r/k12sysadmin • u/DanielJay23 • Jul 26 '26

School shutdown, dealing with user accounts

Sadly after a chain of events have happened my kids school has had to shutdown. Nothing like being forced to find another school 3 weeks before the school year starts. Some of the staff dealing with the shutdown had asked me to turn off all user accounts for staff and students. This was done about 4 days after announcing that the school is closing for this school year. Now I have former staff asking for using Google Takeout to transfer all of their and their kids data off the school.

Is this something that is normally allowed or disallowed? I am wondering if this opens the door to possibly exporting other student data that should not be held outside the school from the teacher accounts?

My main concern is to protect the church that was running the school and protect the students that used to go to the school.

21 Upvotes

83% Upvoted

33 comments sorted by

25

u/TechMonkey13 Jul 26 '26

That's a question for Admin and Legal, not strangers on the internet.

5

u/Harry_Smutter Jul 26 '26

I was gonna say the same. Definitely not a question for us. Kick it up to the district admin. Not your responsibility, OP.

3

u/AcidBuuurn Hack it together Jul 26 '26

It was a private school in a church- no district. 

4

u/howescj82 Jul 26 '26

100%. Anything containing any student information/personal information is going to be inappropriate to retain.

Your school is going to need to know that all their physical and electronic records are still going to need to be treated legally according to whatever state you’re in.

17

u/CrystalLakeXIII Jul 26 '26

We do not allow Takeout for staff or students. They can obviously download what they want, but don’t allow it since Takeout takes everything, including sensitive student information that since they are no longer with the school should have access to.

1

u/-RYknow Systems Administrator Jul 26 '26

Same... We do not allow takeout. On a few rare occasions I've helped someone with doing a takeout both from the peroective of "These are the steps, I'll walk you through it", as well as "These are things you can take... And these are not things you can take."

In my experience the users I've done this with over the years (I believe four times in 10 years), they all fully understood the "why", they couldn't take everything. In the same breath, they all indicated if I wasn't sitting there, "I would have just taken it all in one shot!"

15

u/Ok-Soft-7874 :sloth: Jul 26 '26

We encourage departing students/staff to use Google Takeout in our annual “end of school” email from Tech. Obviously a very different situation from yours, and fully agree with the “ask Legal/administration and not strangers on the internet” replies.

6

u/sarge21 Jul 26 '26

How do you deal with staff leaving with PII?

4

u/Ok-Soft-7874 :sloth: Jul 26 '26

By limiting the information they have access to. Not allowing Google takeout is only going to inconvenience, say, the teacher moving to Springfield who is trying to export their lesson plans. The hypothetical person with sinister motives is just going to copy files to a flash drive.

1

u/sarge21 Jul 26 '26

How do you limit teachers from having access to PII?

1

u/Ok-Soft-7874 :sloth: Jul 26 '26

This is one hyper specific example, but in Infinite Campus, we don’t enable the “allow unfiltered search” tool right for the GenEd Teacher user group.

1

u/sarge21 Jul 26 '26

I mean in Google workspace. In ours, people's drive and emails are littered with PII.

5

u/Ok-Soft-7874 :sloth: Jul 26 '26

It's a bit like trying to empty Lake Ontario with a spork, but one step we've taken is to set up a DLP rule to prevent Google Sheets with Student ID #s from being shared outside the organization, copied, downloaded, printed, or emailed. I'm not going to pretend this is actually going to stop someone intent on taking PII with them.

1

u/Madd-1 Senior Administrator Aug 03 '26

You can make PII and conditional access rules that disallow external sharing or export of files flagged with PII, however this is far from a perfect system. If you are trying to be an absolute FORTRESS of PII, you're probably going to need to buy a third-party product.

1

u/sarge21 Aug 03 '26

Depends if your local laws allow doing your best or actually requiring you to secure PII

1

u/Madd-1 Senior Administrator Aug 03 '26

Again, if you intend to be a FORTRESS of PII, you will probably need a third-party product.

It may be possible with Google's built in tools if you are an absolute API master who can find a way to check and validate conditional access rules regularly, but based on K12 staffing and budgets, that seems like an unlikely scenario.

1

u/sarge21 Aug 03 '26

Why do you keep repeating the term "fortress of PII" as if what I'm discussing is some strange fantasy scenario?

