My contact details being shared with DS’s class

[NameChangerDanger]

DS recently started primary school. There’s a WhatsApp parents group that I’m a member of, but have no inclination to actively use.

A message has come through from one of the parents saying that it’s assumed we’re all ok with our details being compiled into a list and put into book bags

Another parent has asked what details this will include and it’s child’s full name, parent’s full name, contact number and e-mail address. It’s going to be sent out tomorrow or the next day unless people actively object.

I am really quite annoyed by this. My mobile number is obviously available via the WhatsApp group, but I haven’t given my e-mail address out to everyone on the list or given permission for this list to be created. AIBU?

NameChangerDanger so the potential abductor doesn't know the parent's number but is walking along the pavement and finds the discarded list, after which he has all the information to make the call? Not entirely impossible I suppose but if this was the plot of a movie it would be utterly silly.

And of course it matters that the level of the risk is ridiculously low. How else to assess risk than by assessing it's likelihood and severity? Add to this that communication lists have the advantage of allowing people to communicate, which is a significant benefit in this context of parents who may want to welcome new kids to the school, or organize social events, or organize fundraisers, etc., all of which bring significant benefits, and it is even more reasonable to discount the risk.

I mean if you are going to imagine possible but entirely improbable risks how about a situation where another parent could prevent harm to your DC only if they could call you, but you refused to give your number so now they can't.

Emails, names, numbers etc. absolutely count as personal data. If the school is providing this (I assume they are as they are putting it in the bookbags?) then they need consent. Non-reply doesn't count as consent. Not all data controllers need to register with the ICO (and pay the data protection fee) to the PPs who mentioned that, there are certain exemptions but I am not sure what the exemptions are; you'd have to check with them. I assume a school would be included. If it's just a parent doing this alone then I'm not sure of the legal ramifications but I would think it's a very bad idea regardless to use people's data this way without permission, bearing in mind that people might have personal reasons for wanting this info kept private (safeguarding reasons etc).

This is hilarious. Our school is the opposite - not only will they not even tell us the first names of the children in the class, but they insist that parents have to actively sign up to be part of a class WhatsApp group but point blank refuse to provide any kind of help for this process. It's not clear to me why the school can't include GDPR info processes in their initial registration forms or via the book bags or school email forms (we have online forms for consent for class trips etc). But no, for the class WhatsApp groups etc, it has to be organised entirely by the parents, has to be done in physical writing (I think they'd like it in blood if they could) and all done blind.

OP, I honestly think the worry about handing out your email address is overblown but just say no. And yes, for all that I think MY school goes too far, if your school is handing out this data willy nilly, you should absolutely b e having a word with them.

Middle ground people. Surely there's a good middle ground?!

Booboostwo I’ve seen this sort of thing happen. Not in a school context, but vulnerable people.

You said yourself severity is a part of the calculation, well it doesn’t come more severe. If it’s possible to manage the risk, it should therefore be managed.

It really doesn’t have to be such a dilemma. Too much overthinking. We always had these starting from pre-school. Email is actually the most convenient way to distribute information from the class reps, PTA, school help. The list is also useful or birthday parties until you learn who everyone is. It’s not like you’ll be bombarded with SPAM emails.
It’s first year at primary school, the chances of the list getting lost are minimal. List goes in school bag, child gets home, parent checks bag same day.

Just say you don't want to be included. Easy. No point in waiting until there's been a breach of GDPR or bitching that there might be.

FWIW my DC are much older now but I've always found a huge amount of value in being connected by phone/email with other parents.

Aside from the obvious play dates/parties/pick ups facilitation when they're younger, as they've got older and spent more time independently knowing how to get in touch with parents had been both helpful and reassuring.

And have we actually had all these potential dooms day scenarios in this particular context before GDPR was introduced and followed?

This is bizarre. Both schools that my DDs attended had a directory with parents’ names, email addresses and phone numbers. People agreed to this willingly. DD1’s school had the children of a very famous actor and a member of a Girl band and DD2’s had an EastEnders actor and an 80s popstar among the parents - all contributed their details. I was quite surprised!

Oh op come now are you really suggesting that you can't imagine a data breach leading to more risk than that which involves your child's name and your email address

I always kept away from these things too. For us pre internet it was a printed document in the bag. You don't have to do it, and why join the group and give your number if you have no intention of using it

I've always found these lists super useful for all reasons others have mentioned. Say you don't want to be on the list OP and go and enjoy your life of privacy, just accept you/your child may miss out on some things

Could you suggest that they make it opt-in rather than opt-out when you reply? That might make it a little less intense and avoid anyone who missed the message having their details included unexpectedly.

