Am I being unreasonable to expect the same rights as everyone else?

[iamlind]

Hello Mumsnet!

ICO are refusing to protect the medical privacy of SEN children and their families.

You can cut through all the detail below - Blanket rules forcing families to hand over a 22-page medical report loaded with highly sensitive and special category data steps over the entire GDPR framework.

-----------------

The NHS commissioned an ADHD assessment for my DD. We accept the data collected as relevant to the NHS scope but not her school. The school say they require the full report and this is blanket policy. It is incompatible to argue the collection of this data is meeting legal thresholds if there is a blanket policy requiring the entire report from them.

GDPR requires considerations to be made before the collection of personal data, especially so in the case of sensitive data. Demanding the full report as standard practice by-passes and abandons all principles set out by the ICO. An assumption has already been made from the start - it is all relevant without asking any questions or setting any parameters.

The assessment took place in a clinical practice and probed a wide range areas such as my own childhood, when my DD started her period, my medical history, details of childbirth, historical pregnancies/abortion/miscarriages, historical relationships, sexuality disclosure and many other private matters. As an investigation, it is designed to seek out the most sensitive areas in people's lives and encompasses data that reaches back decades before your child is born.

I gave the SEN department of the school information I believed to be relevant for their purpose. However, I did invite them to ask me for more and gave them the page index to be helpful. I explained to the school that the document contains too much personal information. I am not trying to be difficult; I only want them to account for what they are taking.

My wishes were dismissed and I'm told they ‘require’ the report in full and this is blanket policy. I asked why they need details of my childhood and how this will be used to support my DD special educational needs. They did not answer this but did say that ‘The pages you have sent do confirm her diagnosis and will be sufficient for our records.’

I reached out to the head numerous times to raise my concerns. Nobody is saying we need X type of data because it helps to support your child in this way. No consideration is being made to the kinds of sensitive data they are collecting and whether they are relevant to purpose. It is just assumed that 100% of this lengthy medical document is relevant for their scope too. The school don’t know what’s in it, they won’t say what they want from it and the privacy policy states the SEN information they need as ‘SEN information’. I was ignored.

I launched a formal complaint and got a response from the deputy head. Previously I was told that what I had provided was sufficient but now the deputy says my child is likely to be refused SEN support on the basis of not handing over the entire report. They give an example of the JCQ examination board denying additional time in exams. Again, nobody is telling me what the JCQ needs from the report, only that they want the full report.

It is the responsibility of the organisation collecting the data to explain what types of personal data are required by the third-party they are collecting on behalf of. I don’t understand why the ICO are not enforcing this.

The ICO say there is no case to investigate because they cannot say what is relevant. They recommended I ask the IPSEA to clarify this and added that if such a body could establish what is relevant then there would be a case to investigate. The IPSEA say it’s not their role to determine this.

I do appreciate that the ICO are not SEN experts and therefore not in a position to evaluate what is relevant but they could enforce the law by compelling schools to account for the personal data they are collecting. These are back door keys into the most sensitive areas of people's lives with no limitations or controls in place.

GDPR law states it is the job the organisation collecting the data to explain what personal data they are asking for. I don’t understand why the ICO have asked me to find a SEN organisation willing to make this determination.

The ICO are not enforcing the GDPR principles stated on their own website.

Article 5(1) requires that personal data shall be:
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

This is a medical document. It should not be confused with an Educational Health Plan and the school has stated they don’t believe my DD needs an EHC plan.

On the ICO website it says:
‘Special category’ personal data is personal data that needs more protection because it is sensitive. The recitals to the UK GDPR explain that these types of personal data merit specific protection. This is because use of this data could create significant risks to the individual’s fundamental rights and freedoms.

Examples given include:

• their religious beliefs or other beliefs of a similar or philosophical nature
• their sexual life or orientation’

Consider the potential for harm if information such as sexuality or abortion is prised unnecessarily. There are plenty of people who hold views that conflict with the states position.

There does not appear to be any understanding for the sensitivity of this data is or the risks that are being introduced.

