Am I being unreasonable to expect the same rights as everyone else?

[iamlind]

Hello Mumsnet!

ICO are refusing to protect the medical privacy of SEN children and their families.

You can cut through all the detail below - Blanket rules forcing families to hand over a 22-page medical report loaded with highly sensitive and special category data steps over the entire GDPR framework.

-----------------

The NHS commissioned an ADHD assessment for my DD. We accept the data collected as relevant to the NHS scope but not her school. The school say they require the full report and this is blanket policy. It is incompatible to argue the collection of this data is meeting legal thresholds if there is a blanket policy requiring the entire report from them.

GDPR requires considerations to be made before the collection of personal data, especially so in the case of sensitive data. Demanding the full report as standard practice by-passes and abandons all principles set out by the ICO. An assumption has already been made from the start - it is all relevant without asking any questions or setting any parameters.

The assessment took place in a clinical practice and probed a wide range areas such as my own childhood, when my DD started her period, my medical history, details of childbirth, historical pregnancies/abortion/miscarriages, historical relationships, sexuality disclosure and many other private matters. As an investigation, it is designed to seek out the most sensitive areas in people's lives and encompasses data that reaches back decades before your child is born.

I gave the SEN department of the school information I believed to be relevant for their purpose. However, I did invite them to ask me for more and gave them the page index to be helpful. I explained to the school that the document contains too much personal information. I am not trying to be difficult; I only want them to account for what they are taking.

My wishes were dismissed and I'm told they ‘require’ the report in full and this is blanket policy. I asked why they need details of my childhood and how this will be used to support my DD special educational needs. They did not answer this but did say that ‘The pages you have sent do confirm her diagnosis and will be sufficient for our records.’

I reached out to the head numerous times to raise my concerns. Nobody is saying we need X type of data because it helps to support your child in this way. No consideration is being made to the kinds of sensitive data they are collecting and whether they are relevant to purpose. It is just assumed that 100% of this lengthy medical document is relevant for their scope too. The school don’t know what’s in it, they won’t say what they want from it and the privacy policy states the SEN information they need as ‘SEN information’. I was ignored.

I launched a formal complaint and got a response from the deputy head. Previously I was told that what I had provided was sufficient but now the deputy says my child is likely to be refused SEN support on the basis of not handing over the entire report. They give an example of the JCQ examination board denying additional time in exams. Again, nobody is telling me what the JCQ needs from the report, only that they want the full report.

It is the responsibility of the organisation collecting the data to explain what types of personal data are required by the third-party they are collecting on behalf of. I don’t understand why the ICO are not enforcing this.

The ICO say there is no case to investigate because they cannot say what is relevant. They recommended I ask the IPSEA to clarify this and added that if such a body could establish what is relevant then there would be a case to investigate. The IPSEA say it’s not their role to determine this.

I do appreciate that the ICO are not SEN experts and therefore not in a position to evaluate what is relevant but they could enforce the law by compelling schools to account for the personal data they are collecting. These are back door keys into the most sensitive areas of people's lives with no limitations or controls in place.

GDPR law states it is the job the organisation collecting the data to explain what personal data they are asking for. I don’t understand why the ICO have asked me to find a SEN organisation willing to make this determination.

The ICO are not enforcing the GDPR principles stated on their own website.

Article 5(1) requires that personal data shall be:
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

This is a medical document. It should not be confused with an Educational Health Plan and the school has stated they don’t believe my DD needs an EHC plan.

On the ICO website it says:
‘Special category’ personal data is personal data that needs more protection because it is sensitive. The recitals to the UK GDPR explain that these types of personal data merit specific protection. This is because use of this data could create significant risks to the individual’s fundamental rights and freedoms.

Examples given include:

• their religious beliefs or other beliefs of a similar or philosophical nature
• their sexual life or orientation’

Consider the potential for harm if information such as sexuality or abortion is prised unnecessarily. There are plenty of people who hold views that conflict with the states position.

There does not appear to be any understanding for the sensitivity of this data is or the risks that are being introduced.