Emails, names, numbers etc. absolutely count as personal data

Do you have a link to the legislation that says that email addreses count as personal data please @dayslikethese1 ?

My DCs old school sent an email with all parents email addresses visible and I tried to find a definitive answer on whether this was a breach before contacting them and couldn't find anything that clearly said it was so in the end I didn't raise it with them

This is a bit weird to me only because I've never heard of anything like this being done at DC schools but surely if you are a member of a parents WhatsApp then they already have your name and number? If you don't want them to have your e-mail address then just reply "name and number is fine but I won't be passing on my e-mail address thanks" (personally I'd prefer someone have my e-mail rather than my phone number). I think it's a good idea in case there are ever any issues with bullying or other problems where parents need to contact each other directly.

You are being massively U.

Just decline. It has nothing to do with GDPR if it's done privately by parents. How hard is it to state that you don't want to be included in the list.

For most of us, other parents contact details are useful, and class groups even more so. I much prefer a Facebook group to a whatsap one personally, there's a search option and you don't need to scroll through tens of irrelevant messages to find one bit of info. I just decline to share my mobile number with 58 people, it's that easy.

People should stop calling "GDPR" for everything, it doesn't quite work like that

out of interest what are the unsavoury things one could do with this information should the list fall out of a bookbag?

My kids are 15 and 18 now and old enough to decide who they want their data giving to but a few scenarios from when they were at primary.

1. Dh is a secondary/college teacher. He used to teach in an area that wasn't known for having supportive parents. We were ex directory so that pparetns couldn't get our phone number. If our kids were at school in the same area a younger sibling could pass our contact info on.

1. Ds used to have a boy in his class at school whose father was a psychiatrist. He had a very unusual foreign surname. One day hs mother realised tshe and the kids were being followed around town by a disgrunted patient of her husband's. Someone who is mentally ill/holds a grudge could get hold of concact details and cause problems.

GDPR only applies to businesses and organisations, not individuals. Email addresses are included if they identify the individual. for example my work address could be come.from @ away.co.uk

I would be objecting to this. Both from a personal details pov, as well as the fact that it's not opt in.

My DC are at risk in these situations. We have a family member who should not find out about which class they're in, no confirmation about whether they're a student etc.

I always hate the idiots here saying " oh stop being a doom monger" etc, you have no idea of any one else's situations.

We've briefed the school well in case my family member ever tried to get confirmation of school attendance etc (which isn't that hard to do really due to the catchment area), they would need to call the police and us immediately as there's a potential risk to both children and staff on site. Not an emergency unless they showed up, but enough to warrant police involvement and advice immediately.

My child's full (hyphenated, v unique surname) alongside what school and what class on random bits of paper, being distributed out to everyone..?! This is not on.

I always hate the idiots here saying " oh stop being a doom monger" etc, you have no idea of any one else's situations.

IF and when parents are that bothered, and for a valid reason, they have strict measures in place. That is perfectly respectable.

Parents who suddenly call the GDPR card for their email - but are happy for name and phone number to be disclosed for example, are harder to take seriously.

in your example, unless you have made it very clear, you do know that your kid's name is potentially on the list of every parent who throws a class party, or whose child writes a christmas class to everyone?
If you are happy with one, but not the other, it makes no sense, that's what I am trying to say.

To be clear, I have said no. I didn’t need MN’s advice to do that!

NoraThePessimist I’m sorry you have to take such special measures to keep your DC safe, it must be an awful and stressful situation to be in. I mean this in the most sincere way possible, I am not being sarcastic.
But why would you call people ‘idiots’ ?

I think whether it’s “better” to be on the list or not all comes down to personal preference and individual circumstances.

The problem is the opt out arrangement. That’s why I’m annoyed. It’s careless. GDPR is a pain in the backside in many instances, but it is there for a reason. I’d still be annoyed if GDPR were not a thing.

I’ve had to unravel messes before where the sender of personal info “couldn’t understand what the problem was”.

out of interest what are the unsavoury things one could do with this information should the list fall out of a bookbag?

There was the daughter of a town policeman in my dd's class. They didn't want his address and phone number out there. I loved those directories and had no problem having my details in them but I can well understand why another person would not. It should be very explicitly opt-in. I think you should have to sign a release (we always did).

We had similar at my DC's school. I emailed straight back and said no to the email address. Like you they already had my number from the whatsapp group but they don't need to know every contact detail I have, I'm sure there's nothing that urgent that they need to get to me.

Gosh the level of paranoia on here is astonishing. I totally get that for some people it is really important that their details aren't shared, but for the vast majority of parents that's not the case.

Two of the secondary schools I have dealings with circulate the whole year group details. The vast majority of parents are listed in full, with address, email and phone number. And that includes some big household names who don't seem to have a problem.