Help! Advice on deputy headteacher asking me about my home life in front of another parent unknown to me!

[Halfpintmumma]

Hi I’ve had an issue with my sons deputy head teacher, she’s asked me if I was still with my sons father, because she had two different addresses one for me & one for my sons father, now I’m not really bothered her asking this as parents don’t always stay together & can co-parent well, which is the case for us. but what has bothered me is another parent who I do not know was sitting in the office with us at this time, I feel like my right to privacy has been invaded. Is this a breach of data protection? What do I do? Who do I report this to?

Op didn't say that the addresses had been shared, only that they held 2.

What is the data that was breached? You're very confident that everyone is wrong, but don't seem to be able to explain why they're wrong.

I believe that the situation was insensitive, and the OP would be wise to tell them that. "When the staff member asked about my marital status in front of another parent, that was inappropriate and made me feel uncomfortable." But there wasn't any PII breach involved that I can see.

That's still a data breach

It was indiscreet of the DHT to ask you a personal question in public.

At the very most I would find an opportunity to speak quietly to them and just say 'by the way, I was a little embarrassed when you asked about my relationship status in front of another parent last week'.

But making a complaint / threatening to report / mentioning data protection etc. just makes you seem completely OTT and will likely damage your relationship and reputation with the school.

What did the person actually say? From what you've written it sounds like they asked you the question 'are you still with your son's father' - so they didn't share any info, they asked you a question. If you replied with information (rather than saying 'I don't want to discuss that in front of a stranger') then the person sharing the data is you.

Same in a pharmacy when picking up a prescription. You try and whisper but usually there’s a crowd of people waiting who can’t help but hear.

Im not suggesting dont complain. Im just saying that it really is here nor there whether this is a data breach because it was confidential/personal and shouldnt have happened and more training is needed, regardless of it was an official data breach.

No it's not:

• Personal data only includes information relating to natural persons who:
• can be identified or who are identifiable, directly from the information in question; or
• who can be indirectly identified from that information in combination with other information.

No home addresses, emails, dates of birth etc were shared. The OP was simply asked if there should be 2 addresses linked to her DS. There were. How was anyone else in the vicinity meant to know where these addresses were?

Why was the other person in the room with you?

The breach is asking about the relationship with the father and about the two addresses on the system for her son which is an inference to her marital / relationship information. The information can be linked to the person as she was directly asked in front of someone,

For those having problems working out if a disclosure of data happened

deputy head teacher
》 has data file and a duty not to disclose data obtained as a result of her role.

What happened :

"she’s asked me if I was still with my sons father "
> data point
= son and
= relationship with childs other (alive) parent who is listed in the schools records

"she had two different addresses "
> data point
= 2 address held by school and
= possible relationship breakdown

"one for me & one for my sons father "
> data point
= sons father has different address to OP

"another parent "
= third party who has no need to be informed of the OP having a son or sons father having different home address.

Q did the other parent leave the room after obtaining more information than that parent had on entry?
and
Q did that data exchange happen with the consent of the OP or not?

OP yes it is a data breach as personal data ( of you, your son and his father ) was taken from the school system and disclosed.
The DH should not have decided that she needed to update her records in that way.

You can make a complaint or as above raise a concern over the way the data update was managed by the DH and ask now that a weakness has been identified how they propose to modify collection (eg more the training ) so that it will not be an ongoing issue.

Your marital status is personal information and should have been protected. By mentioning two addresses, the deputy head effectively disclosed this information to a complete stranger.

"Marital status is "personal data": Under regulations like the UK GDPR, any information that can be used to identify a person is considered personal data. This includes marital status, name, address, and date of birth.

It requires protection: Organizations that collect and process your marital status must protect it and have a lawful basis for doing so.

It is not "special category data": Unlike highly sensitive information such as race, religion, or health, marital status is not classified as "special category data". This means the rules for processing it are not as strict."

And that is a serious financial problem for UK hospital to have happen as they have a legal duty to take extra care over medical data.

In real terms that is a redesign of the intake area to prevent you from recording the data that you should not have been given access to.

All the teachers on this thread are saying this was a data breach. Listen to them.

No she doesn't. Not remotely.

At what point was your personal information shared by the staff member?

They queried whether having two addresses on file was correct. At that point no personal information has been shared. (Assuming that they didn’t read out those two addresses).

If you chose to answer, you shared your information. You had the choice.

And this level of entitlement and overreaction is exactly why so many are leaving teaching. I feel for the school.

Why were you in her office with another parent?

Her relationship status was disclosed. I don't know what's so hard to comprehend here

Thank you!
It shows how inadequate a lot of DP training is that people don't understand this!

Exactly, the goal in raising it is to help the school by flagging an issue that could cause a serious breach another time

Being asked your address in public happens frequently in health care settings (and data protection is taken seriously, with all staff receiving training). I would be surprised if anyone checking in at a clinic reception is not asked to confirm their name, date of birth and address. On hospital wards patients are asked and answer numerous questions within the earshot of others - curtains only provide a visual barrier.

I get it. I understand that data was breached and why. I also think it's a fucking disgrace that this is what the world has come to. It makes me question the wisdom of having had children because I'm pretty sure I don't want them growing up in a world where this teacher can be sanctioned for this.

It's not about being sanctioned FFS. It's about flagging a thing that needs changing.

Any DPO is just going to see a training need (unless the same person keeps repeating the issue)