Is this GDPR breach

[Harass3d]

A complaint has been lodged with my employer about a comment I made on social media (not upheld!). This complaint has come from the head teacher at my son's school and he has identified himself as such (fine) but then goes on to identify me as a parent (which has no relevance to his complaint) am I right in thinking this is a breach of GDPR? It is no business of my employers where my son goes to school.

I had suggested ofsted before the op advised that she was in Scotland and in fact had agreed that ofsted was her route.

He complained to the employer in his capacity as head teacher of the school

Sorry gow have you determined that her employer details are common knowledge?

Again not the facts which the OP has posted @gingerlybread!

Neither she nor the person who made the post identified the school nor the headteacher.

100+ people commented on the post. That does not mean 100+ people saw @Harass3d“s comment. It may well only be those who are also her own Facebook friends who saw it depending on what her privacy settings are. But clearly someone who saw it screenshotted it and sent it to the head.

@Harass3d did not say in her comment that she had a child at the [unnamed school]. She could have strong opinions about a local school and a local headteacher for many reasons not just as a parent. I certainly know there are schools in my vicinity with a terrible reputation and headteachers who also have terrible reputations.

Bullying is defined is a course of conduct, not one single comment agreeing with a negative anonymised post made by another. OP has said she hasn’t posted anything else on social media about the head or the school and in fact says she rarely uses it.

If she made a DSAR, she would get a copy of everything she requested subject to some statutory redactions. The LEA could not avoid giving her this by giving her an apology

Whether the ICO would sanction the school or the head or not is not really the point. They might well just recommend they do better. What the OP wants to do is to put down a marker that what the head has done is not acceptable and making a complaint about his data breach alongside a cease and desist in relation to his deliberate mistruths to her employer and a request for him to retract that is definitely setting a legitimate boundary. If that’s what she wants to do which is entirely her choice.

Still not believing you are a qualified DPO I’m afraid.

Once again this was not a parent group I commented on. It was a status posted by a FB "friend".

I would expect any complaint made in a work place to be taken seriously and a fair investigation held.

To the poster who said he can say that about my future employment as they have strict policies or is his interpretation that I have breeched them and would be unemployable my work place also has strict rules and an independent/non biased investigation has deemed I did not break them. So it is only his opinion that I would be unemployable. It is not fact and again I am sure he does no have the LA permission to state this.

@Katrinawaves as a previous chair of governors, what would you have done with this information if the OP had come to the governors with it?

I was Chair of Governors prior to implementation of the GDPR.

For current chairs , I’d recommend they take initial advice from the DPO at the Local Authority before dismissing this out of hand.

Well the claim isn't false. He's complained about the post, which is yours and you did write it. Your employer has rightly concluded nothing to do with them. Your only recourse is now to complain to the governors about him

No that claim is not false

To say I've made multiple offensive posts - is false.

The OP has already said that the Headteacher made 3 other allegations against her which were false. She hasn’t denied she made the Facebook comment just that it wasn’t in breach of her works social media policy and her employer has agreed with this.

i honestly think some mumsnetters think we should be living under Chinese social media rules. It’s totally ridiculous to suggest that no one can ever comment on any social service’s shortcomings publicly. That’s not the law and it’s not how democracy works.

Ah OK yes fair on that point

Sorry I missed the point that he claimed 3 other posts made. I didn't suggest she couldn't make the posts etcetera
I said the employer righy concluded it was not a problem !

What is your proof that he was acting in a personal capacity?

Can you explain what this "the head teacher at my son's school and he has identified himself as such" means in the paragraph below?

Harass3d · Today 00:16
A complaint has been lodged with my employer about a comment I made on social media (not upheld!). This complaint has come from the head teacher at my son's school and he has identified himself as such (fine) but then goes on to identify me as a parent (which has no relevance to his complaint) am I right in thinking this is a breach of GDPR? It is no business of my employers where my son goes to school.

Can you explain why you think the OP's employer, who received a random letter about an individual employee, has a obligation to investigate if the Head is complying with his data protection obligations?

If you think that the employer has this obligation how would their staff go about establishing his compliance?

He submitted the complaint not the LA therefore he was submitting it under personal capacity. Tbh I would have expected his employer the LA to submit the complaint to my employer if they deemed it inappropriate.

OP has already said that she has followed the school's procedures for raising the issue of the lack of SEN provision for her son but hasn't had a response.

I would not agree that his sending the letter rather than his employer makes it a personal capacity issue.

He has linked his role in the school, you as a parent and your child as a student and the school your child attends so IMO this is a case of the professional who goes outside the scope of his authority. Outside the scope an internal management control problem
A lot of breaches happen when individuals act outside the scope of their role so the "process flow" checks around Data Protection obligations has not been done (ie the Head should not be sending out letters to third parties untill it has been signed off by the LA's designated staff). So the individual may use data in a way that break the school policy and create a data breach.

