[ { "pod": { "id": "D3E34B39-9D79-4019-8C39-00AA001A1659", "podStatus": "Live", "podToken": "1", "podVersion": "1.0.2", "partyId": "Compass", "privacyList": { "privacy": [ { "default": "Y", "dataModelNamespace": "http://www.sifinfo.org/infrastructure/2.x", "dataModelVersionMin": "2.4", "dataModelVersionMax": "2.8", "privacyObligationsDocument": { "contract": { "contractURI": "http://www.vic.priv.contract.edu.au/contract.pdf", "contractName": "Sample contract ABC", "dateValidFrom": "2018-03-01", "dateValidTo": "2018-06-01", "contractVersion": "0.2", "lawList": { "law": [ { "lawName": "APP1", "lawDescription": "XXXXX" }, { "lawName": "APP2", "lawDescription": "yyyy" } ] }, "studentDataIPRights": "Victorian Department of Education" }, "legalRequirements": { "clauseList": { "clause": [ { "clauseLabel": "Data Access", "clauseReference": "US-I.3", "clauseContent": "The agent shall access only data necessary to accomplish the business task for which it is contracted.", "obligationList": { "obligation": [ { "obligationDescription": "Restrict access to data fields to match the state profile.", "obligationURL": "https://thewave.sde.ok.gov/thewave/Portals/0/2%20x%20Wave%20Requirements_v1%2010.pdf", "benchmarkList": { "benchmark": [ { "benchmarkName": "Oklahoma State Profile" } ] } } ] } } ] } }, "technicalRequirements": { "dataAccess": { "clauseList": { "clause": [ { "clauseReference": "US-I.3" } ] }, "fieldList": { "field": [ { "fieldName": "/SchoolInfo/@RefId", "controlrights": "R" }, { "fieldName": "/SchoolInfo/LocalId", "controlrights": "R" }, { "fieldName": "/SchoolInfo/ACARAId", "controlrights": "RW" }, { "fieldName": "/StudentPersonal/@RefId", "controlrights": "RW" }, { "fieldName": "/StudentPersonal/LocalId", "controlrights": "RW" }, { "fieldName": "/StudentPersonal/FirstAUSchoolEnrollment", "controlrights": "RW" } ] } }, "conditionList": { "condition": [ { "typeOfCondition": "XQUERYTEMPLATE", "conditionName": "RetrieveByGrade", "conditionDescription": "Returns a StudentJoin of StudentPersonal and StudentSchoolEnrollment for the GradeLevel specified as a parameter." }, { "typeOfCondition": "contextId", "conditionName": "CurrentEnrollment", "conditionDescription": "Only works with student data whose records indicate they are currently enrolled according to the StudentSchoolEnrollment SIF object.", "propertyList": { "property": [ { "propertyName": "Enrolled After", "propertyValue": "/StudentSchoolEnrollment/EntryDate>=2018-09-01" }, { "propertyName": "Enrolled Before", "propertyValue": "/StudentSchoolEnrollment/EntryDate<=2019-09-01" } ] } } ] }, "dataSubject": { "clauseList": { "clause": [ { "clauseReference": "US-Subject1", "obligationList": { "obligation": [ { "obligationDescription": "FERPA requires records be delivered within 45 days of a request.", "obligationURL": "https://www2.ed.gov/policy/gen/guid/fpco/brochures/parents.html", "benchmarkList": { "benchmark": [ { "benchmarkName": "Family Educational Rights and Privacy Act (FERPA)" } ] } } ] } } ] }, "fieldList": { "field": [ { "fieldName": "/StudentPersonal/@RefId" }, { "fieldName": "/StudentPersonal/LocalId" }, { "fieldName": "/StudentPersonal/FirstAUSchoolEnrollment" } ] }, "respondInDays": 45, "requirePortability": "Y" }, "dataDeletion": { "deleteData": "Y", "dataRetention": 30, "deleteBy": "2019-07-15", "partyToDeleteData": { "organisation": "Local LEA", "deletecontactInfo": { "name": { "familyName": "EEe", "givenName": "Agg", "otherGivenNames": "hh" }, "positionTitle": "Data Owner", "emailList": { "email": [ "DataSec@localLEA.edu.