Gdpr breach

[Whatsthebl00dypoint]

If your child's school sent out an email CC"ing in over 80 parents with their child's name and parent's email addresses, and it was a specific category of children eg. SEN or Pupil Premium, is that a serious breach of data privacy?

I'm considering whether to make a formal complaint to DD's school since this happened the other day as we have not recieved an official apology or explanation how this was able to happen although it was likely human error. I know mistakes do happen but this seems pretty big for them to remain silent over. There was no sensitive information in the email, just a very general one. But it's the fact that the list of children is very specific and not all families will want this information public for obvious reasons.

That is a serious breach.

At my child's school there were several parents who had very good reason for their email addresses not being in the public domain including:

Parent was a teacher in the local area and didn't want to get emails from parents of children she taught.

Parent was an NHS psychiatrist and had a very unusual surname. Had already been subject to seriously disturbed patients following them & their child around town and trying to contact them personally.

Parent of adopted child whose birth parent was trying to get in contact.

I'm sure there are more.

Sorry I am at work so can't reply properly but wanted to clarify that the recipients list is only those whose children are of that specific group. I won't reveal what but it is considered special category data. The email sent by school office wanted a confirmation reply from the parents whether the email address was accurate. But theres no doubt about the list of children. I know all personal data is sensitive but this really should have been handled with greater care.

I completely agree OP.

Very sad for your colleague but a GDPR breach should be taken seriously. You don’t know the impact of sending out personal details to a large group of people.

A recall isn't enough, the school should be writing out to apologise, confirming the individual will be given extra training and asking parents to delete the reply all responses.

Something similar happened at our school, except it was to parents who hadn't paid fees. It was a nightmare, caused a huge number of issues, the receptionist who did it was fired, parents (understandably) went ballistic! This was about 12 years ago now, but still! I don't think you'd be wrong to complain!

It's worth complaining to a school if they have done something you are not happy with and you can tell them what outcome you want in response to your complaint.
If Op (and probably others) contact the school and ask them to apologise to the parents and they do, probably also saying they will do their best to make sure it doesn't happen again - What further outcome is needed? So why take out a complaint? Just email, ask them to contact the parents to apologise and to give reassurances for the future.

Sounds like something from nothing really.

Since the school’s aware I’d leave it at that.