For the purposes of these guidelines, cloud services refer to the cloud services used by Metropolia, which are Google Workspace for Education (e.g. Google Drive and Google Meet). & Microsoft Office 365 Education (e.g. Microsoft OneDrive, SharePoint, Teams and Stream). Each cloud service includes several applications in the product family to which the same guidelines for storing and processing data apply.
1. What data or information can be stored in the cloud?
Familiarize yourself with Metropolia's terms of use for cloud services, which specify in more detail what you can and cannot store in the cloud.
In addition to the terms of the cloud services, confidential information such as,
- Exam answers and other tests, including all kinds of assignments and examinations, as well as grading marks. However, grades and scores are public, meaning they can be stored in the cloud.
- Sensitive personal information, which includes;
- Information on the verbal assessment of a student's personal characteristics
- Information on the person's state of health, disability, health care or social care clientele or rehabilitation (e.g. applications and decisions on special arrangements for studies)
- Information concerning the person's annual income or total assets, or the income and assets on which the aid or benefit is based, or which otherwise describe his financial situation
Act on the Openness of Government Activities 24 § states what information and/or documents are classified information. In particular, teaching staff must take into account article 24 points 21, 22, 30, which are related to the documents to be processed in teaching. Among other things, the processing of information related to the thesis, research, development must be kept confidential so that it does not cause harm to the research or to the client. The same applies to information that would jeopardize the implementation of the test or exam. As well as documents related to the student such as a teaching waiver, test, certificate, or other documents that include a verbal assessment of personal characteristics.
Other administratively relevant 24 article points are 6, 7, 8, 11, 16, 17, 20, 23, 25. The owner / processor of the information is responsible for the classification of the information.
The data classification and secure storing table below is intended to clarify Metropolia's policy on the use of cloud services and in particular what may be published and stored in those applications / systems.