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(03) 8888-9999" } ] } } } }, "securityTechnologyList": { "securityTechnology": [ { "clauseList": { "clause": [ { "clauseReference": "US-V.1.c" } ] }, "technologyName": "TLS", "versionMin": "1.2" } ] } }, "dataController": { "dataControllerName": "Victorian Department of Education", "privacyPolicyURL": "http://www.vic.priv.policy.edu.au/privacy.pdf", "privacyContactList": { "contact": [ { "name": { "familyName": "Smith", "givenName": "Christime", "otherGivenNames": "Margaret" }, "positionTitle": "Admin", "emailList": { "email": [ "chris@whoville.vic.edu.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(03) 9600-0102" } ] } } ] }, "issuesNotificationContactList": { "contact": [ { "name": { "familyName": "BBBB", "givenName": "AAA", "otherGivenNames": "CCC" }, "positionTitle": "Data Security", "emailList": { "email": [ "DataSec@whoville.edu.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(03) 8888-9999" } ] } } ] } }, "dataProcessor": { "dataProcessorName": "CEOProcessor2", "privacyPolicyURL": "www.ceo.priv.policy.edu.au", "privacyContactList": { "contact": [ { "name": { "familyName": "Woodall", "givenName": "Charles", "otherGivenNames": "William" }, "positionTitle": "Admin", "emailList": { "email": [ "drseuss@whoville.k12.ceo.edu.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(08) 8555-0102" } ] } } ] }, "notifyDataControllerOnAccessRequests": "Y", "dataProcessorContactForAccessRequestsList": { "contact": [ { "name": { "familyName": "XXX", "givenName": "YYY", "otherGivenNames": "ZZZ" }, "positionTitle": "Privacy Officer", "emailList": { "email": [ "off@whoville.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(03) 9999-9999" } ] } } ] }, "purposeList": { "purpose": [ "Admin System", "Australian Schools List" ] }, "alternatePurposeList": { "alternatePurpose": [ "Student Portal" ] }, "deidentifiedPurposeList": { "deidentifiedPurpose": [ "Research" ] }, "dataUsageMarketingAllowed": "N", "personalInformationUpdatedFromSource": 10, "dataBreachNotification": "Y", "dataBreachContactList": { "contact": [ { "name": { "familyName": "XXX", "givenName": "YYY", "otherGivenNames": "ZZZ" }, "positionTitle": "Privacy Officer", "emailList": { "email": [ "off@whoville.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(03) 9999-9999" } ] } } ] }, "employeesMustComplyWithAgreement": "Y", "employeeConfidentialityAgreement": "Y", "employeeTrainingList": { "employeeTraining": [ { "trainingName": "", "trainingURL": "" } ] }, "passwordEmployeeAccessStandard": { "standardName": "", "standardURL": "" }, "securityTestRequiredList": { "securityTestRequired": [ { "testType": "Pen Test", "testFrequency": "Annual", "remediationRequiredIn": "7 days", "shareResults": "Y" }, { "testType": "Vulnerability Test", "testFrequency": "Monthly", "remediationRequiredIn": "24hours", "shareResults": "Y" } ] }, "countryImpactedList": { "countryImpacted": [ { "country": "1101", "usage": "Stored/Processed/Exposed" }, { "country": "1102", "usage": "Exposed" } ] } }, "dataSubProcessorList": { "dataSubProcessor": [ { "subProcessorName": "One", "privacyPolicyURL": "www.one.edu.au", "privacyContactList": { "contact": [ { "name": { "familyName": "First", "givenName": "Charles", "otherGivenNames": "William" }, "positionTitle": "Admin", "emailList": { "email": [ "drseuss@whoville.k12.ceo.edu.