Hi !
We previously announced that the DPIA would be published in October. Now, as we’ve reached November 1st, the DPIA has not yet been released. We will need to hold onto it a little longer. We are not sure when we will be able to publish, but rest assured, we will announce the publication here in this newsletter first. So, keep an eye on this space.
However, what we can discuss is what you, who are awaiting the DPIA, already need to have in place to be able to take our 80%-draft and make it your own.
Who should own the DPIA?
A DPIA should be owned by a leader responsible for school, risk, privacy, and information security. Specifically, it is a leader who should "approve" the results in the DPIA.
A DPIA, as known, contains an assessment of the risk of breaches of privacy rights for students, teachers, and other users of the system, with risk-reducing measures.
And someone—a leader—must "own" this risk and the risk-reducing measures that have been decided to be implemented.
Do you know who will own the risk in the DPIA? Is it the head of child and education services in the municipality? Is it an IT manager? Is it someone in political leadership?
Whoever it is in your municipality, someone has this responsibility. You need to figure out who.
Tip: If you don’t know, ask! Maybe the Data Protection Officer knows?
Internal procedures and templates
Does your municipality have internal procedures you should follow when creating a DPIA? Some municipalities already have internal procedures for how to proceed when creating a DPIA.
Find that procedure, read it, and make up your mind about what you need to do to get this DPIA in place.
Does the municipality have a template you must use? Find it and read through it, because it can tell you a bit about who you need to involve and when.
Is there anyone who MUST be involved? When you do a DPIA, there is a formal requirement that the Data Protection Officer must read through and comment on the DPIA. Maybe your municipality has its own rules about when and how the Data Protection Officer should be involved?
Tip: Contact the Data Protection Officer now, tell them you have a DPIA coming up and ask how they would like to be involved. Perhaps they can tip you off if there is a template available.
Communication of information
Check out what information about Google Workspace for Education the municipality has communicated.
The DPIA has not been published, but what we can tell you is that part of the remaining 20% that you as a school owner need to finalize, deals with the information you have provided to students (and parents as the guardians of the students), teachers, and others who use Google Workspace for Education.
Part of any DPIA deals with how you respond to privacy principles and rights. We've seen that the information you provide is crucial.
It fulfills the right to information for students, teachers, and other staff using Google Workspace for Education and addresses the principle of transparency. And this is something you can start with right now.
How? Let's share some examples in random order that we think are good and that you can use as a basis:
- Lillesand Municipality
-
Bergen Municipality
- Stavanger Municipality
I wish you a wonderful, privacy-friendly week-end!
Best regards,
Ida Thorsrud
Project manager national DPIA
This newsletter was translated from Norwegian to English with assistance from ChatGPT by OpenAI. While it guided our translation, we made independent editorial choices. Any discrepancies result from this combined approach.
