Page 3 | Gdpr breach

Whatsthebl00dypoint · 2023-12-14T00:31:15+00:00

If your child's school sent out an email CC"ing in over 80 parents with their child's name and parent's email addresses, and it was a specific category of children eg. SEN or Pupil Premium, is that a serious breach of data privacy? I'm considering whether to make a formal complaint to DD's school since this happened the other day as we have not recieved an official apology or explanation how this was able to happen although it was likely human error. I know mistakes do happen but this seems pretty big for them to remain silent over. There was no sensitive information in the email, just a very general one. But it's the fact that the list of children is very specific and not all families will want this information public for obvious reasons.

CyberCritical · 14/12/2023 07:23

It is a breach because emails should have been bcc'd. The school would self assess as it being a low value/volume data breach which means it would be on record but not receive fines or action from ICO. Root cause would be human error.

You should make the school aware but beyond apologising and retaining/discussing with the staff member, there is limited action that can be taken.

Stresa22 · 14/12/2023 07:17

This is a good time to suggest school staff receive GDPR training annually.

VisionsOfSplendour · 14/12/2023 07:15

Redsheeps · 14/12/2023 03:05

I think people have lost sight of what GSPR laws are for. No one gives fuck if little jimmy needs his eyes tested. Get over yourself

What a stupid comment, just because you don't care doesn't make it not a breach of the rules

I'd contact the school in a neutral way first and see how they react before deciding what to do

WrongSwanson · 14/12/2023 07:14

AfraidToRun · 14/12/2023 07:11

£10k!

Can ICO dictate that, I thought they just fined companies.

The ICO can fine.

But people can also sue organisations for harm caused as a result of a data breach.

Laurama91 · 14/12/2023 07:14

We had the email situation at work not long back. As soon as it was realised a further email was sent to retract the previous and an apology for sharing every employees personal email.

WrongSwanson · 14/12/2023 07:14

GirlsAloudReturnMadeMyYEAR · 14/12/2023 01:29

Why would you complain about something you've admitted is probably human error? Just to make someone's life a bit harder before Christmas? No doubt you'll say because it's a serious breach but it isn't really. One of my colleagues made a breach similar to this, his daughter had killed herself and when someone complained he ended up going off sick for a very long time. Don't be that person, nobody's done it on purpose.

That's really sad. But equally people can have very good reasons why they don't want their information shared,.so the school does need to know.

If the school are sensible they will deal kindly with the person who made the breach, recognising mistakes happen

WrongSwanson · 14/12/2023 07:12

Yes it's definitely a breach. And potentially quite a serious one.
There are some similar cases on the ICO website.

Definitely at least alert them to it

AfraidToRun · 14/12/2023 07:11

£10k!

Can ICO dictate that, I thought they just fined companies.

NatMoz · 14/12/2023 07:10

The school (or individual) may not have realised their error.

Not all breaches are reportable. The school would have to assess the likelihood of risk before reporting to ICO. If the risk is low then they would log it in house and address remedial measures/containment etc.

Again that's assuming they know an error occurred. There is no harm in raising it to their attention

Quitelikeacatslife · 14/12/2023 07:09

If they've apologised then an internal investigation will have taken place to make sure it never happens again. If they have not mentioned it but you have noticed, then you can email the school with your concerns but don't need to be formal or a complaint. Just say you are aware and ask them to look into it. But you can be nice about it.

CandyFluff99 · 14/12/2023 07:06

I would just drop a polite email on response outlining what you have here. That way they can make sure it doesn't happen again. If it does happen again then I would look at a formal complaint (OK I probably wouldn't. But if it were bothering me this would be my approach).

Emma0987 · 14/12/2023 07:05

This happened in my child's high school. When they noticed they apologised immediately (was quickly after sending) and reported it to who they needed to within the council for the breach and from this I guess would come how to prevent it happening again.

NewJobNewMeNewLife · 14/12/2023 07:02

If nobody is likely to complain, maybe school haven’t realised.

