Mobility Technology
Subscribe to this community
GDPR: Data Protection Impact Assessments
The Article 29 Working Party of European data protection supervisors has published the final version of its Guidelines on Data Protection Impact Assessments (DPIAs). These build on the long-standing concept of Privacy Impact Assessments, being similar to normal risk assessments but looking at risks to the individuals whose data are being processed, rather than to the organisati...
GDPR: Student Unions
I've been asked how universities can share students' details with their students union. Since there doesn't seem to be any law giving universities "special powers" to do that, the choice seems to be between the six normal legal bases under the General Data Protection Regulation (GDPR). Two of these – legitimate interests and consent – are obvio...
GDPR: Twelve Steps, Sorted
Although the Information Commissioner's "Twelve Steps to Prepare" is an exce...
GDPR: Backups, Archives and the Right to...
I was recently asked how the GDPR's Right to Erasure would affect backups and archives. However that right, created by Article 17 of the GDPR, only arises when a data controller no longer has a legal basis for processing personal data. Provided an organisation is implementing an appropriate backup and archiving strategy, that shouldn't happen.The key point is that backu...
GDPR: moving to Information Lifecycle Re...
[UPDATE: the Irish GDPR coalition have a nice infographic on information lifecycles under ...
Janet Yorkshire Humberside service repor...
August service report for organisations in Yorkshire Humberside connected to the Janet net...
GDPR/Data Protection Bill: public author...
The new Data Protection Bill seems to bring clarity to the question of which legal bases will be available to educational institutions under the General Data Protection Regulation:Clause 6(1) of the Bill states that (subject to modification by the Secretary of State) organisations that are classed as public authorities under the Freedom of Information or Freedom of Information ...
Janet Kent service report August 2017
August service report for organisations in Kent connected to the Janet network via KPSN...
Janet North West Regional Delivery Servi...
Please find attached the North West region service report for the month of August 2017....
Janet London Regional Delivery Service R...
Please find attached the London region service report for the month of August 2017....
Improving reliability of Microsoft NPS a...
I've spent a fair bit of time over the past month trying to improve the reliability of our RADIUS service for eduroam. Previously it was entirely based on Microsoft NPS which has the tendency to silently discard authentication packets which it should really be rejecting. This creates a problem because if the authentication request originated from outside of your ...
European Law on Public Authorities
It's pretty clear from the context and implications that when European legislators wro...
GDPR: Public Authorities and Legitimate ...
I was interested to spot that the Article 29 Working Party visited the question of "public authorities" back in 2014, on page 23 of their Opinion on Legitimate Interests. There they note that there are two possible interpreta...
Jisc Security Conference 2017
I'll be doing a presentation on how Information Lifecycles can help you with the General Data Protection Regulation, security and effective use of information...
What's the data protection difference be...
[UPDATE] a slightly revised version of this post formed our response to the ICO consultati...
FreeRADIUS Best Current Practice Configu...
Author - Dr Alan Buxey 27/2/2012This document is not a FreeRADIUS tutorial. Instead it exp...
GDPR: Recording Phone Calls
Most of us are familiar with the recorded messages at the start of phone calls that warn "this call may be recorded for compliance and training purposes". Some may recognise it as meeting the requirement to notify callers under the snappily titled Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000. But the data protection i...
Article 29 WP on Workplace Monitoring
The Article 29 Working Party has produced new guidance on data processing in the workplace, to account for the very significant changes that have occurred since their previous guidance in 2001. Although the focus is on "employee monitoring", it is likely to be relevant to other situations where an organisation has significant power over those who use its premises and ...
Format of FreeRADIUS log to enable inter...
ContentsScopePrelimiary work with FreeRADIUSFTICKSContributors: Adam Bishop, Alan Buxey, Rhys SmithScope As decided at the DOT1XSIG meeting of 24th October 2012, the deliverable is: an agreement on WHAT g...
GDPR: A new kind of consent
While some have viewed the General Data Protection Regulation's approach to consent as merely adjusting the existing regime, the Information Commissioner's draft guidance suggests a more fundamental change: "a more dynamic...
Guidance Document Cost of Implementing e...
Aiming to serve as a business decision making tool, this document provides guidance on the costs involved in implementing eduroam. The costs are broken down into clearly defined work areas and categorised by type of service - Visited-only, Home, Home and Visited....
GDPR: Alumni processes
Most universities maintain databases of alumni, for purposes including keeping them informed about the organisation, offering services and seeking donations. These activities have a lot in common with other charities, so the Information Commissioner's guidance is relevant. Indeed the Information Commissioner's recent description of using consent-based relationships &quo...
GDPR: Wifi access
Many, perhaps most, wifi access services want to perform some sort of authentication of people who use them (for those providing connectivity via Janet, it's a requirement of the Eligibility Policy). Since authentication involves some processing of personal data, it's worth reviewing how different ways of doing that might be affected (or not) by the General Data Protect...
Latest activity
The Article 29 Working Party of European data protection supervisors has published the final version of its...
[Updated to include an example where multiple justifications are appropriate]
One of the key steps in preparing for the...
I've been asked how universities can share students' details with their students union. Since there doesn't seem to be any...
August service report for organisations in Yorkshire Humberside connected to the Janet network
August service report for organisations in Wales connected to the Janet network via the PSBA
August service report for organisations in Kent connected to the Janet network via KPSN
August service report for organisations in Kent connected to the Janet network via KPSN
Please find attached the Cumbria area service report for the month of August 2017.
Please find attached the North West region service report for the month of August 2017.
Please find attached the London region service report for the month of August 2017.