This blind spot in GDPR is being allowed to go unchallenged because the data controller is not being pushed to say what they actually need and nondescript definitions like ‘SEN information’ are being accepted in privacy policies by the ICO.

There is an issue of consent for the data collected because parents are being told the entire document is required otherwise their child won’t get SEN support. Forcing parents to choose between SEN support and privacy is not a fair choice. Both could be achieved, if GDPR law is properly enforced and schools are held accountable for the sensitive data they are collecting.

In my case, both parties could have reached a happy medium. I was happy to give the school whatever they needed as long as they could explain it. They didn’t want to explain anything and dismissed my rights outright. An order from the ICO for the school to improve their GDPR training would inspire a more considered approach. Telling me what I had given them was ‘sufficient’ and then going back on that a month later is not the best outcome for anyone, least of all my DD.

Without enforcement, SEN children and their families will continue to be discriminated against because we are not getting the same rights and protections for privacy like everyone else.

I think you are absolutely right not to want to share the personal and confidential information about yourself (and potentially about other family members who haven't agreed for it to be shared. I think a lot of posters will be unfamiliar with the nature of the report.

I would redact it by sticking a sheet of paper over the top, and writing an explanation of what is in there and why it isn't necessary or appropriate to share it (e.g. family medical history including sensitive medical information about parents).

It is true that if the only way your child can get a suitable education is by you disclosing semsitive and irrelevant personal information, and other parents are able to access a suitable exucation for their child without sharing this, it does seem to be discriminatory.

This, why isn't your rage and ire at the initial clinician who did the report? If none of the information you gave is relevant to his diagnosis, why did you share in the first place?

The doctor wants to establish things like family history. It is part of the NHS investigation and I have no issue with that. They need to rule out other causes too.

I agree that it isn't acceptable that you were told it was fine to submit one page and then that you needed to submit the whole thing, but I am a bit confused about why you submitted a formal complaint when you'd been told that it was fine to submit just the page you had? This seems to have reopened the conversation, leading to them reverting to saying the policy is for the full report, which you're then very unhappy about?

I think it makes sense that they need to see the full report, because if it's in the report the assumption is it's relevant. So the question I'd be asking is why is any of that history relevant in the report? Why is it in the report? That's who you need to go back to.

There is a legal principle that documents must be construed in their entirety. You cannot "cherry-pick" extracts or individual sections and deem others irrelevant.

It's all or nothing.

I suspect that this principle plays a part behind the "policy" that the whole report is required and the school's later request to see the whole thing.

Because of the way this went down. I wasn't convinced by the response and I am concerned about the process of this and how this is being applied universally.

We went from 22 pages to 1 page (2 including page index) to everything. There needs to be some clarity here and schools should know what to advise if a parent is voicing concerns over privacy.

A balance could be achieved. I never thought to redact at the time but I was offering to work with the school and give them more.

You don't know what's in the report. There might be details about historic sexual abuse or mental health conditions the parents suffered. No one else's business.

OP I would redact the portions you want to keep private (black them out) and if the pressed to reveal then I would take it further. There is no need for them to know YOUR personal history or medical details about your dc unrelated to adhd

This, I'd assume by your complaint about them, they've thought 'hold on, we need to make sure we're following the process to a T, to safeguard against further complaints that we are not following due process, best ask for full report as we're meant to'?

I am imagining some kid at a faith school that's disclosed their sexuality or mum disclosing past abortion, with tight knit communities. Not suggesting schools would share that info but psychologically that has the potential to cause a lot of distress.

If parents are being told the whole report is required and there is no way around that - it just doesn't seem like the best policy to deal with the diversity of parents out there.

I am imagining some kid at a faith school that's disclosed their sexuality or mum disclosing past abortion, with tight knit communities.
Why would any of this be relevant to an EHCP being required in education?

It is not an EHCP- The ADHD report is a 22 page medical investigation.

The doctors are probing things like relationships and things like this come out in the process. The child is taken away from their parent and interviewed and feels safe because they're talking to a doctor.

