Email Privacy

[newtownstarling]

Hoping someone can help. I recently emailed my local authority with a complaint. They then must have passed this email on to the individual involved. The complaints department haven't actually come back to me as of yet.
I have now received an email from the individual involved, replying to the one I'd sent to complaints dept. He has also cc'd in several other people, some who I don't know, and some who I do know/have dealt with and who I'd rather not know the details of my original email which is included in the one he sent. I'm pretty annoyed and just want to know if I have grounds to complain further? I know that you should be wary with emails as they are potentially out there for all to see, however I was under the impression that you were supposed to ask permission before passing on any info?
This is the second time he has done this so it's not a mistake.

Thanks for reading if you followed all that!

I have no idea what is right or wrong about forwarding an email but I am posting so I can follow this and learn.
GDPR seems to have some rules about this.

Are you saying you emailed the LA to complain about a person in the LA and it was passed on? Depends, because it is the same organisation. But information sharing is on a strict need-to-know basis. The individual involved has a right to know who is complaining and what the complaint is, but not necessarily your contact details. Have you read the LA complaints procedure? That should give guidance.

But if you emailed the LA and they passed it on to eg an outside contractor, then that's a breach of GDPR.

My understanding is that if you emailed then as an individual to make a complaint I would expect the complaints department to contact you after an investigation. Under GDPR your personal indentifying information should not have been passed onto anyone without your authority. Can you email address identify you? Does it contain your name. On your email did you quote your full name and address, if so and they forwarded the email on without your permission that I feel they have broken the rules. I would do another email compliant headed GDPR breach and tell them what’s happened and see what they say. Last resort is reporting it to the information commissioners office as a breach

Yes I emailed the LA because of a particular person and also their entire department, and the email was passed on to them, which is fine, however this person has now taken it and distributed it to other people in the LA who I didn't really want to know about this. I don't want to out myself too much but basically passed on my original email to teachers who obviously are employed by the LA, but don't work in the head office and don't have any need to be seeing my email. You know how people can gossip... I wouldn't have given permission for them to see it as it doesn't concern them AT ALL.

Was the person you complained about a member of the LA? Or a third party?

They work for the LA

No not a third party

Yes, your update post is a breach of GDPR

Ooh the second lot of passing it on is dodgy. Especially as it had your contact details on.
I’d say you have grounds for a GDPR breach. Report to their GDPR rep and watch them shit themselves.
I work local authority and since the new GDPR came in, we have been told to never forward/reply emails in case it creates an email chain with personal details.
Sharing your email would be a huge no no!

Yes, my email address is my full name and it identifies me, but I didn't give any other info such as my address. It does however give my son's full name and the school he attends.

They might try to get away with it by saying that it was still kept within the organisation but that won’t hold up to scrutiny.
They’ve screwed up and had the kindness/stupidity to forward you the evidence

Thanks Nesssie

I will definitely complain again then. The organisation in question is the most disorganised and incompetent place I have ever had the misfortune to come across. Even the complaints department doesn't respond to emails half the time.

Completely forgot to mention the reason for my original complaint (trying not to give away too much info). I had sent a physical letter by recorded delivery to their offices, I tracked it and it was signed for by a member of staff. They now can't find the letter and it contains info such as my full address, childs name and school, plus private details about his health. Would this also be a GDPR breach? Thanks

Usually, the person being complained about or their manager about should respond to the first complaint. If you are still dissatisfied it should be passed further up the line. Ask to see their complaints procedure.

If you had complained about a third party it would be a different matter.

Reading between the lines... You have complained about school. - to get a response you have to follow the school complaints procedure... Which typically escalates through school to the head to the chair of governors. - if you try to bypass this it is simply returned back down the chain. Even if you send a complaint direct to Ofsted if it's not gone via the school the don't do anything. (Safeguarding is a different policy and treated differently). So sending to the LA won't mean they deal with it as it's a school matter.

Hi user - no I've not complained about a school at all. I've complained about an incompetent individual at the local authority who has been ignoring emails and letters that I've been sending and as a consequence my ds has not received the correct support from them.

If I were you I would ring the ICO and ask them. They will be able to give you advice on how to proceed.

ico.org.uk/global/contact-us/

The LA and all of its employees will have had quite recent GDPR training. Some of what you have detailed breached Data Protection Act prior to GDPR anyway!

Thanks Curious - that's really helpful. I'll get in touch with them.

No problem. I run a small, very niche business and have always found the ICO really helpful!