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(08) 8555-0102" } ] } } ] }, "purposeList": { "purpose": [ "Attendance" ] } }, { "subProcessorName": "Two", "privacyPolicyURL": "www.two.edu.au", "privacyContactList": { "contact": [ { "name": { "familyName": "Two", "givenName": "Charles", "otherGivenNames": "William" }, "positionTitle": "Admin", "emailList": { "email": [ "drseuss@whoville.k12.ceo.edu.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(08) 8555-0102" } ] } } ] }, "purposeList": { "purpose": [ "TimeTabling" ] } }, { "subProcessorName": "Three", "privacyPolicyURL": "www.three.edu.au", "privacyContactList": { "contact": [ { "name": { "familyName": "Third", "givenName": "Charles", "otherGivenNames": "William" }, "positionTitle": "Admin", "emailList": { "email": [ "drseuss@whoville.k12.ceo.edu.au" ] }, "phoneNumberList": { "phoneNumber": [ { "number": "(08) 8555-0102" } ] } } ] }, "purposeList": { "purpose": [ "StudentPortal" ] } } ] } } }, { "default": "N", "appIDList": { "appID": [ "TT12" ] }, "adapterFingerprintList": { "adapterFingerprint": [ "b4ef12ce-7025-11e8-adc0-fa7ae01bbebc" ] }, "zoneContextList": { "zoneContext": [ { "zoneId": "4001", "contextId": "" } ] }, "endpointList": "", "privacyObligationsDocument": { "technicalRequirements": { "dataAccess": { "fieldList": { "field": [ { "fieldName": "/SchoolInfo/@RefId", "controlrights": "R" }, { "fieldName": "/SchoolInfo/LocalId", "controlrights": "R" }, { "fieldName": "/SchoolInfo/ACARAId", "controlrights": "R" }, { "fieldName": "/StudentPersonal/@RefId", "controlrights": "R" }, { "fieldName": "/StudentPersonal/LocalId", "controlrights": "R" }, { "fieldName": "/StudentPersonal/FirstAUSchoolEnrollment", "controlrights": "R" }, { "fieldName": "/TimeTable/*", "controlrights": "RW" } ] } } } } }, { "default": "N", "adapterFingerprintList": { "adapterFingerprint": [ "b4ef12ce-7025-11e8-adc0-fa7ae01bbebc" ] }, "zoneContextList": { "zoneContext": [ { "zoneId": "4002", "contextId": "" } ] }, "dataModelNamespace": "http://www.sifinfo.org/infrastructure/2.x", "dataModelVersionMin": "2.3", "dataModelVersionMax": "2.9" }, { "default": "N", "adapterFingerprintList": { "adapterFingerprint": [ "b4ef12ce-7025-11e8-adc0-fa7ae01bbebc" ] }, "zoneContextList": { "zoneContext": [ { "zoneId": "4003", "contextId": "" } ] }, "dataModelNamespace": "http://www.sifinfo.org/infrastructure/2.x", "dataModelVersionMin": "2.1", "dataModelVersionMax": "2.8", "privacyObligationsDocument": { "technicalRequirements": { "securityTechnologyList": { "securityTechnology": [ { "technologyName": "SSL", "technologyDescription": "", "referenceURL": "" } ] } } } } ] } } } ]

<pod id="D3E34B39-9D79-4019-8C39-00AA001A1659"> <podStatus>Live</podStatus> <!-- podStatus - The status value for this POD. --> <podToken>1</podToken> <!-- podToken - The token reference for the POD. --> <podVersion>1.0.2</podVersion> <!-- podVersion - The POD version number. PODs are expected to change over time. --> <partyId>Compass</partyId> <!-- partyId - The name of the party (typically the data processor) which will receive the data from the school, district or state and has entered into an agreement to process the data and respect the privacy obligations of the data --> <privacyList> <privacy> <default>Y</default> <dataModelNamespace>http://www.sifinfo.org/infrastructure/2.x</dataModelNamespace> <dataModelVersionMin>2.4</dataModelVersionMin> <dataModelVersionMax>2.8</dataModelVersionMax> <!