Is anyone experienced in data protection issues please?

[Claw001]

I have 4 issues.

1. CAMHS wrote a letter containing details of my son’s mental health, addressed to me and cced in my GP and school. I did not give my consent for anyone to be cced and it was cced before I had read it.

1. School then shared it with others, without my knowledge or consent.

1. Once I read the letter parts were factual incorrect and detrimental to my son. CAMHS have agreed to provide an amended version.

My understanding is this is classed as ‘special category data’ and should not have been shared with anyone without my or my son’s explicit consent in the first place?

A slightly different issue, but similar.

1. A school professional assessed my son and provided a report. 8 months later, she has extensively amended the same report (without any mention within the report of it being an amended version) it is still dated as if it was written 8 months ago too.

This professional has then shared the amended report with others, but not me. So I have a totally different version of the same report!

All a bit of a mess! Any suggestions of how to sort this?

My understanding is this is classed as ‘special category data’ and should not have been shared with anyone without my or my son’s explicit consent in the first place

Your understanding is wrong. Consent is only one of the grounds under which special category data can be processed. If CAMHS considered that sharing the data with your son's school was necessary to protect your son's vital interests (e.g his mental health) they can process the data (which can include sharing it with others) without your explicit consent.

Thank you, I was thinking more in relation to 2 and 3. Should I not have been given a copy first to read first before it was shared?

CAMHS have asked for my consent for amended copy to be shared with GP and school. Which I have no problem with, as it is now accurate.

However school have already shared with others, who were not cced, due to the detrimental factual inaccuracy so it can be used against my son. Should ‘special category data’ only be shared for the benefit of the child?

Without knowing who the school shared the information with or why they did so, it is impossible to comment. They may have had legitimate justification under GDPR, they may not. If it was simply interesting gossip it would be a breach. However, if they were sharing it in order to help your son it may not have been a breach.

The presence of factual errors may be a GDPR breach but it depends how they arose. Provided the errors were corrected when they were made aware of them they may have fulfilled their responsibility.

Should ‘special category data’ only be shared for the benefit of the child?

Not necessarily. There are nine possible justifications for processing special category data. Only one of these justifications needs to be present.

It was shared with LA, for a Tribunal situation, in support of my son NOT receiving a higher level of support in school.

It will not support this, now amended. However, that was the intent.

It is also the intent behind the school professional amending a report, 8 months after it was written, with no mention of the extensive alterations made to the report in the report. I was not given a copy. So I have a totally different report, to the one presented to Tribunal.