4 ms·

"data is stored in the cloud, which is illegal" Which data is illegal to store in the cloud? Could you please provide a source?

xel02 16y ago
In Canada it is illegal to store student information on servers outside of Canada. At least that is what I was told when I was asked to create a CMS.
- robg 16y ago
  That just seems like a business opportunity - dealing with regulatory hurdles.
- thesethings 16y ago
  There is at least one Canadian school amongst the 8 millions students using Google Apps as their official suite. http://www.google.com/a/help/intl/en/edu/case_studies/lakehead.html http://www.google.com/a/help/intl/en/edu/case_studies/lakehe... I'm betting that Google or a 3rd party will eventually piggy back a for-pay educational tool on the existing Google Apps school customer-base through their Marketplace.
axiom 16y ago
Grades, and almost any student info in general. Come on, if you've spent any amount of time in the education industry you know this.
- snprbob86 16y ago
  There are hurdles, for sure, but none of it is outright illegal to store. You need permissions and protections, but I don't think any of the legal problems are unsolvable.
deleted 16y ago
[deleted]
patio11 16y ago
In Japan, where the laws are different from the United States but not in a very material fashion, the personal information privacy law means you have to treat anything with "personally identifiable information" as toxic and anything regarding a few types of enumerated data as nuclear waste. Your students' names or email addresses are toxic. (Do you offer them blogs? Do they have commenting features? Tied to email? Toxic!) Their grades, counseling reports, religious affiliation (do I have to explain what kind of universities need this info?), etc, are nuclear waste. Just because something is in the cloud doesn't make it illegal, but (to pick one example of many) it is going to make that biannual in-person inspection of your facilities they're going to demand a wee bit tricky now won't it. You can argue until you're blue in the face that Google knows what they're doing regarding physical security and that the university stores equivalent data in servers that are in unlocked rooms in a building housing 1,000 transients, but you will not prevail in that argument.
- bricestacey 16y ago
  I don't know if CloudCourse allows it, but so long as the data is encrypted in transit and at rest, physical security can be overlooked.
  - patio11 16y ago
    No, that is categorically not true. Physical access to the machine means the attacker has root if they want it. Physical access to the machine means you can physically steal it, which is sort of problematic for most of my ex-clients. Physical access to the machine also means you can steal the hard drive and, since you won't leave a note saying "I didn't actually get access to this", the user has to treat the data as compromised anyway, and that means (among other things) that the university and their IT contractors (i.e. my employers) are front page news the following day.

xel02 16y ago

In Canada it is illegal to store student information on servers outside of Canada. At least that is what I was told when I was asked to create a CMS.

robg 16y ago
That just seems like a business opportunity - dealing with regulatory hurdles.
thesethings 16y ago
There is at least one Canadian school amongst the 8 millions students using Google Apps as their official suite. http://www.google.com/a/help/intl/en/edu/case_studies/lakehead.html http://www.google.com/a/help/intl/en/edu/case_studies/lakehe... I'm betting that Google or a 3rd party will eventually piggy back a for-pay educational tool on the existing Google Apps school customer-base through their Marketplace.

axiom 16y ago

Grades, and almost any student info in general. Come on, if you've spent any amount of time in the education industry you know this.

snprbob86 16y ago
There are hurdles, for sure, but none of it is outright illegal to store. You need permissions and protections, but I don't think any of the legal problems are unsolvable.

deleted 16y ago

[deleted]

patio11 16y ago

In Japan, where the laws are different from the United States but not in a very material fashion, the personal information privacy law means you have to treat anything with "personally identifiable information" as toxic and anything regarding a few types of enumerated data as nuclear waste. Your students' names or email addresses are toxic. (Do you offer them blogs? Do they have commenting features? Tied to email? Toxic!) Their grades, counseling reports, religious affiliation (do I have to explain what kind of universities need this info?), etc, are nuclear waste. Just because something is in the cloud doesn't make it illegal, but (to pick one example of many) it is going to make that biannual in-person inspection of your facilities they're going to demand a wee bit tricky now won't it. You can argue until you're blue in the face that Google knows what they're doing regarding physical security and that the university stores equivalent data in servers that are in unlocked rooms in a building housing 1,000 transients, but you will not prevail in that argument.

bricestacey 16y ago
I don't know if CloudCourse allows it, but so long as the data is encrypted in transit and at rest, physical security can be overlooked.
- patio11 16y ago
  No, that is categorically not true. Physical access to the machine means the attacker has root if they want it. Physical access to the machine means you can physically steal it, which is sort of problematic for most of my ex-clients. Physical access to the machine also means you can steal the hard drive and, since you won't leave a note saying "I didn't actually get access to this", the user has to treat the data as compromised anyway, and that means (among other things) that the university and their IT contractors (i.e. my employers) are front page news the following day.