-- Privacy Obligations - holds information about the contract --> <privacyObligationsDocument> <contract> <contractURI>http://www.vic.priv.contract.edu.au/contract.pdf</contractURI> <contractName>Sample contract ABC</contractName> <dateValidFrom>2018-03-01</dateValidFrom> <dateValidTo>2018-06-01</dateValidTo> <contractVersion>0.2</contractVersion> <lawList> <law> <lawName>APP1</lawName> <lawDescription>XXXXX</lawDescription> </law> <law> <lawName>APP2</lawName> <lawDescription>yyyy</lawDescription> </law> </lawList> <studentDataIPRights>Victorian Department of Education</studentDataIPRights> </contract> <legalRequirements> <clauseList> <clause> <clauseLabel>Data Access</clauseLabel> <clauseReference>US-I.3</clauseReference> <clauseContent>The agent shall access only data necessary to accomplish the business task for which it is contracted.</clauseContent> <obligationList> <obligation> <obligationDescription>Restrict access to data fields to match the state profile.</obligationDescription> <obligationURL>https://thewave.sde.ok.gov/thewave/Portals/0/2%20x%20Wave%20Requirements_v1%2010.pdf</obligationURL> <benchmarkList> <benchmark> <benchmarkName>Oklahoma State Profile</benchmarkName> </benchmark> </benchmarkList> </obligation> </obligationList> </clause> </clauseList> </legalRequirements> <technicalRequirements> <dataAccess> <clauseList> <clause> <clauseReference>US-I.3</clauseReference> </clause> </clauseList> <fieldList> <field> <fieldName>/SchoolInfo/@RefId</fieldName> <controlrights>R</controlrights> </field> <field> <fieldName>/SchoolInfo/LocalId</fieldName> <controlrights>R</controlrights> </field> <field> <fieldName>/SchoolInfo/ACARAId</fieldName> <controlrights>RW</controlrights> </field> <field> <fieldName>/StudentPersonal/@RefId</fieldName> <controlrights>RW</controlrights> </field> <field> <fieldName>/StudentPersonal/LocalId</fieldName> <controlrights>RW</controlrights> </field> <field> <fieldName>/StudentPersonal/FirstAUSchoolEnrollment</fieldName> <controlrights>RW</controlrights> </field> </fieldList> </dataAccess> <conditionList> <condition> <typeOfCondition>XQUERYTEMPLATE</typeOfCondition> <conditionName>RetrieveByGrade</conditionName> <conditionDescription>Returns a StudentJoin of StudentPersonal and StudentSchoolEnrollment for the GradeLevel specified as a parameter.</conditionDescription> </condition> <condition> <typeOfCondition>contextId</typeOfCondition> <conditionName>CurrentEnrollment</conditionName> <conditionDescription>Only works with student data whose records indicate they are currently enrolled according to the StudentSchoolEnrollment SIF object.</conditionDescription> <propertyList> <property> <propertyName>Enrolled After</propertyName> <propertyValue>/StudentSchoolEnrollment/EntryDate&gt;=2018-09-01</propertyValue> </property> <property> <propertyName>Enrolled Before</propertyName> <propertyValue>/StudentSchoolEnrollment/EntryDate&lt;=2019-09-01</propertyValue> </property> </propertyList> </condition> </conditionList> <!-- Who the information is about. Typically a Student and/or a Parent and/or a Teacher. --> <dataSubject> <clauseList> <clause> <clauseReference>US-Subject1</clauseReference> <obligationList> <obligation> <obligationDescription>FERPA requires records be delivered within 45 days of a request.</obligationDescription> <obligationURL>https://www2.ed.gov/policy/gen/guid/fpco/brochures/parents.html</obligationURL> <benchmarkList> <benchmark> <benchmarkName>Family Educational Rights and Privacy Act (FERPA)</benchmarkName> </benchmark> </benchmarkList> </obligation> </obligationList> </clause> </clauseList> <fieldList> <!