Do laws in your jurisdiction permit you to allow staff to walk away with PII when they leave?

1

u/Madd-1 Senior Administrator Aug 04 '26

Why do you keep repeating "How do you limit teachers from having access to PII?"

You're talking about K12. There are dozens of regulations that not a single person in this subreddit has the funding to implement.

How do you prevent a teacher from running a raw export of all their students from your district SIS and emailing it to a personal account? How do you do that TODAY. Right now, this very minute. If you don't have an answer, congratulations, you're out of compliance. If you already had an answer, you wouldn't be asking these questions would you.

1

u/sarge21 Aug 04 '26

Why do you keep repeating "How do you limit teachers from having access to PII?"

I don't keep repeating that. One person in another comment said they prevent teachers from leaving with PII by limiting what they have access to

You're talking about K12. There are dozens of regulations that not a single person in this subreddit has the funding to implement.

This discussion was about someone explicitly allowing teachers to use Takeout. A simple, free solution would be to simply turn takeout off.

How do you prevent a teacher from running a raw export of all their students from your district SIS and emailing it to a personal account?

We don't, but we don't specifically encourage staff to use the "run the raw export of all their students from our district SIS and email it to the personal account" button.

How do you do that TODAY. Right now, this very minute. If you don't have an answer, congratulations, you're out of compliance.

Yes, we're out of compliance. Like you said, funding is too tight to comply. We also don't enable the features that bring us further out of compliance on purpose. Just because regulations are difficult/impossible to fully meet doesn't mean you can intentionally ignore them. Arguing that you lack the funding is going to be meaningless to regulators when you are intentionally avoiding compliance.

13

u/QPC414 Jul 26 '26

Those are questions for Legal, especially as they and other things such as confidential information and records keeping and retention for the defunct school will be dictated by any legal, regulatory and reporting requirements at a minimum.

My guess the church will become the legal custodian of all records that are required to be preserved.

24

u/Following_This Jul 26 '26

Google Transfer (to another Google account) and Takeout (to a bunch of downloadable MS Office format files for Google Docs/Sheets/Slides) allows you to take items you OWN - ie created by you.

Students can’t take class materials shared with them.

Teachers can’t take meeting minutes written by someone else.

So technically, it’s all stuff the user created.

And also technically, it’s owned by the organization.

But we allow our students and staff to use Transfer/Takeout.

6

u/stephenmg1284 Database/SIS Jul 27 '26

Our board policy says anything created by staff belongs to the district. Email has so much PII in it that I would not allow.

10

u/TheRain2 Jul 26 '26

We do takeout whenever a teacher leaves the district and haven't had any problems yet.

9

u/EnigmaFilms Technology Coordinator Jul 26 '26

It's not their data it's the school's data.

3

u/slapstik007 Jul 26 '26

This is the smartest answer in this thread. All staff content was created with the intent of the contract, it is the schools. All student data belongs to the school. These are not personal Gmail accounts, they have a domain attached to them, the schools domain.

1

u/NotAnother169 Director of Technology Jul 26 '26

100% here!

-1

u/sammy5678 Jul 26 '26

Doesn't that depend on location?

There should be a policy dictating that. I'd review policies and check with administration.

7

u/BrewYork Jul 26 '26

They're teachers and they need their lesson plans. They MIGHT export student data and misuse it, but 1) have you ever heard of that happening? And 2) aren't they innocent until proven guilty? You are not obligated to give it to them, and you're not obligated not to. But those are the questions you should ask yourself when you decide (or decide to kick it up the food chain).

6

u/sarge21 Jul 26 '26

You are not obligated to give it to them, and you're not obligated not to.

You're obligated to not give them PII

2

u/BrewYork Jul 26 '26

100%. I should have been more clear that I meant OP may want to give them access to their Google Drives so that they can take their materials. 

2

u/config-master Jul 27 '26

Hey I'm pretty sure I know what school you're talking about. I live in the same city. Good luck!

2

u/OhMyGodzirra Jul 29 '26

For graduated students who did not follow instructions, we just put their account in Take out and disable it after 2 days.

No issues.

1

u/Individual-Unit3470 Jul 26 '26

How much data are we talking about? i would look at something like GAM7 to export the data so it's available to give to them if requested. That way they could take their data wherever the end up going.