It's interesting because I had purposely deflected away from my family but this was picked up and conclusions drawn and in the report. A throwaway comment about my grandparents did make it in the report. Psychologist was probing any mental illness in family.

Yanbu

My child's school had a huge data theft (attempted ransom by hackers) last year and I have already been informed that a fair bit of data about my family is on the dark web. Nothing especially personal but plenty of information which now makes our household particularly vulnerable to targeted fraud. Apparently there is an increase in hacking attempts on schools.

I'm waiting ADHD assessment myself and given this experience and the fact the NHS is also very much a target of hackers I'm feeling quite concerned about the way my sensitive, personal data will be held.

It's not unprecedented for hackers to use sensitive, personal material to target victims:

en.m.wikipedia.org/wiki/Vastaamo_data_breach

I thought it might be useful to share the page index so we're all clear what comes under an NHS investigation. I am ok with their scope of purpose.

Note how many times you see 'History' on this index.

Yes I'd redact the bits I don't want them to see.
No one involved with your child's education needs to know your medical history or about your private life.

Just give them the bit that talks about your DC

The school is not a legally interested party. The op isn't trying to sell her child to them, just them to educate her child.

This is what we did, covered over any personal health info of the parents.
This was for the EHCP though. School never required the diagnosis report for anything else.

Starting from the assumption there’s probably stuff in there they don’t need is the right mindset.
I’ve never been through this process before and felt stripped of my privacy in one casual email.
I’ve never redacted anything before so it never sprung to mind but I wish it had.

I worry a lot of parents feel strong-armed into handing over the entire thing and are not being offered any suggestion how to balance their privacy. For many this will be no big deal, for others, their worst nightmare.

There has to be a better way. When you strip it down - the raiding of peoples medical privacy has been normalised, with no guidance in place.

Are we not worthy of a bit of consideration in a privacy policy? Something like…
‘We require full medical reports but will accept redactions. We are committed to your privacy but may still need to ask for more information.’

In principle, yes. But I wonder if it’s the school’s shortfall? Not every report will contain that type of information or at least not to that degree.

I would argue that the ADHD report shouldn’t contain that in the first place, as opposed to the school having the responsibility to vet what’s in it.

There is likely some kind of NHS/government guideline that dictates what the school can and cannot accept - perhaps this is where it can be argued that a report for school / child should be different to that of an adult in any other circumstance? I’m open to someone correcting me if I’m wrong, but what does the parents physical history have to do with a child’s mental health diagnosis? I can accept that in certain circumstances conditions can be hereditary and that’s where it’s relevant.

The report was a medical investigation. I’m not upset with the doctors because their job is different to the school. They need to rule out other causes and that requires a comprehensive investigation. The school doesn’t need to know about great uncle Bobs psychiatric condition from 3 decades ago.

ADHD isn't a mental health diagnosis. It's neurodevelopmental, with both genetic and environmental factors. They take a full family and medical history and developmental history of the child. You tell them everything which might be helpful in understanding your child's needs, and then they write it all in the report.

I assume it's necessary so the basis for making the diagnosis is recorded.

The school may legitimately want to see enough of the report to confirm the diagnostic outcome meets the DSM criteria, but you are correct that they don't need to know your medical history.

It's not an SEN issue, it about your third party data which can only be disclosed by the provider with your permission.

As PP have identified, you have 2 options; ask for a modified report from the provider, or redact the details yourself.

An alternative would be to ask the provider for a simple diagnostic letter.

Makes sense.
in which case there should be a change in the way the reports are made for the purpose of support in school. Only the relevant information should be summarised. I still don’t think the school is unreasonable here, they are following policy - but the policy can be scrutinised

Before providing a diagnosis of ADHD other diagnosis are considered, so for example the traits may be attributable to trauma or anxiety, or issues around pregnancy, birth & the neonatal period.

However what the school need to know is that the information was considered in reaching the diagnostic conclusion. They don't need to know what it is.