-- information that must be supplied to the Data Subject if request as per Clause above. --> <field> <fieldName>/StudentPersonal/@RefId</fieldName> </field> <field> <fieldName>/StudentPersonal/LocalId</fieldName> </field> <field> <fieldName>/StudentPersonal/FirstAUSchoolEnrollment</fieldName> </field> </fieldList> <respondInDays>45</respondInDays> <requirePortability>Y</requirePortability> </dataSubject> <!-- obligations relating to the deletion of data. --> <dataDeletion> <deleteData>Y</deleteData> <dataRetention>30</dataRetention> <deleteBy>2019-07-15</deleteBy> <partyToDeleteData> <organisation>Local LEA</organisation> <deletecontactInfo> <name> <familyName>EEe</familyName> <givenName>Agg</givenName> <otherGivenNames>hh</otherGivenNames> </name> <positionTitle>Data Owner</positionTitle> <emailList> <email>DataSec@localLEA.edu.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(03) 8888-9999</number> </phoneNumber> </phoneNumberList> </deletecontactInfo> </partyToDeleteData> </dataDeletion> <!-- Aligned to the SDPC work for consideration. --> <securityTechnologyList> <securityTechnology> <clauseList> <clause> <clauseReference>US-V.1.c</clauseReference> </clause> </clauseList> <!-- See Security Protocol clause above. --> <technologyName>TLS</technologyName> <versionMin>1.2</versionMin> </securityTechnology> </securityTechnologyList> </technicalRequirements> <dataController> <!-- Those who are in charge of storing and controlling the information on behalf of parents. --> <dataControllerName>Victorian Department of Education</dataControllerName> <privacyPolicyURL>http://www.vic.priv.policy.edu.au/privacy.pdf</privacyPolicyURL> <privacyContactList> <contact> <!-- Simplify these! More like: http://specification.sifassociation.org/Implementation/NA/3.5/Collections/xStaffs.xhtml --> <name> <familyName>Smith</familyName> <givenName>Christime</givenName> <otherGivenNames>Margaret</otherGivenNames> </name> <positionTitle>Admin</positionTitle> <emailList> <email>chris@whoville.vic.edu.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(03) 9600-0102</number> </phoneNumber> </phoneNumberList> </contact> </privacyContactList> <issuesNotificationContactList> <contact> <name> <familyName>BBBB</familyName> <givenName>AAA</givenName> <otherGivenNames>CCC</otherGivenNames> </name> <positionTitle>Data Security</positionTitle> <emailList> <email>DataSec@whoville.edu.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(03) 8888-9999</number> </phoneNumber> </phoneNumberList> </contact> </issuesNotificationContactList> </dataController> <dataProcessor> <!-- Data processor is the vendor who will be accessing, consuming and/or providing back information. --> <dataProcessorName>CEOProcessor2</dataProcessorName> <privacyPolicyURL>www.ceo.priv.policy.edu.au</privacyPolicyURL> <privacyContactList> <contact> <name> <familyName>Woodall</familyName> <givenName>Charles</givenName> <otherGivenNames>William</otherGivenNames> </name> <positionTitle>Admin</positionTitle> <emailList> <email>drseuss@whoville.k12.ceo.edu.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(08) 8555-0102</number> </phoneNumber> </phoneNumberList> </contact> </privacyContactList> <notifyDataControllerOnAccessRequests>Y</notifyDataControllerOnAccessRequests> <dataProcessorContactForAccessRequestsList> <contact> <name> <familyName>XXX</familyName> <givenName>YYY</givenName> <otherGivenNames>ZZZ</otherGivenNames> </name> <positionTitle>Privacy Officer</positionTitle> <emailList> <email>off@whoville.