Risk Mitigation
Risk Mitigation
Embedded Files
The Delta School District believes that the most important element when considering the adoption of any online tool is the possible threat to student privacy and safety. With that priority in mind, The use of any online tool with staff and students comes some possible risk and must be weighed against the educational benefits.
In light of this, district staff have carefully reviewed the Privacy Policy and the Terms of Service for Google Apps for Education, and are comfortable the potential risks that may occur.
In order to mitigate the risks of adopting Google Apps for Education, we have considered the following:
Risk - 1. Breach of personal information – Google
Risk - 1. Breach of personal information – Google
Description of Risk
Description of Risk
A user’s personal information is made public because of a breach of Google’s servers.
Risk Mitigation Plan
Risk Mitigation Plan
Google’s data centres are geographically distributed across the US and in other countries, in secret locations. Google’s computing clusters are designed with resiliency and redundancy in mind, eliminating any single point of failure and minimizing the impact of common equipment failures and environmental risks. Access to data centres is limited to only authorized Google employees. In the Google Apps for Education Terms of Agreement Google states that they consider our data as important as their own in terms of security.
Risk - 2. Student or staff account compromised
Risk - 2. Student or staff account compromised
Description of Risk
Description of Risk
A user’s GAFE password becomes known another user, the other user can then impersonate them online.
Risk Mitigation Plan
Risk Mitigation Plan
Once notified of such a breach, system administrator(s) can suspend the Google account. The user (student) can then reset the password through the District “School Connect” portal, which will then sync the new password with the district GAFE platform. To determine whether a student has been impersonated online, further investigation by system administrators can find the IP address of a user’s log in, which may be useful in determining the validity of the complaint. The risk is not significantly different from the district’s current use of School Connect or First Class with grade 7-12 students.
Risk - 3. Personal information released by Google
Risk - 3. Personal information released by Google
Description of Risk
Description of Risk
Google shares or sells Delta staff or student information or data to a 3rd party.
Risk Mitigation Plan
Risk Mitigation Plan
In the Google Apps for Education Terms of Agreement Google states that it will not release any personal information unless it is required to do so by law. They have stated that where possible, they will notify the school district of any requests/demands for personal information.
Additionally, the Delta GAFE Use Guidelines provide information for students and staff that sensitive information (contact information, health or psychiatric assessments, etc) should not be created within or uploaded into the Delta GAFE platform.
Risk - 4. Inadvertent sharing of personal or 3rd party information
Risk - 4. Inadvertent sharing of personal or 3rd party information
Description of Risk
Description of Risk
Docs or email with personal information is shared more broadly than intended.
Risk Mitigation Plan
Risk Mitigation Plan
We know that once something is posted to the internet, it is essentially out of our control. We also know that access to any online tool presents the risk of sharing personal or 3rd party information, particularly as students could use any online tool for personal, rather than educational purposes.
This risk is not significantly different with the Delta GAFE as with the current Delta student email system, First Class where students could potentially share personal or 3rd party information. While FirstClass email accounts are hosted within the district, sharing to any external email account would fall under FIPPA, as the majority of email providers (gmail, hotmail, yahoo, etc) are hosted on US servers.
The Delta School district recognizes the inherent risk of shared personal or 3rd party information and is mitigating this risk in a number of ways:
Through training. All staff and students will go through a introductory presentation on the GAFE platform, including what is acceptable and unacceptable data to share.
Through access to information. A district website has been created for staff to use which outlines the privacy issues in using the Delta GAFE platform.
Through privacy settings. The default setting for all Google Docs has been set to private. Therefore a staff or student must decide to make any Doc pubAlso, additional features have been added to disable students in grades 4-7 from sharing any Google Docs beyond the Delta platform.
Through limiting tool access. We have disabled many of the tools that are part of the Google Apps suite, including Google Sites, limiting the number of possible channels for information to be inadvertently shared. Limiting the number of tools also allows the distrit to filter and more closely monitor the types of information being shared within the Delta GAFE platform.
Through named accounts. As students use any online tool there is the potential for sharing personal or 3rd party confidential information. When students use the Delta GAFE platform, all their activity is tied to their account, meaning that the potential for any anonymous sharing is removed. Delta system administrators will be able to identify and possibly suspend any violations.
Risk - 5. Unauthorized access to student account
Risk - 5. Unauthorized access to student account
Description of Risk
Description of Risk
Administrator or teacher logs in as student to view their content
Risk Mitigation Plan
Risk Mitigation Plan
As part of the introductory training which they will complete, staff will be notified that they must have ‘reasonable’ grounds to believe that there has been a breach of school rules in order for them to log in to a student’s GAFE account without their consent.
Teachers are responsible for the care and education of our students. Reasonable rules of conduct must be allowed to be maintained by staff members, whether the conduct takes place on a playground or online.
Risk - 6. Advertising
Risk - 6. Advertising
Description of Risk
Description of Risk
Using online tools such as Google Apps presents students with advertising, or sells student information to advertisers.
Risk Mitigation Plan
Risk Mitigation Plan
As per the Google Apps for Education Terms of Service, Google does not serve ads nor use customer data for the purpose of advertising.
Risk - 7. Change in Google Terms of Service
Risk - 7. Change in Google Terms of Service
Description of Risk
Description of Risk
Online tools such as Google change their privacy agreements or terms of service.
Risk Mitigation Plan
Risk Mitigation Plan
As part of their GAFE terms of service Google maintains the right to modify the terms of their service. However, Google states in the terms of service that Delta system administrators will be informed of any changes.
Also, Google states in the Privacy Policy that they will not make any changes which reduce customer rights without explicit consent
Additionally, the Delta School District has appointed an employee who will review Google’s Privacy Policy and GAFE Terms of Service twice annually (Jan and July). Should any significant modifications be implemented by Google, the District IT committee will review the modifications and, if need, terminate the agreement with Google.
Page updated
Report abuse