compliance for SMEs.
Philipa is a qualified teacher besides holding a computer science (Bachelor of Science in Artificial Intelligence Programming) and electronic and intellectual property law (LLB) qualified. She is trained in constitutional (fundamental) rights litigation and enjoys a good debate.
Philipa has over twenty years of experience working in different sized organisations and sectors on operational, governance, risk management and compliance matters. She is an analytical and focused person that enjoys a challenge in the workplace. She loves technology, systems and people and has a passion for showing people how technology can make life easier and better. She understands that the world is driven by data today but privacy is paramount. Responsibly developed AI excites Philipa for the future.