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(03) 9999-9999</number> </phoneNumber> </phoneNumberList> </contact> </dataProcessorContactForAccessRequestsList> <purposeList> <purpose>Admin System</purpose> <purpose>Australian Schools List</purpose> </purposeList> <alternatePurposeList> <alternatePurpose>Student Portal</alternatePurpose> </alternatePurposeList> <deidentifiedPurposeList> <deidentifiedPurpose>Research</deidentifiedPurpose> </deidentifiedPurposeList> <dataUsageMarketingAllowed>N</dataUsageMarketingAllowed> <personalInformationUpdatedFromSource>10</personalInformationUpdatedFromSource> <dataBreachNotification>Y</dataBreachNotification> <dataBreachContactList> <contact> <name> <familyName>XXX</familyName> <givenName>YYY</givenName> <otherGivenNames>ZZZ</otherGivenNames> </name> <positionTitle>Privacy Officer</positionTitle> <emailList> <email>off@whoville.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(03) 9999-9999</number> </phoneNumber> </phoneNumberList> </contact> </dataBreachContactList> <employeesMustComplyWithAgreement>Y</employeesMustComplyWithAgreement> <employeeConfidentialityAgreement>Y</employeeConfidentialityAgreement> <employeeTrainingList> <employeeTraining> <trainingName /> <trainingURL /> </employeeTraining> </employeeTrainingList> <passwordEmployeeAccessStandard> <standardName /> <standardURL /> </passwordEmployeeAccessStandard> <securityTestRequiredList> <securityTestRequired> <testType>Pen Test</testType> <testFrequency>Annual</testFrequency> <remediationRequiredIn>7 days</remediationRequiredIn> <shareResults>Y</shareResults> </securityTestRequired> <securityTestRequired> <testType>Vulnerability Test</testType> <testFrequency>Monthly</testFrequency> <remediationRequiredIn>24hours</remediationRequiredIn> <shareResults>Y</shareResults> </securityTestRequired> </securityTestRequiredList> <countryImpactedList> <countryImpacted> <country>1101</country> <usage>Stored/Processed/Exposed</usage> </countryImpacted> <countryImpacted> <country>1102</country> <usage>Exposed</usage> </countryImpacted> </countryImpactedList> </dataProcessor> <dataSubProcessorList> <!-- List of entities that provide services to the Data Processor. They also handle the data and must be aware of privacy obligations. e.g. Google, iCloud, Microsoft Azure, AWS etc. --> <dataSubProcessor> <subProcessorName>One</subProcessorName> <!-- Caps? --> <privacyPolicyURL>www.one.edu.au</privacyPolicyURL> <privacyContactList> <contact> <name> <familyName>First</familyName> <givenName>Charles</givenName> <otherGivenNames>William</otherGivenNames> </name> <positionTitle>Admin</positionTitle> <emailList> <email>drseuss@whoville.k12.ceo.edu.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(08) 8555-0102</number> </phoneNumber> </phoneNumberList> </contact> </privacyContactList> <purposeList> <purpose>Attendance</purpose> </purposeList> </dataSubProcessor> <dataSubProcessor> <subProcessorName>Two</subProcessorName> <privacyPolicyURL>www.two.edu.au</privacyPolicyURL> <privacyContactList> <contact> <name> <familyName>Two</familyName> <givenName>Charles</givenName> <otherGivenNames>William</otherGivenNames> </name> <positionTitle>Admin</positionTitle> <emailList> <email>drseuss@whoville.k12.ceo.edu.