Help protect children from gaming harms.

Take our survey

Please or to access all these features

AIBU?

Share your dilemmas and get honest opinions from other Mumsnetters.

Is this GDPR breach

652 replies

Harass3d · 01/02/2025 00:16

A complaint has been lodged with my employer about a comment I made on social media (not upheld!). This complaint has come from the head teacher at my son's school and he has identified himself as such (fine) but then goes on to identify me as a parent (which has no relevance to his complaint) am I right in thinking this is a breach of GDPR? It is no business of my employers where my son goes to school.

OP posts:
Thread gallery
5
thiswilloutme · 01/02/2025 12:33

Oioisavaloy27 · 01/02/2025 11:11

He is not going to risk his job for no reason.

unless the OP is quite correct and he really is useless and the school is a shambles......

I was a teacher, known some fabulous heads, but the odd one was a narcissistic nightmare and definitely unable to handle criticism....

AnSolas · 01/02/2025 12:34

noblegiraffe · 01/02/2025 11:52

Data protection laws involve a security breach. Looking at someone's employer details on Linked-in doesn't involve a security breach. There is no expectation of privacy for data that you have chosen to publish on a public forum.

The Head teacher located/obtained the personal data however had no permission (one lawful reason) to collect the OP's data, store the data nor use the data.

Once the Teacher obtaines the data it falls with in the Schools data policy. One of which would be to safely store the data and maintain the privacy of both the OP and the OP's son.

The Head created the security breach by sending out the letter.

gingerlybread · 01/02/2025 12:34

@GlasgowGal82 he could write in his personal capacity explaining that he works as a headteacher and that she is attacking him personally.
I don't think this is inappropriate at all and no breach of GDPR- if she is an NHS health professional he could write to eg. Grampian or Highland HR department. There's no doubt that he is actually employed in the school and since she outed herself as a parent in the chat that's in the public domain. The child isn't identified here. He is writing to suggest that she may be breaking her work code of conduct, which is what the police may have advised because essentially they have no right to police what's said on a closed group, unless it's extremely offensive.

noblegiraffe · 01/02/2025 12:35

Boohoo76 · 01/02/2025 12:31

I never said that it was. Where did I say that? But it doesn’t mean that you obtain personal information from publicly available sources and do whatever you want with it. I can’t obtain people’s names and addresses from 192.com and do whatever I want with them. In some cases my use may be lawful and in others it may not be.

No, you can't, but not because you're a data processor under GDPR (unless you are doing it for a company but we are talking about you, personally acting as an individual), but because of other laws, like stalking or malicious communication.

Harass3d · 01/02/2025 12:36

Okay feel I need to clear some points up.

I am not "professional" enough for my employer (and exact department) to be found from a google search of my name. I don't have a linked in profile. I am not clinical nor am I registered with any governing bodies. I am not bind by any SSSC codes.

I have never had a complaint made to my employer about my SM use, never. I have never had a complaint raised about me in all my time there for any reason.

I rarely, use SM. This was actually very out of character for me. I have cooperated fully with my employer and offered to show them the entire post and not just the screenshot of my comment - which they viewed.

I cannot post the full details of why I have come to the conclusion about the HT/school but I have my reasons. I won't back down from this opinion and I absolutely would stand in a room full of people and tell them that this was my thoughts/opinion. I had raised my concerns through the correct channel with no resolution up until this point.

Why he has chosen to come at me, I honestly don't know. Possibly because they thought they could make an example out of me given my employer, who knows.

I am not seeking to "sue" him nor the school. I want him to redact the false claims he has made about me to my employer and that's it.

OP posts:
Katrinawaves · 01/02/2025 12:37

noblegiraffe · 01/02/2025 12:32

I get what you are saying about professional capacity, but if (and we don't know) the OP identified herself as a parent of a child at the school in e.g. social media posts and it didn't require any special headteacher knowledge to know this, then what data has been breached?

I'm not defending what the HT did, btw.

Well we do know this because the OP herself has said that neither she nor the person on whose post she was commenting named either the school or the headteacher and the OP also said she did not say in her comment that her child was a pupil at the unnamed school. So why are you still arguing this point?

peachystormy · 01/02/2025 12:37

Harass3d · 01/02/2025 00:44

For clarity, I never named him and actually the post itself never even indicated what school they were ranting about.

Thanks all of to check with Ofsted

That's shocking! I wonder who ss it to the head. I would definitely take it further

thiswilloutme · 01/02/2025 12:37

Cerealkiller4U · 01/02/2025 12:24

What false claims did he make.

READ the OPs POSTS! It's easy to filter, either on the MN website or on the app. You will then see what the false claims were. Because they are false the OP will easily be able to prove them false.

Seems to me that he might actually be confusing her with someone else.....

HotCrossBunplease · 01/02/2025 12:38

Harass3d · 01/02/2025 12:36

Okay feel I need to clear some points up.

