In the last week or so a conversation has been underway in a listerv of which I am a member, related to the gnarly question of where the data about students is stored. Should it be locally in schools or cloud computing?
There has been a full on discussion of the ethics of a school using cloud computing services that may well have blanket policies (often underpinned by US law, rather than a specific country's law), as well as around what happens to the data once it is in the cloud. The members of the listserv unpacked the pros and cons of cloud computing, the fuzziness of the policies often used in relation to data stored in the cloud, and their own responsibility.
I've included below my contribution to the conversation, as the subject is of concern to a wide range of people...in fact, pretty much anyone who has data stored in the cloud. One of the key strategies I'd like to suggest is raising awareness so that folk know the questions they need to ask to find out about what is happening to their (or their child's) data, and do not abdicate responsibility to 'someone else'...or at least are given the choice to abdicate this responsibility (see this Educause initiative for example). Informed consent seems to me to be the way to go, but sometimes you may need to ask for the information to inform your decisions, and may also need to ask for assistance in figuring out what that information actually means in practice.
Would be great to hear your thoughts :-)