This blind spot in GDPR is being allowed to go unchallenged because the data controller is not being pushed to say what they actually need and nondescript definitions like ‘SEN information’ are being accepted in privacy policies by the ICO.

There is an issue of consent for the data collected because parents are being told the entire document is required otherwise their child won’t get SEN support. Forcing parents to choose between SEN support and privacy is not a fair choice. Both could be achieved, if GDPR law is properly enforced and schools are held accountable for the sensitive data they are collecting.

In my case, both parties could have reached a happy medium. I was happy to give the school whatever they needed as long as they could explain it. They didn’t want to explain anything and dismissed my rights outright. An order from the ICO for the school to improve their GDPR training would inspire a more considered approach. Telling me what I had given them was ‘sufficient’ and then going back on that a month later is not the best outcome for anyone, least of all my DD.

Without enforcement, SEN children and their families will continue to be discriminated against because we are not getting the same rights and protections for privacy like everyone else.

There seems to be misperception that these reports are created for the purpose of the school. They are not. The NHS have their own legitimate purposes and role in supporting ADHD. Of course the NHS/Clinical Practice are fully aware their findings are of value to education and in my view they go out their way to produce a lot useful data for schools, along side their own needs.

It's not the job of NHS to produce a report exclusively for the school. They primarily produced it for us and credit to them, they encourage parents to share data that may help the school support your childs needs.

I don’t have that misperception, I’m fully aware that a medical report is first and foremost done for yourself to determine if you need any treatment and it then can be used to support you in other places such as educational needs, workplace accommodations, DWP applications.

it says on this website that you don’t need to raise the EHC request via the school, you can do this directly through your council? sounds like you can cut out the middle man and just send the report directly to the people that will be making the decisions:

adhduk.co.uk/adhd-educational-health-care-plan-ehcp/#:~:text=A%20formal%20diagnosis%20is%20not,Educational%20Health%20and%20Care%20Plans.

I agree with your point- the only medical information the school needs is the information about the child they are educating.

In my (admittedly limited) experience, it’s normal practice for the HCPs who have completed these medical assessments to write a separate letter to the school, advising what the diagnosis is and what provision the school needs to make. Can you go back to the HCP and ask them to write directly to the school?

Thank you.

The problem is not how I get around this. Redaction is a great idea. Every parent should know this is an option available to them.

The reason I brought this to mumsnet was to highlight that the wholesale raiding of peoples medical spaces has somehow become normalised. Even when a parent is raising privacy concerns, no guidance is being offered. Parents feel cornered - give it all over or your child doesn’t get support.

I do apologise for such detail at the start and confusing my message.

Schools will deal with parents of all different abilities. It’s really important that privacy policies are clearly understood by all. ‘SEN information’ is too opaque. We need clarity. We deserve clarity. The law demands clarity.

This is a big deal. Medical spaces as sacred spaces to be protected. Lines are being casually crossed on what appears to be an industrial scale.

My DD feels she could never trust a Doctor again. She doesn’t blame the doctor. This is what is wrong with all of this. Patient - Doctor confidentiality must be respected. Without that trust, Doctors can't do their jobs.

Surely you should expect the school sen system need some proof of why support is being requested? My DD's file ran to a lever arch file and was needed to explain the complexity of her situation because a 20 minute assessment with an educational psychologist would have resulted in zero help, one to one with adults she did great!

Professionals need to exchange information, even sensitive information between them, but that needs to be kept securely. I have to information share due to my job and I'm acutely aware that gdpr is not absolute, not is privacy, there are times I'm permitted even required by law to hand it over for the benefit of that individual.

And that specific sensitive data you describe can per pertinent to the situation, however as we are talking about school age children i really can't imagine anything in a report which would need to be redacted, they are professionals and trained to deal with sensitive information

Thank you for clarifying that point. You did a better job of that than me.

My Local Authority has advised me to apply for EHC plan. School don't believe she needs one.
I have been gathering up evidence in support of that application. Unfortunately, a SAR was blocked and delayed for 5 weeks due to the school not cooperating.

