Is this GDPR breach

[Harass3d]

A complaint has been lodged with my employer about a comment I made on social media (not upheld!). This complaint has come from the head teacher at my son's school and he has identified himself as such (fine) but then goes on to identify me as a parent (which has no relevance to his complaint) am I right in thinking this is a breach of GDPR? It is no business of my employers where my son goes to school.

@Harass3d you would be unemployable by education because they have very high standards on social media. He was just making a comparison because you've made a comment that he can't respond to on facebook.
You are just expecting him to suck up your comments and you don't like it when he uses the channels he can to make his point- eg. Stop doing this.
You can dish it out but you can't take it!!!

He most certainly does IF he believes that the OP’s profession may expose others to risk.

Oh I got dragged back!

will hide now 😆

If the Headteacher genuinely thought OP’s posting was exposing anyone to risk he could report this without disclosing the fact that her child attended his school? That detail would be completely irrelevant to the allegation that she was a risk to the public (which she clearly isn’t by the way!)

@Katrinawaves the school is the only school in the area.
He's the only HT.
He doesn't need to tell the employer anything about the OPs child.
It's literally the only school the child could attend.
In your world no teacher in a small school could ever raise generic concerns or make an official complaint because that would be a GDPR breach.
He has a right to a private life and his complaint is entirely reasonable.
He's not the one sounding off on facebook!!!

It doesn’t matter if the recipient of the letter could infer the OP had a child at the school. They might be right or wrong about this and the employer doesn’t necessarily even know the OP has a child of the right age to attend the school.

The facts in this case are that the headteacher explicitly told the employer that OP’s child attended the school and that is the data breach.

I get you don’t understand this and that you almost certainly don’t work in this field but maybe check out whether the arguments you are so vehemently persisting in are correct before bludgeoning on with them?

@Katrinawaves he did not explicitly say the child was at the school.
He complained that she'd said things about him and the school in a parent conversation.
How was he going to be able to do that without identifying himself, the school and her as a parent????
You're wrong, I do work in the area and it's a grey one, with social media and schools especially all local authorities will take a different view.
He's acting as a private person who is employed as a HT here.
Personally I think he's been advised by police that this is an action he could take because the LA have probably been fudging the situation.

@Katrinawaves

"this field but maybe check out whether the arguments you are so vehemently persisting in are correct before bludgeoning on with them?"

Lol

Read the very first post! He said in his letter that he was the headteacher of named school and that OP was a parent of a child at that school!

And OP could easily have contributed to this Facebook conversation without having a child at the school. The school
and headteacher wasn’t even named on the Facebook post by either the person who posted it or OP who commented on it. So she had not disclosed her child’s school on social
media.

@Katrinawaves
This is the first post.
He's identified himself.
But given the nature of the complaint it would be impossible to redact this information.
I do think it's reasonable. I don't think it would be upheld as a GDPR breach.

@Katrinawaves she was in a parent discussion and said she'd found the ht to be terrible and the school to be a shambles.
So how do we deduce that she's not a parent ???
The OP is not just a parent, she's "that parent "

But it’s not impossible to make the complaint without disclosing that OP has a child at the school!

dear employer

I am headteacher at X school. I am writing to express my concern that @Harass3d who has a personal axe to grind, may have breached your social media policy by posting online that I am useless and my school is a shambles.”

that’s all be needed to say and no data breach there.

It’s completely irrelevant to his complaint whether OP has a child, a relative, knows someone who has a child at the school or knew the head from a previous school where she had a child.

FFS. Are you really trying to suggest on this thread that you are ISO 17024 qualified if this is your analysis. Words fail me!

Are you completely sure you’re not actually a teacher and not just a teacher but “that teacher” 😂

@Katrinawaves he could have said exactly that.

My point is that there is only one school that the OPs child can attend.
There are no other schools.
He is automatically identified and in fact we don't know if he did say anything except she was commenting in a parent fb group for the school.
We only have OPs word here.

In this case I think it's irrelevant because he is the only possible HT.

If he was suspected of any kind of breach it would have been reported back to the local authority because OPs employer will have been highly inconvenienced by the investigation.

It's a triviality.

Oh well, if we are going to start forming a view based on a completely different set of facts than those set out by the OP, that’s a different matter completely! Personally I express a view based on the facts the OP has given us as it’s not much use to her to give her the law on a completely different scenario but you do you.

Outing myself how?!

If her employer details are not available on line then he has found it from somewhere - I would be checking to see if it is on the files held at school to establish whether it was available there and therefore a reasonable line of enquiry.

As for proof - I am obviously not going to know what records management and data security is on the school system - I would be surprised if the files are paper based.

@Harass3d YABU with the whole GDPR thing. Seriously, don't bother. The ICO couldn't care less about individual cases, so even if it gets upheld, nothing will happen and the entire thing will be an anti-climax and irritating.

But the fact that this headteacher has gone out of their way to track down your employer and send a personal letter is creepy! It makes it look like your comment about the head was spot on!

Instead of the ICO, I'd be contacting OFSTED and/or the board of governors as this is highly inappropriate behaviour for a head.

Hmm @Katrinawaves I'm rather more qualified than you and work in a very pertinent sector.
I can tell you that the OP could put in a SAR around this and all she'd get would be a corporate apology from the LA.
The HT has not breached data protection here- pps are so keen to think he's somehow got the information from school and is using it inappropriately.
No.
He's been bullied by the OP online.
He knows who she is because either someone told him when they showed him the post, or he knows through the community.
He's complained to her employer as a private citizen.
The data he has used was common knowledge to over 100 people and published on the internet.
Her employer has investigated the issue and it's not been upheld.
Probably because he's been careful not to share screenshots.
It's not a data breach essentially because she identifies herself in the original post shared on the internet, but also because we can have no reasonable expectation that he can't complain about her behaviour as a private person.

@OpenFox @maddening she's in Scotland- no Ofsted here.
The employer isn't needing to be tracked down, she works for the NHS so it's just a case of the local health board. Pps have said the informant probably told him.

I think the HoS went OTT with his allegations to 'prove' to your employer what a nasty person you are, because ... not only did you say nasty things about him, but... you did this and... are this... and ... etc. But, and this is important, your employers know that this is not true. Thing is, HoS did not call you and ask you to clarify, personally, why you think the school is terrible. He went behind your back, to your employer, and accused you of being an underhand person - which he has shown himself to be, instead. Also, since you said what you said in a private group, someone broke your confidence. I know that this happens, yes, because people have sent me screenshots of what was said about me, so I will know who I am dealing with, despite their faux friendships.

Regardless, a headteacher contacting someone's employer is VERY unprofessional.

I guess if it's Scotland then there must be a governing body to complain to. Google says this one:
https://education.gov.scot/media/5twf11fn/complaintsprocedure.pdf

gingerlybread

Its been explained a few times on here, you don't seem to have understood and I gave the best analogy I could to explain, using the gp surgery as an example. You asked the question - I answered

what Op has done or not done is irrelevant to HT breeching GDPR - the HT has told Ops employer where her dc goes to school - its not allowed to share that information with a third party.

but then goes on to identify me as a parent (which has no relevance to his complaint) am I right in thinking this is a breach of GDPR?

this is the part I'm refering

HT is not allowed to give this information to a third party