Is this GDPR breach

[Harass3d]

A complaint has been lodged with my employer about a comment I made on social media (not upheld!). This complaint has come from the head teacher at my son's school and he has identified himself as such (fine) but then goes on to identify me as a parent (which has no relevance to his complaint) am I right in thinking this is a breach of GDPR? It is no business of my employers where my son goes to school.

I am not a data collector or processor if I look up your employer on Linked-in. Otherwise everyone who uses Linked-in needs to register with the ICO as a data processor.

There may be an issue with this headteacher if he stored or handled this data via school systems, but generally accessing personal data from publicly available sources is not covered by GDPR. It doesn't matter that it's personal data.

My point was rather if the headteacher included a screenshot of the social media post where the person, under their real name was talking about how they were a parent of a child at the school and the headteacher is useless and the school is terrible, then it seems fairly obvious that the person has a child at the school rather than it being a breach of data to say that?

For the millionth time, the fact that the OP’s child is a pupil at his school is not “publicly available data”! It’s personal data held by the headteacher as Data Controller which he has no right to disclose to the OP’s employer. However he found out how to contact the employer.

That might be your point but it’s still wrong as a matter of law.

it’s pretty irrelevant that you personally think this should be OK. It’s not.

You are interrupting a conversation with a different poster about something in particular (we have been discussing obtaining employment details) in order to correct me about something I wasn't talking about.

I've addressed your point in a post to you.

lol at the defamation and libel. One it's not a criminal offence so there won't be any police involved, two it's an opinion and one OP has a right to hold if her child has been let down by the school, not to mention there has to be actual serious harm/loss which is unlikely.

Some painters here sound as deranged as the headteacher

This is not about the looking up of personal data is it though and I never said that it was. I have never once said that you cannot look me up on Linked in or cannot search for me using a search engine due to the GDPR. You are making things up.

GDPR isn’t a beach against one individual. It’s against a company and is the misuse of personal information

its about how corporations handle data. Huge companies.

Saying your name oublically means nothing hence why they didn’t uphold it.

No, you have said that using someone's employment details that you found on Linked-in is governed by the 6 usages specified by GDPR, which it isn't.

It is covered.
One of the reasons you now may get a google message saying there may be more data availble but we cant show it is because GDPR applies to google looking at datadases.

If you are collecting any personal data its covered.
There are provisions which allows the law to class the use of the personal data by one individual as not in the public interest to fill the regulator body / courts with interpersonal fighting

In this case the Head is acting as Head teacher of school against student parent who posted X

In all of my children's schools they've asked for the name and address of our employer for contact during the day in case of emergencies.

However. I would ring the ICO if you’re worried. It won’t be a GDPR breach but they might fine something.

If your job was related to the school, a sister establishment or group, or even children in some way, I'd understand - it wouldn't be nice but I'd see the link.

He's just being a massive bellend. I'd definitely file a complaint against him if nothing else. And I'd be looking to move my kid from the school if possible.

Eh?

The OP’s employer did not uphold the headteacher’s complaint against her because they looked at the social media post and decided (having seen it unlike everyone on this thread) that it didn’t breach their social media policy.

The employer wasn’t deciding on whether the Headteacher had breached the OP’s data privacy rights and had no jurisdiction to do so. That’s for the ICO. The headteacher was acting in his professional capacity not his personal one and using the school’s data. The school having obligations under the GDPR which prevent any of its staff doing this.

And if you educate yourself by looking at the ICO’s website you will very quickly realise that GDPR is ALL about protecting individual’s rights and a breach of a single person’s rights is more than enough for the ICO to get involved.

Gosh you get some weird responses on here these days. I understand from OP’s posts that she made a comment in a private thread saying she thought HT useless, didn’t name him or the school. He got wind of this somehow and emailed her employer claiming she had acted unprofessionally, when she was posting privately and in a personal capacity! I don’t know if he has breached GDPR but he is clearly a complete wanker.

It can be though, it depends what you do with it once you have it. Obtaining personal information on Linked In or other publicly available sites, doesn’t mean that you can do whatever you want with it.

What false claims did he make.

@GlasgowGal82 @noblegiraffe

It's the parents right to participate in a discussion about their child's school. They are acting in a personal capacity so it is not a data breach. The HT wrote to the OP's employer introducing themselves in a professional capacity, told the employer that OP's child was a pupil at their school and in doing so breached the child's privacy!

I don't think this applies here. The HT could have written in a person capacity to say she has damaged his reputation as a professional without mentioning the child at all. If there are more than 50 children at the school they won't be identifiable and there's no breach.

Me looking up someone's employer on linked in doesn't make me a data controller or processor.

OP doesn't say that the headteacher included a screenshot of the social media post. She says:

• The headteacher wrote to her employer and identified himself by his professional role
• The headteacher informed the employer that OP had a child at his school, which is a breach of OP's privacy and more seriously the child's privacy
• The headteacher made a complaint about OP's behaviour on social media to her employer

Given that the HT introduced himself as by his professional role it's a fair assumption he was acting in a professional capacity so he has responsibilities under law to protect the personal information he has come across in the course of doing his job, and that includes information that is not held in formal systems like a pupil record. It is therefore legitimate for OP to write to his employer and ask them to investigate whether there has been a data breach, and if OP is not satisfied with their response to complain to the ICO.

If he'd written as a private individual based on something he'd seen on social media or which had been sent to him by his friend and he happened to know OP worked for the local health board or could find that out without accessing data obtained in the course of his work then GDPR wouldn't come into it, but that is not what happened!

If the headteacher was thick he would not be in the job.

From one of OP’s posts, he falsely claimed "apparently this is not the first time your staff member has had complaints made about her social media usage"

I never said that it was. Where did I say that? But it doesn’t mean that you obtain personal information from publicly available sources and do whatever you want with it. I can’t obtain people’s names and addresses from 192.com and do whatever I want with them. In some cases my use may be lawful and in others it may not be.

No, but if you are already a data processor (as the HT would be) you should not be adding publicly available data to the data you already hold in order to misuse it.

I get what you are saying about professional capacity, but if (and we don't know) the OP identified herself as a parent of a child at the school in e.g. social media posts and it didn't require any special headteacher knowledge to know this, then what data has been breached?

I'm not defending what the HT did, btw.