When we got my sons diagnosis of ASD we got a letter confirming the diagnosis and then the ADOS which has all that information in it as an appendix. The ADOS is the answers to the questions asked to determine diagnosis and observations of ds.

The diagnosis letter was all school and la required. (He had an EHCP)

I provided the ados for context as had useful information but no one insisted I sent it.

It’s hardly nitpicking: the law clearly states that data collected must not go beyond what is needed for the purpose, especially sensitive information.

Do you think (eg) mum’s teen abortion and aunt’s psychiatric stay are relevant to the school’s SEN decision? Is it nit-picky to expect the law to be followed?

If you were the aunt maybe you wouldn’t personally care, but the law has taken a view on this. It’s reasonable to expect the school not to disadvantage the son in response to being asked to explain how their policy is lawful.

Also puzzled how many people are replying saying ‘Unreasonable. Just give them part of the report’, when that’s exactly what the OP has done and has been told is insufficient.

The OP’s issue is about what types of sensitive information she can be expected to disclose and for what purpose. The precise law that deals with that is GDPR. Why would it not apply?

In your view, the relevant information is the stuff that talks about the school age child? I think OP agrees with you. It’s all the additional stuff around, eg, her own medical history that she wants to withhold (or at least have the school explain the need for).

I had exactly the same report produced for my son with his ADHD diagnosis. The NHS sent it directly to the school without my consent. I received a copy too. It has all the medical information I disclosed about myself/ ex husband and other family members.
It took me by surprise but I was frankly so exhausted by the diagnosis process and fighting for support in school that I just tried to forget about it.

Yes do this. It's what I do.

Of course I want to give the school what they need. I gave them the diagnosis confirmation and areas she struggles with but also gave them the page index and invited the school to ask me for more. I wasn’t saying “That’s your lot!”

It is inevitable these reports contain both relevant and non-relevant personal data.

To those arguing that it is all potentially relevant - No sorry. Some mother having a teenage abortion or experiencing a miscarriage in her past is not the schools business. We could go through so many different examples of things that could come up but the point is anything could come up. You can’t argue something is relevant if you don’t know what that something is.

With the right mindset, it is possible to balance privacy and assist schools with the information they need.

School are definitely in the wrong here, but I can see how frustrating it must be for you if they don't understand that they are not entitled to third party data and won't accept a simplified report. The legal advice re SEN suggested by other posters might be the route to go.

FWIW - It is not uncommon for parents to request their information to be removed from the version of the report that goes to school, so I'm really struggling to understand why they are being so obstructive (other than to delay having to provide your DC with appropriate support).

I would add, I have also been involved in subject access requests for children's information, from separated parents where the mother's medical information has been redacted before sending to the other parent. And I find it hard to believe a school wouldn't have also come across a similar situation before.

In case you don't already realise it you are autistic.

Regards, autistic mother.

Thank you. I know i've not explained this well, so I am grateful to those that get it.

What alarms me is that there are zero controls are in place for what should be one of the most protected spaces, medical. Too many assumptions.

Every parent applying for SEN wants to assist the school. They don’t jump through all the bureaucratic hoops they have to for the fun of it. You’re fighting for help for your child. That doesn’t mean we don’t deserve legal protections for privacy.

Otherwise we are just accepting discriminately violating peoples privacy, without justification, for what is an easily manageable problem.

If the full report including your miscarriages is relevant to her SEN needs for NHS purposes why isn't it relevant for educational purposes?

The NHS was tasked with job to do. Investigate if my DD had ADHD. At the point of their involvement, there is no ADHD confirmed. They need to investigate and for that their scope is justifiably wider. Ruling out other causes, seeking out possible causes and establishing correlations will all be part of that. The report talks about sharing the “outcomes”. Doctors do not need schools marking their work for all the background stuff they do to arrive at their outcomes. They’re professionals. If they have any safe guarding concerns, we can trust they will pass this on.

You can debate a thousand examples but if it is assumed from the start all is relevant, you can be sure no considerations have been made. It is designed to seek out sensitive areas in peoples lives.