Cloud Storage; Good or Bad?

Cloud storage first reared its head in my school at least two years ago when a forward thinking (shall we say?) teacher asked me to install the DropBox software on his teacher machine.  As with most of these requests, my first question was Is it safe?

Working in a school in England means we must, follow a number of laws and acts of parliament based around data security and safeguarding.  We must follow  The Data Protection Act 1998 and register our organisation with the Information Commissioners Office who are the regulatory body and are a great place to find advice.

The DPA  states what type of information may be stored or processed, how it must be stored, and how we go about obtaining it.  There are two types of data Personal Data & Sensitive Personal Data.

Personal Data is someones name, date of birth, sex, address, telephone number, email address etc.  Sensitive Personal Data is a persons religious beliefs, ethnic origin, political opinion, trade union status, health, sexual life and criminal offences or alleged offences.

The DPA crucially also tells us where we can transfer the data to.

Personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Itlay, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.

Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Isreal, Jersey and Switzerland.

Although the United States of America (US) is not included in the European Commission list, the Commission considers that personal data sent to the US under the “Safe Harbor” scheme is adequately protected.

So, with all that in mind, can that teacher use drop box?

On first inspection, we find that DropBox is based in San Francisco, however searching the Safe Harbor list, their name doesn’t show up.  However, it turns out they use Amazon strorage, and they are on the list.  But does that make it ok? Grumbledook of edugeek explains this specific issue much better than I could.

So which platforms are ok?  Personally I use SugarSync.  They give you 5GB’s rather than the 2 from DropBox.  They offer the same service (cloud storage of  files and photos, sharing and mobile apps access) but most importantly, they comply with the safe harbor guidlines.

We have recently been asked by staff to also use the web clipping tool Diigo. It’s a online web clipping and bookmark tool.  Again it’s not based in the EEA, but it’s not on the safe harbor list either.  Evernote however is. It offers the same services although in a slightly different way.  It’s primarily an online note service.  I happily sync my desktop to my laptop to my netbook, to my iPhone…

Unfortunately, the buzz word companies in the market often grow so quickly, and are so keen to improve their offerings they make mistakes. Sadly DropBox had the mother of all data breeches when they let anyone into any account for a period of four hours.

SkyDrive & Google Docs may not quite have the same functionality or level of synchronisation across  devices, but they are big names, offering a secure service, ticking the relevant data protection boxes.

Should we ban the use of DropBox and Diigo (in this example) from School?  My answer is, probably not.

Although some of these services are classed as safe, the safest method is not to upload it in the first place. User training is key, as always.

I do use evernote for note taking in work, but I never use peoples names;  I use initials. I use Google Docs, but only for my personal files.  I’ve made that choice, it’s my lookout if it all goes wrong.  All school personal data stays in my own cloud, where I can touch the disks in a locked room.  It’s a kind of mini cloud, called a Storage Area Network.

What do you think?  Am I way off the mark?  Should I lighten up? Block access? Please comment.