Active discussions

Please or to access all these features

Talk
AIBU?

Share your dilemmas and get honest opinions from other Mumsnetters.

Original poster

Gdpr breach

83 replies

Whatsthebl00dypoint · 14/12/2023 00:31

If your child's school sent out an email CC"ing in over 80 parents with their child's name and parent's email addresses, and it was a specific category of children eg. SEN or Pupil Premium, is that a serious breach of data privacy?

I'm considering whether to make a formal complaint to DD's school since this happened the other day as we have not recieved an official apology or explanation how this was able to happen although it was likely human error. I know mistakes do happen but this seems pretty big for them to remain silent over. There was no sensitive information in the email, just a very general one. But it's the fact that the list of children is very specific and not all families will want this information public for obvious reasons.

OP posts:
New posts on this thread. Refresh page
WhatsTheUseOfWorrying · 14/12/2023 15:04

Sounds like something from nothing really.

Since the school’s aware I’d leave it at that.

Poufpastry · 14/12/2023 14:57

It's worth complaining to a school if they have done something you are not happy with and you can tell them what outcome you want in response to your complaint.
If Op (and probably others) contact the school and ask them to apologise to the parents and they do, probably also saying they will do their best to make sure it doesn't happen again - What further outcome is needed? So why take out a complaint? Just email, ask them to contact the parents to apologise and to give reassurances for the future.

Andbreatheee · 14/12/2023 14:48

Something similar happened at our school, except it was to parents who hadn't paid fees. It was a nightmare, caused a huge number of issues, the receptionist who did it was fired, parents (understandably) went ballistic! This was about 12 years ago now, but still! I don't think you'd be wrong to complain!

angsanana · 14/12/2023 14:35

A recall isn't enough, the school should be writing out to apologise, confirming the individual will be given extra training and asking parents to delete the reply all responses.

cezannesapple · 14/12/2023 13:54

GirlsAloudReturnMadeMyYEAR · 14/12/2023 01:29

Why would you complain about something you've admitted is probably human error? Just to make someone's life a bit harder before Christmas? No doubt you'll say because it's a serious breach but it isn't really. One of my colleagues made a breach similar to this, his daughter had killed herself and when someone complained he ended up going off sick for a very long time. Don't be that person, nobody's done it on purpose.

Very sad for your colleague but a GDPR breach should be taken seriously. You don’t know the impact of sending out personal details to a large group of people.

bonzaitree · 14/12/2023 13:03

I completely agree OP.

Original poster
Whatsthebl00dypoint · 14/12/2023 12:11

Sorry I am at work so can't reply properly but wanted to clarify that the recipients list is only those whose children are of that specific group. I won't reveal what but it is considered special category data. The email sent by school office wanted a confirmation reply from the parents whether the email address was accurate. But theres no doubt about the list of children. I know all personal data is sensitive but this really should have been handled with greater care.

OP posts:
Comefromaway · 14/12/2023 11:34

That is a serious breach.

At my child's school there were several parents who had very good reason for their email addresses not being in the public domain including:

Parent was a teacher in the local area and didn't want to get emails from parents of children she taught.

Parent was an NHS psychiatrist and had a very unusual surname. Had already been subject to seriously disturbed patients following them & their child around town and trying to contact them personally.

Parent of adopted child whose birth parent was trying to get in contact.

I'm sure there are more.

fpqand · 14/12/2023 11:27

@MandyMotherOfBrian from what OP says it sounds like a list error but a specific list, she mentions 80 people, so it doesn't sound like the entire school but a list for a purpose which in itself divulges information. Obviously only an investigation can confirm that but I suspect OP has been able to glean that much.

MandyMotherOfBrian · 14/12/2023 11:19

fpqand · 14/12/2023 10:58

@MandyMotherOfBrian not necessarily, it's the context, if the context is that the list is clearly for those with specific needs then you are essentially divulging special category data, if it was a generic school letter sent to the whole school that would likely be lower risk despite being more people because the context is lower risk. There was a similar breach involving HIV patients, "cc-ing" breaches can be very high risk, or low risk, you can't define them by the type alone, you need the context.

Yes exactly, and if they made a CC error they may have also made a list error - it might have gone to everyone, therefore no one can be identified as a particular category. But only the investigation will reveal that, which should be carried out regardless of the risk level of course.

fpqand · 14/12/2023 10:58

@MandyMotherOfBrian not necessarily, it's the context, if the context is that the list is clearly for those with specific needs then you are essentially divulging special category data, if it was a generic school letter sent to the whole school that would likely be lower risk despite being more people because the context is lower risk. There was a similar breach involving HIV patients, "cc-ing" breaches can be very high risk, or low risk, you can't define them by the type alone, you need the context.

MandyMotherOfBrian · 14/12/2023 10:39

Whatsthebl00dypoint · 14/12/2023 08:15

I understand errors happen, we're all human but the rules are in place for protection. As I said the list is of a specific vulnerable category of school children and disclosing this information can cause lots of potential issues.

I don't want the person responsible to be fired or anything extreme but hopefully it won't happen again. I'll ring up today and see what the school says.

