Data protection question about child’s info

[Unicornhamster]

I am in the process of signing my son up for a holiday club for the February half term. When emailing with the booking department they sent me a form to fill out about him, emergency contact information, medical history (quite detailed), address, phone numbers, school and name DOB.
When I opened the form it was already filled out by another family who happen to go to his school. I was a bit confused when I seen the name and it took me a minute to register what it was so I scrolled through the message thread and the guy had wrote another email asking me to ignore the previous form, ‘please delete it without opening’ and fill out the new blank one.
The way my emails are set out the filled form came up first with the first message he sent (so chronological order by time of delivery) I couldn’t see the next email without scrolling right down so didn’t realise it was there. I am not usually one for complaining or causing a fuss but if that form went to another family about my DS I would be pretty pissed off, not only a huge safeguarding issue but he has a complex medical history that he would hate for his friends to know about.

Would you do anything in this situation? Escalate it? Or just delete and put it down to the guy having made a genuine mistake and hope it wasn’t done again?

Yes escalate it. As you say, it's a big safeguarding issue and a huge breach of GDPR.

I have had a look and their website has company confidential section it says if anything is sent in error to discard it and contact (owners name) but that’s the man who sent the email in the first place... who else can I can contact? Or is that it.

That's bloody crap. I'd complain but I don't know who to!

In reality it’s a breach of gdpr and you can complain to ico; he should have informed them himself.
However it sounds like a genuine mistake and he’s probably bricking it now as the fine can be substantial.

What do you actually want to happen ? I’m sure the man is mortified and sorry he sent the email in error. But apart from either getting him removed from his post with the club, shaming them on social media so other parents don’t use them,

Is the info you saw was sensitive and would the other family really be affected by someone seeing it ? If so why not speak to them?

It's a genuine mistake, and no harm has been done. I wouldn't complain, but would let it be known that you know IYSWIM.

I understand you don’t want your sons friends to know about his medical needs but realistically it wasn’t your sons info that was leaked so it’s all hypothetical. Another family may not care about someone seeing their address and name and an ‘n/a’ in the medical box. Realistically do you want to potentially end someone’s employment or send a business out of operation. If you think that’s something they deserve then I’d take it as far as you can. But think about it first.

This is the issue I have with GODR. A genuine mistake has been made and because of the new legislation people want to “escalate”. I would forget I have seen it and move on. And not worry about “what if”, I doubt they will do it again.

It was an accidental data breach, nobody’s perfect with their job or technology. I’m sure the sender has learnt their lesson, why would you want them to get into trouble?

Agree with nicknacky

I would chalk it up as a genuine mistake, delete the email and not bother about it any further. Humans make mistakes all the time, just cut us some slack.

It was an accident, they do happen. He should have reported it himself though if adhering to the new GDPR rules.

I understand you have concerns and wouldn't like your child's details being shared incorrectly, but I suppose it's a case of nobody is perfect.

What do you want to be the outcome of reporting it/escalating it? I think that will help you decide what to do if you know what you want to achieve from it.

I wouldn't complain. I couldn't see the benefit in it.

He made a mistake and I think you are over-reacting. People have become hyper-sensitive to data leaks since GDPR. Does it make any material difference to your life? You could email him to say you received another child’s info and are anxious about this happening with your child’s info. See what he says.