Data protection breach?

11 replies

AygoHomeNow · 29/02/2020 08:19

My DS hasn't had the MMR for valid medical reasons. This week I was sent a reminder through the automated school email about booking in for vaccines being given at school next month. The email had a spreadsheet attached with the names of all the children who hadn't had the vaccination.

I was horrified - before I speak to the school is this normal or was it a huge cock up?

OP posts:

Numbness2020 · 29/02/2020 08:20

Massive GDPR breach. You need to report

TildaTurnip · 29/02/2020 08:21

Cock up

BlueEyedPersephone · 29/02/2020 08:21

Yes this is a huge breach please report to school immediately.

TheSlipperSchlepp · 29/02/2020 08:24

Yes GDPR breach. Accidental or not, they could get fined for this.

M0reGinPlease · 29/02/2020 08:38

Agree this is a breach. You need to report it and the school need to declare it as such.

happystory · 29/02/2020 08:44

That's terrible.

Original poster

AygoHomeNow · 29/02/2020 09:08

Thanks, I will speak to the school.

OP posts:

lljkk · 29/02/2020 09:12

You're not required to report it to anyone. Up to you whether it matters to you.

Grasspigeons · 29/02/2020 09:21

The school needs to report it. They should also immediatley ask people delete it (phoning them if necessary) and review their processes. The FCO will likely not be that interested in this.

comictern · 29/02/2020 09:43

Agree it's a breach, but unless the spreadsheet contained additional information that you haven't mentioned, then the actual risk to persons is pretty low. I would let the school know, and they should apologise, ask recipients to delete the data, and review their procedures to minimise the risk of it happening again. I doubt the ICO would be remotely interested in fining them though.

Original poster

AygoHomeNow · 29/02/2020 11:52

It was literally just a list of names and vaccinations required. I will let the school know and leave it up to them what happens from there.

OP posts:

Flip