I am not "professional" enough for my employer (and exact department) to be found from a google search of my name. I don't have a linked in profile. I am not clinical nor am I registered with any governing bodies. I am not bind by any SSSC codes.

I have never had a complaint made to my employer about my SM use, never. I have never had a complaint raised about me in all my time there for any reason.

I rarely, use SM. This was actually very out of character for me. I have cooperated fully with my employer and offered to show them the entire post and not just the screenshot of my comment - which they viewed.

I cannot post the full details of why I have come to the conclusion about the HT/school but I have my reasons. I won't back down from this opinion and I absolutely would stand in a room full of people and tell them that this was my thoughts/opinion. I had raised my concerns through the correct channel with no resolution up until this point.

Why he has chosen to come at me, I honestly don't know. Possibly because they thought they could make an example out of me given my employer, who knows.

I am not seeking to "sue" him nor the school. I want him to redact the false claims he has made about me to my employer and that's it.

Why did he say you’d be unemployable in education?

GoBackToTheStart · 01/02/2025 12:39

Me looking up someone's employer on linked in doesn't make me a data controller or processor

If you are accessing LinkedIn as an individual then you're covered by the personal/household activity exemption, so it's irrelevant.

If you're capturing data for your employer then it's your employer that will be a data controller, not a processor (because they're selecting the means/content/purpose etc of collection, not processing it on behalf of LinkedIn or another controller).

Seagullsandclouds · 01/02/2025 12:41

thiswilloutme · 01/02/2025 12:37

READ the OPs POSTS! It's easy to filter, either on the MN website or on the app. You will then see what the false claims were. Because they are false the OP will easily be able to prove them false.

Seems to me that he might actually be confusing her with someone else.....

I wondered the same, if the head has confused OP with someone else.

Puzzledandpissedoff · 01/02/2025 12:44

I have never had a complaint made to my employer about my SM use, never. I have never had a complaint raised about me in all my time there for any reason

In that case I'm wondering what caused you to write "there are A LOT of false claims made against me which I need to address", @Harass3d?

Boohoo76 · 01/02/2025 12:44

noblegiraffe · 01/02/2025 12:35

No, you can't, but not because you're a data processor under GDPR (unless you are doing it for a company but we are talking about you, personally acting as an individual), but because of other laws, like stalking or malicious communication.

Where did I say I was doing it as an individual? This thread is not about someone processing data as an individual. It’s about a headteacher acting in a professional capacity.

Harass3d · 01/02/2025 12:45

Puzzledandpissedoff · 01/02/2025 12:44

I have never had a complaint made to my employer about my SM use, never. I have never had a complaint raised about me in all my time there for any reason

In that case I'm wondering what caused you to write "there are A LOT of false claims made against me which I need to address", @Harass3d?

Sorry I meant within his complaint he has made alot of false allegations not that I have had several false allegations made about me to my work

OP posts:
Happysack · 01/02/2025 12:45

Boohoo76 · 01/02/2025 10:28

And that would still be a GDPR breach. Personally identifiable information includes information you use with other information to identify an individual. You can’t just use the personal information for any reason whatsoever. There is no lawful basis here for using the OP’s personal information.

I think it’s much more likely that HT was sent the screenshot, took OPs name from it, then searched FB - perhaps for the offending thread to see what else came up.

I bet OP has their work information on FB like so many do - and that’s where the HT got it from.

There’s no evidence they used any data from the school records to contact OP’s work.

noblegiraffe · 01/02/2025 12:46

Boohoo76 · 01/02/2025 12:44

Where did I say I was doing it as an individual? This thread is not about someone processing data as an individual. It’s about a headteacher acting in a professional capacity.

You said "I can’t obtain people’s names and addresses from 192.com and do whatever I want with them."

Did you mean to say 'If I were a headteacher working in a professional capacity I can't....'?

FlowerUser · 01/02/2025 12:47

Harass3d · 01/02/2025 12:36

Okay feel I need to clear some points up.

I am not "professional" enough for my employer (and exact department) to be found from a google search of my name. I don't have a linked in profile. I am not clinical nor am I registered with any governing bodies. I am not bind by any SSSC codes.

I have never had a complaint made to my employer about my SM use, never. I have never had a complaint raised about me in all my time there for any reason.

I rarely, use SM. This was actually very out of character for me. I have cooperated fully with my employer and offered to show them the entire post and not just the screenshot of my comment - which they viewed.

I cannot post the full details of why I have come to the conclusion about the HT/school but I have my reasons. I won't back down from this opinion and I absolutely would stand in a room full of people and tell them that this was my thoughts/opinion. I had raised my concerns through the correct channel with no resolution up until this point.

Why he has chosen to come at me, I honestly don't know. Possibly because they thought they could make an example out of me given my employer, who knows.

I am not seeking to "sue" him nor the school. I want him to redact the false claims he has made about me to my employer and that's it.

I would recommend you get a subject data access request about you from the school. The ICO has a form you can use. That way you can see what he has been saying about you to teachers and to others, including the letter he sent to your employer. It's unlikely he made those claims about you without discussing it with some other person at the school. Then you can use that information to ensure he doesn't repeat the accusations and to report him to the LA.