I would have replied to the email as soon as I received it saying something like- good morning, just to let you know that this small has been cc Ed instead of being bcc'd. I wanted to make you aware so in future you could ensure emails are blind copied.
Thank you

then I would feel like I’d let them know, and I could forget about it. I wouldn’t be waiting to see what happened from school. I’d be more constructive about it all.

fpqand · 14/12/2023 03:26

ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/12/ico-fines-ministry-of-defence-for-afghan-evacuation-data-breach/

Yeah why can't we just cc people into emails, it's totally fine.

Bringbackspangles · 14/12/2023 03:19

@Whatsthebl00dypoint I think you are right to be concerned and although it is very likely to be human error, there is a chance it would happen again. Being able to accidentally email all parents should be (administratively) a quite difficult thing to do to avoid this scenario. I.e email lists have very distinct names.

I think you have two separate issues: 1. The Breach itself and 2. The lack of urgency in the school explaining how it has happened, a request for all recipients to delete and an apology. I think if by close of play today you haven’t had the latter, it would be reasonable to make a complaint to the Head Teacher in the first instance.

Redsheeps · 14/12/2023 03:05

I think people have lost sight of what GSPR laws are for. No one gives fuck if little jimmy needs his eyes tested. Get over yourself

nameychangio675 · 14/12/2023 03:02

Coyoacan · 14/12/2023 01:45

How horrible but you do not know how people were affected by this breach and if nobody complains, it will happen again

Show quote history

It happens because of human error not for a laugh, why would anyone be "affected"?!

Privacy breaches have just gone way too far now. Remember the days when everyone was just cc'd in to stuff, sigh.

fpqand · 14/12/2023 02:57

It is a breach yes, whether it's serious enough to be ICO reportable will hard for anyone here to say without the full context. But the fact the school haven't (appeared to at least) recognised the breach is pretty bad form, they should be going out and apologising, asking people to delete the email (yes people are obligated to under the law) and then in the least recording internally. If after that point you don't feel the school have addressed it properly (ie you feel it is reportable not just recordable) you can take to the ICO, but they will do very little, they're useless and have done very little with much more serious breaches, the current commissioner has little appetite for enforcement. I think it's reasonable to complain to the school though to ensure it is handled how it is legally supposed to be.

Redsheeps · 14/12/2023 02:19

Ffs, what do you expect to achieve? If you just want an apology, highlight it and ask they do an assessment to prevent it again. Why the need for a “formal “ complaint

AnotherCrazyCatLady · 14/12/2023 02:13

It likely was inadvertent, but it is worth politely drawing this to the School's attention as it is a GDPR breach to cc rather than bcc all the parents. I wouldn't frame it as a 'formal complaint' at this stage - I'd give them the benefit of the doubt and see how they respond.

Coyoacan · 14/12/2023 01:45

GirlsAloudReturnMadeMyYEAR · 14/12/2023 01:29

Why would you complain about something you've admitted is probably human error? Just to make someone's life a bit harder before Christmas? No doubt you'll say because it's a serious breach but it isn't really. One of my colleagues made a breach similar to this, his daughter had killed herself and when someone complained he ended up going off sick for a very long time. Don't be that person, nobody's done it on purpose.

How horrible but you do not know how people were affected by this breach and if nobody complains, it will happen again

catotangent · 14/12/2023 01:44

You should make a formal complaint

cryinglaughing · 14/12/2023 01:37

The school I worked at had to pay one parent £10k for this exact thing.
Extra training was given to hopefully prevent it happening again.

GirlsAloudReturnMadeMyYEAR · 14/12/2023 01:29

Why would you complain about something you've admitted is probably human error? Just to make someone's life a bit harder before Christmas? No doubt you'll say because it's a serious breach but it isn't really. One of my colleagues made a breach similar to this, his daughter had killed herself and when someone complained he ended up going off sick for a very long time. Don't be that person, nobody's done it on purpose.

kitchenhelprequired · 14/12/2023 01:25

It needs to be reported as a GDPR breach by the school. Have they just not noticed or has it been pointed out to them and they don't consider it an issue?