The LA should have a policy on dealing with SM with a process and it needs to be reviewed to ensure it complies with data protection.

If the Head had passed the complaint to the LA the LA could have reviewed what was to be issued and amended per the suggestion @@Katrinawaves gave in the post at 17:13.

On reciept of a SAR his LA would have to investigate and set out a case as to why the data used in the letter was not obtained during the course of his duty as Head.
They cant claim that as he used his personal computer (possible data breach) they are not responsible for the data or he was composing the text out side of his official contracted hours as a get out of jail card.

Under the current regulation the ICO would have to first look at the circumstance and decide if the data collected by the Head was covered by the exemption or not and IMO Head disclosed data obtained from his professional role.

@gingerlybread is making the "because I said so argument" so I am intrested how gingerlybread splits finer details used to determine why he is a private citizen while listing his professional role to the OPs employer in order to complaining about a comment on unnamed "The Head's" professional performnanc which resulted in him collecting the OP and OP's son's data in a 'non-professional' capacity.

He is pretty stupid in what he said to me. Eg if he said I'd like to slap you. You could be prox B Cox with a IQ of Einstein and make a comment that could get you sacked. If you said it to a parent in your HT office. Hence very clever teachers going to prison for having sex with pupils. Stupid choices no? Or can people with degrees not make stupid / thick choices?

i am intrigued as to why the op thinks the school is shambolic and the HT so useless given her son is happy at the school.

Is it the education you’re son is receiving op that you think is so appealing?

@AnSolas I have relevant experience here and I completely disagree with your assessment of the situation.
Police Scotland will advise education staff to pursue social media abuse as private citizens. The LA will not get involved with this unless there is clear evidence of criminal intent. A HT is a strange post because it is a role in the community as well as a school and it's impossible to separate these two in many people's minds. You're conflating the man and the role.
There is no data control issue here. He's been told some information by another parent or a friend and he's used that information to complain to the OPs employer. He has to say what his job is because it's relevant context.
Why he chose to go to the employer is beyond me but probably because he has no other avenues. The LA will have no interest in this low level nonsense and to think they will have a flow chart of procedures shows complete ignorance of education systems in Scotland.

How can the LA prove that their employee has as you claim :

He's been told some information by another parent or a friend and he's used that information to complain to the OPs employer.

That is their obligation when a individul claims that data held by them has been used by a staff member in "private" capacity.

The LA staff l may take a view point of

"have no interest in this low level nonsense"

Data protection is a legal obligation.
Plus they have a legal obligation to ensure staff welfare the fact that your the LA is washing its hands because it cant drop the client/customer is leaving them open to future legal action.

This

and to think they will have a flow chart of procedures shows complete ignorance of education systems in Scotland.

explains that you dont understand how data protection should be implemented.
Without a documented process the LA have nothing to prove that they are implementing controls. So back when the laws were introduced someone in the LA was given a job of looking at how the law applied to schools. That LA staffer wrote a long complex document on how data was processed in schools and then what controls were needed to comply with the law.

When the LA started dealing with SM impacting on staff and decided to wash their hands they needed to assess what data an individual staff member had access to and issue "guidance" (control of data) about what data the Role has access to and what data the "private citizen" can collect and disclose about a data subject.

Is a private citizen employee telling a third party that someones family member is a client/customer of their employer a problem (data breach) when the client list is proprietary information. Can the employee ever be lawfully sacked by their employer for doing that?

@AnSolas you're confusing the OP's possible breach of her code of conduct with the actions of the man who is the Headteacher.

He is not complaining to her employer using data that he has obtained from school.

She made defamatory comments against him in a parent facebook group, for his school.

He couldn't possibly complain about this without disclosing that he was the HT, even if it was on a complaint form where he had to state his profession. The complaint itself identifies him.

The only data shared is that he is the HT of that school, which is in the public domain anyway.

There's no breach here- except possibly by the person who shared the post with the HT , but once you post on FB you've given permission to Meta who are the publisher.

@AnSolas the client list of the school is not private data when all children in one area attend the same school!!!
That's what everyone is failing to see here, there is no clear data breach because there is no clear identifying data.

The only data shared is that he is the HT of that school, which is in the public domain anyway.

The opening post

but then goes on to identify me as a parent [...of the school where he is Head]

Is a private citizen employee telling a third party that someones family member is a client/customer of their employer a problem (data breach) when the client list is proprietary information.

Can the employee ever be lawfully sacked by their employer for doing that?

I did not make a defamatory comment on a parent facebook group.