To complain about school's breach of DPA?

[sananbaz]

My DS(9 yo) has brought out an envelope from school (addressed to us) with a copy of his care plan to sign. Also in the envelope is a consultant's clinic letter and minutes from a TAC (team around the child) meeting for a different child at his school. I don't know this child or her parents. It contains name, address, DOB, and various diagnosis. I immediately returned the paperwork to the school office and pointed out how serious a breach of data protection and confidentiality is, but the receptionist didn't seem to look at all bothered, took it from me and said she'd give it back. I said I thought it was quite serious and that I would send an email - she didn't seem interested.
So, aibu to email the head and the senco, telling them what happened and that I'm very concerned how poorly sensitive data has been mishandled or am I blowing it up more than is necessary? And if I do email, what sort of key phrases will get them to take this seriously?

Exactly cauliflower. And the draft letter suggested upthread may have been drafted by a professional, but the OP who wants to send it is not.

I would just have a quiet word with the Senco, let them know your not happy and leave it at that.

This. Because PP was right that she'll feel sick when she realises the mistake s/he made. The receptionist's reaction was inappropriately casual, but the head would have to give SeNCO a warning if he knew and it's his/her fault, so a quiet word is kinder.

Biscuit, I've only ever said I wanted to tell the school and find out how they were going to prevent it happening again. I'm not baying for blood, or anyone's head. I don't want to create a shitstorm. I'm not sure where you have got this impression. And yes, she may earn minimum wage, but there are many people in that situation and that doesn't mean they are less consciousness in the way they perform their duties. If changes to practice or policy can prevent this happening again, surely this lady can be a part of that process and work together with her colleagues to make necessary changes. If I don't mention it, nothing changes, and the next time the fallout could be far worse for the person whose data has been mishandled. Suppose another child saw medical information, spread the word, a child got bullied and committed suicide? That's extreme, but would the admin assistant day she's not paid enough to do her job properly? I'd hope not.

Put your letter of complaint to the school first and see if they take it seriously tighten their procedures to prevent this happening again.

Then take it further if they refuse to review how they are conducting themselves

Oh ok. Well if you don't want to create a shit storm then the example letter is not your way forward. If you want it reviewed then talk to the senco.

eyelevel not sure if you are still reading but, for your own interest if you like, google "ICO fines Northern Ireland Department of Justice." I was involved in that case and I know for a fact that the DOJ, following discussions with the ICO, decided not to inform the data subjects affected due to the early containment of the breach and the disproportionate distress which would be caused by telling them. That is why any article about it does not specify the information or the area in the DOJ where the breach occurred. I know that is different from a school but is an example of a decision not to cause greater distress.

OP you are welcome and good luck in whatever you decide to do about this. Have a nice weekend and don't worry about it until Monday

DS1 spent a great deal of time at CAMHs early this year. Our local branch is about 40 minutes away and covers a vast area. In April he received a diagnosis which we'd been expecting in the post. Inside the pack (it was quite a hefty thing with various booklets and folders of information) was also another child's diagnosis letter which had obviously been gathered accidentally in the pile addressed to DS1.

I think accidents like this can and do happen, but must be addressed in order to prevent it occurring again. People make mistakes of course, but when it comes to protection of information schools (and other agencies) need occasional reminders. A complaint letter isn't ott at all.

With the greatest of respect to ilove do not send that letter unless you want to kill entirely any relationship you have with the school.

Lovewine - I think your advice is spot on, well done. I note you've written "in early course" in your letter- is that something you can say? I'm not saying it's wrong, but that I might want to add it to my list of phrases. I usually use, and see "at your earliest convenience" (when I need to be very polite) or "as soon as possible". I use "in due course" when it is less urgent.

Hey 5 yes you can say "in early course". I use it when I don't want to use "due course" but don't want to say "in seven days" or similar just to make it clear that I expect a response soon

Well actually inexperience and minimum wage kinda does exactly equal poor quality. A 17yo on minimum wage is much less likely to do polished work than a worker of experience and on decent pay. That's why budget cuts lower standards.

Not the main thrust of the thread I know but reality is that poor standards of employment show themselves in poor quality work.

Thanks for sending details of the news reports love wine, I appreciate you taking the trouble. Data protection can be interesting: who knew?

We can agree to differ on the merits of the letter and your statement that there has been no damage :) I'm with cauliflower.

Fair enough eyelevel I always enjoy a good discussion

Thanks for that, Lovewine. I shall add it to my repertoire!