Ownership of the Google Workspace account/privacy/management questions

[NielsBrockmeier]

Hi everybody,

I'm in a bit of an altercation with management about some topics and I'd love your input on how to handle this.

The background: We have 1:1 Chromebooks where the parents lease the Chromebook through a third party. We pay the third party for the physical device from the school budget and the students (their parents) will only pay for insurance and repairs. We manage them, they are all added in our Workspace domain, and pretty much only add convenience, like wifi settings this way they can also use that device for exams through kiosk app(s), and don't limit the use in any way. The reason for this is that legally the parents are the owners and not us, not IT's preference but it is what it is.

 The current problem:
We have a platform that allows teachers, not just any staff, to look at what the students are doing on their Chromebooks at school. There are limitations to it: the student needs to be at school (IP restricted), the roster system needs to have the teacher teach the student during the year, it needs to be between school times (so not during after-school activities), the students needs to be signed in with their school account, and anytime a teacher looks at a screen it is logged in the system that they clicked on the screen. Also whenever a teacher does open the screen the extension icon turns red so the student knows someone is watching the screen, it doesn't give a popup though. 
Teachers have noticed that when there was a week-long hiccup in the system that students would be more distracted and classwork suffered during the time. As they knew they could play games as the teacher couldn't easily check what they were doing.

Management now has decided that the extension needs to be removed because of privacy concerns, notifying IT (me and my colleagues) that as of the next school year this needs to be implemented. Our summer break starts tomorrow and we won't be in until the week before the students start. They haven't informed the teaching staff about this yet so I already know who will get the brunt of the anger that the teachers can't look at the screens anymore. 

The question:
As they are now telling faculty staff that IT is looking for a privacy-friendly alternative for this software, which is interesting as this is the first time we as IT have also heard about this, I'm looking at what would be an appropriate response to this development. Does anyone have any insights or experiences with similar problems? 
I was also wondering about some implications that are being taken from this, online I read a lot about employees asking about who can see what in their accounts etc. Where usually the response is that the employer owns the account and not the employee. I am sure this is the same when it comes to student accounts. But I am wondering who is responsible for whatever happens with the accounts, say someone would spam from it or post/do illegal content from their school account. Who would be responsible for this, the student or the school?

Thank you for any response, hopefully there is someone who can help me get my head around this whole debacle.

[GBrauner]

Niels, some questions for clarity - What were the privacy concerns? Doesn't your contract with this platform have a clause in it that protects students data?  Doesn't your filter produce the same data that the classroom management software provides? 

[NielsBrockmeier]

Good questions.
The privacy concerns were described as "because of a possible privacy breach for the student" with nothing more clarified. We are assuming they mean that if a student looks something up for themselves while a teacher might be looking at the screen, but we aren't 100% sure about this.

The platform is completely GDPR compliant, created by a Dutch company specifically for the Dutch schools/education system.  We don't filter anything, the original policy is that we don't limit the students so they can be taught instead of shielding them from the outside world. However, in recent years management has changed the reason to "The devices are the student's property so we can't limit them"... 

[kmcmahon99]

This sounds like it could be settings.  I know Securly has options for when we can view student screens.  It is based on time (school hours) and IP address, so when they are at home, we cannot view screens.  However, we can always look up history from any day or time.  Would these sorts of controls solve some of the issues?

[NielsBrockmeier]

These are already active in the system we use, time limits, IP limitations and even limited to only school accounts, (Our Chromebooks can be used with private accounts as well) from what we heard from management we assume this still isn't enough as teachers can see what a student is doing, for example writing a private document, without giving the student a heads-up and given a chance to close the screen before the teacher can see what they're doing. But again that is just an assumption, as IT (not even the IT manager) we didn't get more information. Just that we have to remove the management app for the platform the first day we get back from summer break.

[GBrauner]

Our district does not allow for the use of private accounts to be used on school issued devices. We block this through Google Admin Console. My assumption is that is where the privacy concern is coming from. If the content is school related, the filtering or visibility shouldn't be an issue. That said, without any indication from your management team, it's all a guessing game.