Is this GDPR breach

[Harass3d]

A complaint has been lodged with my employer about a comment I made on social media (not upheld!). This complaint has come from the head teacher at my son's school and he has identified himself as such (fine) but then goes on to identify me as a parent (which has no relevance to his complaint) am I right in thinking this is a breach of GDPR? It is no business of my employers where my son goes to school.

Read the OP’s posts! The letter from the Head to the employer said OP had previously had a complaint about her SM use upheld (which is untrue), inferred she was unfit to work with children and according to the OP made several other untrue and unfounded claims about her which she hasn’t specified on the thread.

This thread sums up nicely why we are in such a mess in the UK.

Perhaps instead of criticising individuals publicly on social media, following the procedures for complaints would have been a more productive way to highlight concerns.

You don’t seem to acknowledge your very naive (or arrogant) part in this. It’s never a bad thing to look outside the box at the bigger picture and possible implications.

Whichever way you want to dress it, you have publicly (social media is not private) shamed the HT and his school.

He is rightly upset (wouldn’t you be!?), but due to his retaliation, the only issue I would be focusing on now is considering moving my son to a different school, because this could potentially have a negative impact on him.

The data breach which the Head has committed is also telling the OP’s employer that the child is a pupil at his school. It doesn’t matter that the employer could have known this or worked it out. It’s still a data breach to tell them. Just like a doctor cannot tell anyone you’ve broken your leg without your consent even if you are hobbling around in a cast and it would be blindingly obvious to anyone who saw you.

This^

I was told by the compliance officer, never ever write down something you wouldn't want to later read out in court

Think before you write anything, be it an email, on paper or on SM

as it can land you in a whole heap of trouble

There must be a lawful basis for using it - there are six lawful bases set out in the GDPR

GDPR covers the correct usage of information held about the pupil/parent in the school database.

GDPR doesn't cover stuff that you can google about someone.

So if I googled 'Boohoo76' and found that you had an account under the same name on Substack with your real name attached and then googled your real name to find you on Linked in and got your employer's details from that, none of that is covered by GDPR.

I work in a school and have to contact multiple parents daily - frequently the same ones.

Unless the kids tell me where their parents work or I know them personally, name of workplace isn't identified on the system.

Obviously I don't know what system your school uses, but for a staff member at my school to find out where you work, they would have to check your contact numbers and Google the work number if you had one, or look you up on Linked In to get that info.

So it definitely seems as though the head has gone above and beyond to track down your employer (and not in a good way).

Of course it's a data breach. If someone called the school and asked "does Op's son attend here" the school wouldn't be permitted to say "yes", in the same way a hotel can't come out and say "yes Op is staying here". It's information that is attributable to an identifiable living person, so they are restricted with what they can do with it, even setting safeguarding aside (which is another relevant issue).

The head used his professional capacity (by signing as the head) to disclose personal data about Op (she's a parent at the school) and her child (a pupil of the school) to a third party without legitimate purpose or consent. That's already a breach, even without going into her records to find her employer's information.

Information doesn't have to be secret to be personal data.

I would have thought that the most likely source for the information about where OP works, is the person who sent the screenshot to the head.

It's that not obvious?

I don't think this is a data breach but you should come at this more from a complaint about professional standards. A headteacher should never be making a complaint to a parents employer over a social media post, that is highly inappropriate. You should complain to the chair of governors as this is a professional breach.

Regarding accessing your child's records, there is no way of tracking who did that. Admin staff, teachers can access any child's record at any time and these are not recorded in any way.

Absolutely!

Just about everyone here is fixating on the wrong issue - which is how the Head knew where the OP worked and whether that was recorded on school files. That’s a total red herring and completely irrelevant as that’s not the actionable data breach!

The data breach (which is a serious one) relates to the child not the OP and it lies in disclosing to an adult who had no need to know this information, which school the child attends.

What are you hoping to get out of this?

I agree that if the head said false things about you, that needs to rectified.

But then what? You said you don't have any other schooling options...and your relationship with the SLT is broken(? I think?) so how to resolve issues you do have with the school. You'll need to tread carefully and follow the process so you don't appear vexatious.

You son is the priority here.

You are wrong. It doesn’t matter how they obtained it. The GDPR and the Data Protection Act 2018 are concerned with personal data. Just because personal data is publicly available doesn’t mean that it’s not personal data. You can’t just find out personal data about a person and use it for whatever means you want. That’s the whole point of data protection laws. There needs to be a lawful basis for processing (using) it.

Honestly, you went about this all wrong. It wasn't constructive, it was mean-spirited and it will do your child no good. What you did was slander. Schools are really under pressure now due to poor funding and high turnover. Parents like you have no idea what it's like to work in a school and you add to the problem by grinding down staff.

It's a bit late now to make her child the priority. OP, just move him. You have completely burnt your bridges.

Data protection laws involve a security breach. Looking at someone's employer details on Linked-in doesn't involve a security breach. There is no expectation of privacy for data that you have chosen to publish on a public forum.

Presumably the OP outed themselves as a parent of a child at the school when they went on social media to complain about how they had always found the school to be useless in their dealings with them and all the other parents agreed with them?

There are so many people making false statements about GDPR on this thread it's really alarming! A few points:

• Data doesn't need to be stored in an individual's record for it to be subject to protection on data protection rules. If it's on any work IT system, or a piece of printed paper on a desk or written in a work notebook it is still subject to data protection laws.
• If the data about OP's employment is held by the school then they would need to check and provide assurances that the HT who has written to OP's employer in an official capacity did not use personal data held by the school for purposes other than what is set out in their privacy policy
• Schools will hold personal data of both children and their parents and both are protected by data protection laws.
• GDPR covers the processing of all personal data, that is any data that can be used to identify an individual including their name, address, telephone number, what school they go to, who their employer is.

You are wrong. Data protection laws relate to the use of personal data and whether the use is lawful or not. It therefore depends on the purpose that you are using it for. It’s nothing to do whether it is publicly available or not.

“A name and a corporate email address clearly relates to a particular individual and is therefore personal data.”

The above is taken from the ICO website.

Good lord op didn't you know no one is ever allowed to comment on a school on social media. They even tell you this because some are so deluded they think they have a right to curtail parents freedom of speech

I'd definitely be taking this higher. The ICO have an online chat function that can be useful.

That doesn’t matter.

I can tell anyone I like about my personal data. Doesn’t mean the person holding it can do likewise.

Are you saying that if you joined a Facebook group for sufferers of say IBS, that your doctor could write to your employer without your knowledge or consent to tell them you had poor bowel control?

I'm on SEN SM groups. If I post I never ever give any clues on what school I'm having issues with. I have lots of issues with my LA and post about that, but it's factual so not slanderous.

The groups are private, I don't use my real name ( but it's easy to find who I am, it's not immediately obvious). I also go back and delete most of those posts every few months.

My HT insulted me the very first time he met me with an extremely unprofessional statement which he had to quickly backtrack on. School and governors close ranks. I just refused to meet with him after that. You have this in writing. He sounds incredibly thick and nieve. ICO can be useless as they did nothing when my LA sent me another child's ehcp with medical details in. Nothing came of that.

Follow the school’s complaints process. It should be on their website. If it isn’t resolved to your satisfaction it will go to a governor panel.

It's the parents right to participate in a discussion about their child's school. They are acting in a personal capacity so it is not a data breach. The HT wrote to the OP's employer introducing themselves in a professional capacity, told the employer that OP's child was a pupil at their school and in doing so breached the child's privacy!