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(08) 8555-0102</number> </phoneNumber> </phoneNumberList> </contact> </privacyContactList> <purposeList> <purpose>TimeTabling</purpose> </purposeList> </dataSubProcessor> <dataSubProcessor> <subProcessorName>Three</subProcessorName> <privacyPolicyURL>www.three.edu.au</privacyPolicyURL> <privacyContactList> <contact> <name> <familyName>Third</familyName> <givenName>Charles</givenName> <otherGivenNames>William</otherGivenNames> </name> <positionTitle>Admin</positionTitle> <emailList> <email>drseuss@whoville.k12.ceo.edu.au</email> </emailList> <phoneNumberList> <phoneNumber> <number>(08) 8555-0102</number> </phoneNumber> </phoneNumberList> </contact> </privacyContactList> <purposeList> <purpose>StudentPortal</purpose> </purposeList> </dataSubProcessor> </dataSubProcessorList> </privacyObligationsDocument> </privacy> <privacy> <default>N</default> <appIDList> <appID>TT12</appID> </appIDList> <adapterFingerprintList> <adapterFingerprint>b4ef12ce-7025-11e8-adc0-fa7ae01bbebc</adapterFingerprint> </adapterFingerprintList> <zoneContextList> <zoneContext> <zoneId>4001</zoneId> <contextId /> </zoneContext> </zoneContextList> <!-- List of rest endpoints --> <endpointList /> <!-- User Groups? --> <!-- Users? --> <privacyObligationsDocument> <technicalRequirements> <dataAccess> <!-- Since a POD represents a contract, only these should very. As such the replacement logic, should apply to each immediate child found here. --> <!-- holds the green list and the permissions or conditions on these elements. --> <fieldList> <field> <fieldName>/SchoolInfo/@RefId</fieldName> <controlrights>R</controlrights> </field> <field> <fieldName>/SchoolInfo/LocalId</fieldName> <controlrights>R</controlrights> </field> <field> <fieldName>/SchoolInfo/ACARAId</fieldName> <controlrights>R</controlrights> </field> <field> <fieldName>/StudentPersonal/@RefId</fieldName> <controlrights>R</controlrights> </field> <field> <fieldName>/StudentPersonal/LocalId</fieldName> <controlrights>R</controlrights> </field> <field> <fieldName>/StudentPersonal/FirstAUSchoolEnrollment</fieldName> <controlrights>R</controlrights> </field> <field> <fieldName>/TimeTable/*</fieldName> <controlrights>RW</controlrights> </field> </fieldList> </dataAccess> </technicalRequirements> </privacyObligationsDocument> </privacy> <privacy> <default>N</default> <adapterFingerprintList> <adapterFingerprint>b4ef12ce-7025-11e8-adc0-fa7ae01bbebc</adapterFingerprint> </adapterFingerprintList> <zoneContextList> <zoneContext> <zoneId>4002</zoneId> <contextId /> </zoneContext> </zoneContextList> <dataModelNamespace>http://www.sifinfo.org/infrastructure/2.x</dataModelNamespace> <dataModelVersionMin>2.3</dataModelVersionMin> <dataModelVersionMax>2.9</dataModelVersionMax> </privacy> <privacy> <default>N</default> <adapterFingerprintList> <adapterFingerprint>b4ef12ce-7025-11e8-adc0-fa7ae01bbebc</adapterFingerprint> </adapterFingerprintList> <zoneContextList> <zoneContext> <zoneId>4003</zoneId> <contextId /> </zoneContext> </zoneContextList> <dataModelNamespace>http://www.sifinfo.org/infrastructure/2.x</dataModelNamespace> <dataModelVersionMin>2.1</dataModelVersionMin> <dataModelVersionMax>2.8</dataModelVersionMax> <privacyObligationsDocument> <technicalRequirements> <securityTechnologyList> <securityTechnology> <technologyName>SSL</technologyName> <!-- do we really need this here? <purpose/>--> <technologyDescription /> <referenceURL /> </securityTechnology> </securityTechnologyList> </technicalRequirements> </privacyObligationsDocument> </privacy> </privacyList> </pod>