Nursery data breach

[Pizzatrip]

Hi all,

I want to gauge your opinions on how bad this is before I reply to the nursery.

I emailed my child’s nursery today with their code for the 15 funded hours. Nursery have sent me back a form to fill in, but rather than send me a blank form, they’ve sent a form with another child’s details filled in (parent details and NI numbers, address, disability status, care status etc).

I was considering alerting the nursery to their mistake, telling them I’ll delete the email if they can send it again with a blank form, but part of me thinks it requires further escalation (now quite sure what/to who?) as it’s a GDPR breach.

What would you do?

I would flag it up to the manager and delete it.

All you can do is what you suggested- flag and delete, and let their data governance person deal with it.

You have no line of further escalation (apart from a referral to the ICO but they won’t look at a very low-level issue like this).

I think I’d just tell them they’ve send the wrongly filled in form, ask for a blank one and then delete the email. Maybe copy nursery management in if you want to make sure they are aware it happened.

I'd just delete it and ask for a blank
one too, it sounds like a one off mistake not a systemic failure, the person who did it will probably be mortified.

Great thanks guys - will do as I suggested. I have the tendency to be relaxed on things like this, so just wanted to check I wasn’t minimising anything