Active discussions

Meet the Other Phone. A phone that grows with your child.

Meet the Other Phone.
A phone that grows with your child.

Buy now

Please or to access all these features

Talk
AIBU?

Share your dilemmas and get honest opinions from other Mumsnetters.

Original poster

What does the school have to do now?

140 replies

MrsDylanBlue · 27/05/2018 17:04

My data protection consent form arrived from DS2 school yday.

It contained the slip along with a form which had my address, DS2 dad’s address and his mother’s (who is emergency contact) and phone numbers, our with our Drs info and DS2 medical info and all three of my children’s full names and dates of birth.

The envelope was unsealed and the flap hadn’t even been folded down meaning any number of people may have read it and replaced it.

I have emailed the school alerting them to this and asking them to follow their data protection breach policy.

Can anyone tell me what they need to do now (obvs after half term!). Do they need to contact everyone whose data protection has been breached etc?

OP posts:
stoneagemum · 27/05/2018 19:30

Ok your worrying over an unsealed envelope, isn't the bigger question did Dad & Gran consent to their data being shared with you?

scrumples · 27/05/2018 19:33

This reply has been deleted

Message withdrawn at poster's request.

SmileEachDay · 27/05/2018 19:36

Hm.

Having thought about this, I’m really surprised that anything confidential was sent through the post in a non recorded format - otherwise there is no way to find out if data has been lost/gone astray. We’ve changed practice to sending any confidential personal data by recorded delivery.

Why did the school send the information to you?

ICantCopeAnymore · 27/05/2018 19:38

It didn't "float around town". It would have gone from school to the sorting office, then to your home.

At least you know one thing, OP. You're lucky enough to have this to worry about instead of an actual real problem..

scrumples · 27/05/2018 19:41

This reply has been deleted

Message withdrawn at poster's request.

SmileEachDay · 27/05/2018 19:48

I dunno scrumples - I’d say medical info falls under “higher sensitivity” - so recorded delivery is more appropriate.

llangennith · 27/05/2018 19:49

No matter how many people tell OP to get over herself she’s not listening. Why ask AIBU and then ignore the response and keep on and on about it?

SmileEachDay · 27/05/2018 19:49

I just don’t understand why the actual information needed sending in the first place.

Dermymc · 27/05/2018 19:51

If someone really wanted the data they could just take the whole envelope surely?!

Better stop sending any sort of communication about anything because of GDPR Hmm

Anasnake · 27/05/2018 19:51

For GDPR smile

BoneyBackJefferson · 27/05/2018 19:54

As I see it
The OP reports the potential data breach.

The school needs to report 72 hours after they have been made aware

The clock could start on Tuesday 28th or Monday 4th June depending on the office staffing and whose email she sends it too.

The school reports to ICO. (if they have to).

ICO says review your procedures.

School reviews their procedures and envelopes get stuck down.

The end.

SmileEachDay · 27/05/2018 19:57

Ana - I know that - but if it was an opt in “do we have permission to hol your data” thing, I don’t understand why it wasn’t just a generic “is it ok for us to hold contact details/medical info/etc” form?

I don’t understand why they sent the actual details.

scrumples · 27/05/2018 19:58

This reply has been deleted

Message withdrawn at poster's request.

scrumples · 27/05/2018 19:59

This reply has been deleted

Message withdrawn at poster's request.

scrumples · 27/05/2018 19:59

This reply has been deleted

Message withdrawn at poster's request.

SmileEachDay · 27/05/2018 20:00

😂😂😂 I bet someone has a gdpr kink

scrumples · 27/05/2018 20:00

This reply has been deleted

Message withdrawn at poster's request.

Aragog · 27/05/2018 20:01

I have emailed the school alerting them to this and asking them to follow their data protection breach policy.

Isn't a near miss or potential breach, rather than an actual breach?

Can anyone tell me what they need to do now (obvs after half term!). Do they need to contact everyone whose data protection has been breached etc?

You dot know if anyone else has been affected. Sound more like they just accidentally missed one letter put of however many, I guess potentially several hundred if a secondary school. So, base don what you know, the only person with a potential breach is yourself - and they don't need to notify you as you already know!

Do you have any evidence it is likely to have been breached? You can normally tell if an envelope has had something removed and replaced in my experience, even if it was unsealed originally.

scrumples · 27/05/2018 20:03

This reply has been deleted

Message withdrawn at poster's request.

LyndaLaHughes · 27/05/2018 20:05

OP: "AIBU?
All of mumsnet: "Yes"
I think you have your answer. You've let them know- they will address it and apologise. What more do you want them to do? What do you have to gain from pushing this agenda any further? Please let it go.

SmileEachDay · 27/05/2018 20:06

If the health info has been provided by an outside agency they might?

Oh I don’t know.

I really want to know why they sent the info.

SweetCheeks1980 · 27/05/2018 20:08

I am not sure what you're getting so angry about?
Did it have the results from the sexual health clinic in it and now you can't look the postie in the eye cos he knows you have warts

titchy · 27/05/2018 20:08

But it wasn't floated around town for a few days Confused Or do you think the staff at the local sorting office had a look?

CageyBee · 27/05/2018 20:14

GDPR has just come into effect and OP has proven themselves to be “one of those” within minutes. OP definitely is a troublemaker who has a problem with the school or a general inferiority complex.

AtomicP · 27/05/2018 20:19

The Data Protectiom act was always around before GDPR and barely and bothered