Gdpr breach

Accidentally CCing not BCCing is easy to do

They sent a recall email so they have done what they needed to do

Also sounds like a lot of parents are using "reply all" if you know they've replied to the question and one complained - this shows a lack of technical unawareness from their side too.

Most data breaches are human error, that's just a fact, cyber breaches you hear of are dwarfed in numbers by staff mistakes, it's not as if we have a prolific problem of staff maliciously over sharing data, staff are the biggest risk factors and data controllers need to address these issues properly to improve training and processes.

Could you inform the head as opposed to formally reporting?

This is a breach and the school needs to deal with it.

If they don't sort out their procedures then the next breach could be far more serious.

Cc ing is really sloppy and suggests the person doing it hasn't undertaken their training.

You are right to raise this with the school.

its a hard one, and likely a human error. Probably added the names to CC rather than BCC as its not always obvious where to find that.

Once, before the GDPR rules came into force I was reminded of this when I sent out a welcome email to everyone who was coming to stay at our glampingsite in a particular month. Its what I had always done, just copy and paste all the booking emails into one email to send out to guests - Id done it for several years, and a guest pulled me up on it. I really didnt know (as not trained in admin/office protocol) that it wasnt the done thing, and my partner who worked in IT pointed out to me where to find the BCC tab. I now just reply to everyone individually , but it is easy to do, and fortunately it was just unintentionally rude rather than illegal.

I am pretty sure this was reported about on the BBC news website. It is a coincidence if not. Is the school in Essex?

It does make a difference that the content of the email has to do with SEN. Health information is considered 'special category' data in the UK GDPR. These categories of person data are considered more sensitive and are given extra protection by the law.

Yes, mistakes happen. It's how the school responds to the data breach that matters.

Yeah they are about not passing on data.

Who is to say that one parent won't decide to use the email addresses to try and sell multi level marketing products at or to harass another parent? It's basic level safeguarding.

You don't know what that data might be used for - that's point - to prevent ANY misuse of your data.

It's not simply about whether little Johnny has issues with their eyes.

You are deliberately and grossly misrepresenting the issue.

I would definitely have to say something. Especially if my DC might be impacted because of this error. If the school didn't respond appropriately I'd probably complain then. It's not on is it?

Human error or not, there’s absolutely no need for other parents to have my email address. That’s sensitive information and I’d absolutely be complaining.

OP, we had a situation like this at work. I work in the film industry and our team leader CC’d customers in an email instead of BCC’ing them. Despite the fact that the email was very basic, so many customers complained because their email address was available for other people to see.

I don’t necessarily think it matters that the content has to do with SEN. I think you need to complain due to the email address issue alone

If it's a genuine mistake by the school, just reply to the sender and politely let them know.

If it's a first time issue, it seems quite churlish to escalate it to the ICO.

I would follow this up.

It is simply not on for an organisation to share your email address to scores of other people.

It doesn't matter whether it's a school or a company or a whatever. It shouldn't happen, they need to do better. And apologise.

@Whatsthebl00dypoint best thing to do would be to go back to school to ask them to reassess the situation as they do not appear to have followed the appropriate process. If you are not satisfied with their response, contact their DPO via their privacy notice as sometimes the operational areas are just poorly trained in their duty so alerting their dedicated DP can help.

The ICO will not be interested until you have exhausted talking to the organisation.

Cross Post. School know so move on .

It would have been best if you'd just contacted them to say what you noticed and then they could apologise or investigate as they felt fit. I would hope no harm done and the worker will be more careful next time but there may be other issues about sharing particular emails that trigger a greater worry. I am paranoid about using bcc as I've done a similar thing with a smaller group of people by accident. Luckily no one threw the book at me and I avoid bcc if I possibly can. But in school with that volume of people to contact it can not be sent individually.

So school have breached GDPR but unless someone makes them aware they’ll likely have no idea OP- person sending the email has probably thought they BCC’d rather than CC’d.

I’d give them a heads up but honestly doubt the majority of parents have paid much attention to who else has received the email or cares for that matter.

Oh, chill out darling.

If your child is SEN or FSM, then fine, but don't get upset on someone's else's behalf.

I think you should report it. I would politely contact the school and enquire if they're aware and handling the breach. I would probably report to the ICO too because they can then decide if it's worth investing or not. I love the ICO - they've always been very helpful when I've had to contact them about work matters.

I'm surprised that people think that reporting this is petty. This is personal data and potentially health related data shared with loads of people.

Don't be ridiculous. This kind of activity is exactly what the law on data protection is for. That's GDPR and the Data Protection Act 2018.

There are lots of things the people used to do that we don't now because the law has changed. Smoking indoors, seatbelts, marital rape. All used to be allowed and accepted, now against the law. Data protection is the same.

OP, you'd be right to tell the school. If they know they should have contacted you all to request deletion, reassure you, offer the opportunity to ask any questions etc. if they haven't realised they need to know so they can do those things, train the person/people responsible, think about their processes for managing personal data and assess whether it meets the threshold for telling the ICO.

I've been a data protection professional for 14 years. I don't think it's immediately reportable to the ICO based on what you've described so far, but I don't know the full content of the email. It could be. That it involves children will be a factor. But at the very least the school needs to know to contain and minimise the impact.

Tell them. You don't need to go in all guns blazing. But they do need to know.

They need to do the self assessment tool on the ico website and see if they need to formally report themselves. That’s a very basic error from the school, someone probably needs some more training on the practical side of things. Personally I would be contacting the school. Next time they could make a much bigger fuck up!

https://www.bbc.co.uk/news/uk-england-essex-67698037

I've just read this on the BBC website. Is it that school? Of course YANBU. Posters saying things have got out of hand and that nobody used to worry about stuff like this are so naive.

Yes absolutely this is a GDPR breach. It happens at our work, like anywhere human error exists. Even if we send an email to the wrong person (internally) we need to report. This incident 100%, the ODPO may want to investigate. They should have reported themselves. Our procedure would include an email apologising and asking everyone to delete the email. Quite poor they’ve not done that yet

Have you spoken to the school? Is it possible that they are not aware. E.g. all names were cc'd rather than bc'd in that case they may not have picked up the error.
I have to say I wouldn't really be all that bothered my email address is outthere for many people/companies with they way things are.