Harass3d · 01/02/2025 12:49

Happysack · 01/02/2025 12:45

I think it’s much more likely that HT was sent the screenshot, took OPs name from it, then searched FB - perhaps for the offending thread to see what else came up.

I bet OP has their work information on FB like so many do - and that’s where the HT got it from.

There’s no evidence they used any data from the school records to contact OP’s work.

Tell me you've not read the OPs posts without telling me 🙄🫠 I don't have and never have had my employer on FB or anywhere else online!!

OP posts:
Katrinawaves · 01/02/2025 12:50

Happysack · 01/02/2025 12:45

I think it’s much more likely that HT was sent the screenshot, took OPs name from it, then searched FB - perhaps for the offending thread to see what else came up.

I bet OP has their work information on FB like so many do - and that’s where the HT got it from.

There’s no evidence they used any data from the school records to contact OP’s work.

Even though the OP had said explicitly upthread that she does not have her employer on social media profile and has never posted about her work?

This thread is completely doing my head in! So many people gaslighting the OP and posting completely shit about what the law is and isn’t and making up all kinds of things to frighten her which just aren’t true!

Boohoo76 · 01/02/2025 12:52

noblegiraffe · 01/02/2025 12:46

You said "I can’t obtain people’s names and addresses from 192.com and do whatever I want with them."

Did you mean to say 'If I were a headteacher working in a professional capacity I can't....'?

I also said that it depends on what “I” did with the information once I obtained it. “I” doesn’t necessarily mean that I was referring to using it in a personal capacity. And given that we are talking about a headteacher acting in a professional capacity, I think it is reasonable to assume that I was talking about acting in a professional capacity. I’m not sure what you are seeking to achieve by trying to catch me out?!

BobbyBiscuits · 01/02/2025 12:53

The head teacher is an arsehole. He's told your employer 'this woman who's kid goes to my school has put a message on her friends Facebook page saying she thinks I'm useless and the school sucks'.
The employers response would be 'well, I suggest you take that up with her.'
Or, more amusingly 'well, is it true?'
He's clearly made himself look an absolute fool.
You should ask him how he found out where you work. If what you say is true, that there's no evidence of it publicly, then he has breached by lifting it from school records.
The school could only ever contact the employer in an emergency to try and reach you, if your mobile wasn't working or getting answered. Not for any other purpose.

AnSolas · 01/02/2025 12:53

gingerlybread · 01/02/2025 12:27

@GlasgowGal82 @noblegiraffe

It's the parents right to participate in a discussion about their child's school. They are acting in a personal capacity so it is not a data breach. The HT wrote to the OP's employer introducing themselves in a professional capacity, told the employer that OP's child was a pupil at their school and in doing so breached the child's privacy!

I don't think this applies here. The HT could have written in a person capacity to say she has damaged his reputation as a professional without mentioning the child at all. If there are more than 50 children at the school they won't be identifiable and there's no breach.

Problem being that the opening post clearly states that Head documented the OP has a child and that the child attends a particular school.

The employer may have up to that date have no data on the OP having a child.
The reason the Head knows about and can link her child to the post is via his professional capacity.

Curtainqueen · 01/02/2025 12:53

Harass3d · 01/02/2025 12:36

Okay feel I need to clear some points up.

I am not "professional" enough for my employer (and exact department) to be found from a google search of my name. I don't have a linked in profile. I am not clinical nor am I registered with any governing bodies. I am not bind by any SSSC codes.

I have never had a complaint made to my employer about my SM use, never. I have never had a complaint raised about me in all my time there for any reason.

I rarely, use SM. This was actually very out of character for me. I have cooperated fully with my employer and offered to show them the entire post and not just the screenshot of my comment - which they viewed.

I cannot post the full details of why I have come to the conclusion about the HT/school but I have my reasons. I won't back down from this opinion and I absolutely would stand in a room full of people and tell them that this was my thoughts/opinion. I had raised my concerns through the correct channel with no resolution up until this point.

Why he has chosen to come at me, I honestly don't know. Possibly because they thought they could make an example out of me given my employer, who knows.

I am not seeking to "sue" him nor the school. I want him to redact the false claims he has made about me to my employer and that's it.

Perhaps he thought his professional character was being attacked.

Harass3d · 01/02/2025 12:54

HotCrossBunplease · 01/02/2025 12:38

Why did he say you’d be unemployable in education?

How would I know why he has made this claim? Apparently based on this one comment from social media.

OP posts:
ThatsNotMyTeen · 01/02/2025 12:55

DowntonNabby · 01/02/2025 11:10

I haven't made anything up. Like other PP I've just speculated on what could have prompted the HT to take such an extreme step. It suggests he thinks the comment WAS false and defamatory.

Because he thinks it, doesn’t mean it was

it is abundantly clear from postings on this thread that many people don’t have a clue what defamation actually is