Was the email message very specific about a named individual with SEN?
Or was it a generic email that was CCd to all instead BCCd?
Because the latter, sharing only email addresses, will be considered low risk. Bearing in mind that some of the email addresses will be anonymised and/or be names that do not correlate with a specific child’s name, information gleaned from it will be minimal.

bonzaitree · 14/12/2023 09:56

This is absolutely a serious data breach on the basis that it includes information about

  1. Children
  2. vulnerable people
  3. medical information (special category data)
  4. disability information

The school has a duty to take care of your and your child’s personal data, including training all staff (which the message clearly hasn’t got through!)

Personally I would be writing to the governors about this, including 1. Factually what happened; 2. Why this is a personal data breach; and 3. The effect on you and the children (embarrassment, loss of trust in the school etc.)

Ask them for a report on how they have dealt with the incident. At a minimum, they should have:

  1. recorded the incident in their breach register
  2. conducted an analysis of why the breach occurred
  3. implemented measures to prevent recurrence such as staff training, reviewing software etc.

This isn’t ok- don’t let it drop!

Megifer · 14/12/2023 09:55

Cleanbedsheets · 14/12/2023 09:45

I'm hoping the school will have reported itself to ICO as per the rules, but just an apology would be enough for me. They cannot just gloss over this mistake as if it didn't happen

This kind of breach does not require reporting to the ICO. However, and internal record should be made by the school, and parties informed.

It involved special category data (health) and data relating to children. So a double whammy.

breaches should be reported if there is a risk it could affect the rights and freedoms of the individual. I'd suggest sharing identities of minors who have SEN could potentially be such a breach as it has breached confidentiality. At the very least, those affected should have been informed separately.

I'm really surprised at that ICO officers response tbh.

ArseInTheCoOpWindow · 14/12/2023 09:50

I left teaching 3 years ago. We weren’t allowed to use names in email then. It had to be initials only. Sounds like the school are behind the curve in safeguarding.

It was introduced to stop this sort of thing happening.

ColleenDonaghy · 14/12/2023 09:46

I would speak to the school and see if they realise how serious it is and take it from there.

I had this with the GP once - they sent out asthma review forms and CC'ed all the patients rather than using Bcc. Obviously asthma isn't the most sensitive of medical conditions, but still really shouldn't have happened. I replied to the email and then had a call from the practice manager. I was satisfied they realised how potentially serious it was and so I left it there.

Cleanbedsheets · 14/12/2023 09:45

I'm hoping the school will have reported itself to ICO as per the rules, but just an apology would be enough for me. They cannot just gloss over this mistake as if it didn't happen

This kind of breach does not require reporting to the ICO. However, and internal record should be made by the school, and parties informed.

mindutopia · 14/12/2023 09:42

Yes, it's a GDPR breech. They shouldn't be sharing parent email addresses with everyone. I would report it to them and let them address it.

It's very likely a junior admin person who hasn't had sufficient training or did something in a rush without thinking, but it's important that it's flagged up so they can learn from their mistake. We've had the same happen at work (not me personally, but with another staff member whose job involves less data protection stuff). It was a helpful learning experience.

Ivyy · 14/12/2023 09:41

Similar thing happened at dd's school in the summer. SEN dept administrator sent out an email about dates for end of year record of outcome meetings. Parents were bcc'd so it showed every parent's email address. It didn't go to all parents, just those who have children with sen at school. If it had gone to all parents I would've said something as my daughter doesn't tell anyone she has sen and wants to keep it private.

In any case, the administrator sent a second email almost straight away, not apologising but saying the last email had been sent in error and please delete it. She was new and had only been working at the school a couple of weeks, so I just put it down to that and human error. Had no idea it was a breach til reading this post tbh!

Megifer · 14/12/2023 09:41

I'm surprised the ICO have said a recall is enough, recall doesnt work unless everyone is in the same org or using the same email exchange (think thats the terminology) so e.g. someone sending from Outlook will never successfully recall a message from a gmail address.

Original poster
Whatsthebl00dypoint · 14/12/2023 09:39

@Vinrouge4 no we are not the school mentioned in the news.

OP posts:
Original poster
Whatsthebl00dypoint · 14/12/2023 09:36

I've just spoken to someone from ICO for general advice and been told it is a breach of data albeit low risk and quite common (alarmingly!), but it's important how the situation is handled by the school afterward. If they did the recall then they do not need to refer themselves to ICO. However, as someone above pointed out a few parents have been doing 'reply all' so the list of personal details has been sent out repeatedly and this has not been addressed by the school asking parents to urgently delete the emails. Any complaint/concern from a parent should be in writing I was told so if it is investigated there is a paper trail so I'll email the HT instead of a phone call as initially planned. It won't be a complaint but they do owe the parents an apology at the very least.

OP posts:
fpqand · 14/12/2023 09:31

@ButWhatAboutTheBees recall emails don't really work, they should be emailing the parents and a) apologising because you know...common decency and all that b) requesting the emails are deleted (yes individuals are compelled by the legislation to do that or they can be individually liable)

Youcannotbeseriousreally · 14/12/2023 09:21

Vinrouge4 · 14/12/2023 09:00

I am pretty sure this was reported about on the BBC news website. It is a coincidence if not. Is the school in Essex?

The OP has already said it’s not the same one.

In Essex the school reported themselves to the ICO. That was a really really significant breach.

Frabbits · 14/12/2023 09:20

Absolutely it's a GDPR breech and I would expect the school to treat it seriously.