What does the school have to do now?

[MrsDylanBlue]

My data protection consent form arrived from DS2 school yday.

It contained the slip along with a form which had my address, DS2 dad’s address and his mother’s (who is emergency contact) and phone numbers, our with our Drs info and DS2 medical info and all three of my children’s full names and dates of birth.

The envelope was unsealed and the flap hadn’t even been folded down meaning any number of people may have read it and replaced it.

I have emailed the school alerting them to this and asking them to follow their data protection breach policy.

Can anyone tell me what they need to do now (obvs after half term!). Do they need to contact everyone whose data protection has been breached etc?

*protection

*anyone

Oh Jesus

I'm with you in this too OP.
They can't email you this info due to privacy and safety reasons, so have to post it, which obviously hasn't been any safer in this case. Definitely flag it up with the school.

Near miss. Also it may have been sealed at point of leaving the school and become unsealed, bad glue on envelope. You have reported to the school, they will follow their guideline, appologise etc. What you can do is request that they do not post anything to you in future and that you will collect all communication that may contain data from the school in person.
It was an accident, you are correct to flag it to the school. It may be a whole bunch of bad envelopes, or juat a few missed but now they can review and ensure it doesn't happen in the furture.
That's all that can happen. No compensation, no grand gestures,no firing just an assurance to ensure no repeat.

I'm with you OP.

School need to be more careful with the personal and sensitive information they hold on children and families.

Sounds like they had no real need to send it through the post anyway.

They won't be fined, but they need to review their processes.

Agree with you, OP, very sloppy and there should be a follow up investigation. Also amazed at how slack people are with their personal information. What happens if confidential info about someone who was adopted or in witness protection got out? This is potentially very serious!

No need to be rude. Our school can't and doesn't.

Your school can't email?

Of course it can email, just not sensitive information.

What cataged said.

So it doesn't then.

Smile Re sending confidential info out via normal post as opposed to recorded delivery ** - this is usual practice eg in the NHS. Letters are sent out all the time with medical info, diagnoses, test results on etc. They are marked 'confidential' though.

They wouldn't be able to email it without adding some adding additional security measures such as Egress Switch.

I would rather be emailed to and from a secure email.

I know the NHS won’t donthis though and are the last people in the world still using Fax which is the least insecure method in the world.