GDPR breach? | Mumsnet

Hoppinggreen · 2023-06-26T19:21:21+00:00

First of all I am NOT going to report this if it is a breach I have just had a text from a number I don’t recognise asking me whether my child has any memories of his Y5 teacher as she is retiring this year and they want to make a memory book featuring past pupils. I won’t be replying as DS wasn’t a fan but he is now in Y9 so he left the school almost 4 years ago. Should the school still have my number?

prh47bridge · 26/06/2023 23:40

GDPR does not set any limits for how long a data controller can hold your personal information. The school should have a retention policy that dictates how long they hold data. Provided they have complied with their own retention policy and can justify their policy based on their purposes for processing, this is not a breach.

BiscuitsandPuffin · 26/06/2023 23:44

Actually I disagree with the poster above. If you're being contacted by a random mobile number, that means your phone number has been transferred to a non-secure device that's not part of the official organisation. Sharing your contact details with a third party without your consent is a GDPR breach.

Soapboxqueen · 26/06/2023 23:55

How do you know it was the school?

It could be a parent who's putting together a retirement gift for a teacher who has your number because your ds was in the same class as her older child but she's involved because her younger child is still at the school.

Just a thought

HarrietSchulenberg · 26/06/2023 23:58

The unrecognised number could be a school mobile, so not necessarily a member of staff's personal phone.
The GDPR does state that data should only be kept for as long as it's needed and organisations should develop a policy on retention of that data. Maybe check the school"s policy. Safeguarding records should be retained for 6 years after a child has left the school so it's possible that they've reflected that in their policy for general data retention.

waltzingparrot · 27/06/2023 00:07

You can ask to have your details removed at any time.

prh47bridge · 27/06/2023 07:35

BiscuitsandPuffin · 26/06/2023 23:44

Actually I disagree with the poster above. If you're being contacted by a random mobile number, that means your phone number has been transferred to a non-secure device that's not part of the official organisation. Sharing your contact details with a third party without your consent is a GDPR breach.

A mobile phone is not automatically insecure, and we don't know for sure that a mobile phone was used to send the text. There are services that send bulk SMS messages without the message ever going near a mobile phone.

Even if there a mobile phone was used to send the text, we don't know who the phone belongs to. It could belong to the school or to a member of staff acting in the course of their duties, in which case OP's contact details have not been shared with a third party.

Sharing contact details with a third party without consent is not automatically a GDPR breach. If the third party is a data processor acting on behalf of the school, it is not a data breach to share contact details. No specific consent is required.

We don't even know if the sender of the text knew that the number belonged to OP, or if they were just given a list of numbers with no names.

There may have been a breach of GDPR, but there isn't enough in the OP to say that for certain.

Original poster

Hoppinggreen · 27/06/2023 08:04

Thank you for all your responses.
If the text was from a parent I would have expected them to say who they were, there was no name on it. I think it was probably a mass text so likely to be an automated one from school.
I was just very surprised that the school would still have my details 4 years later, they must have more than a phone number still on record to know my son was in this teachers class (3 form entry)

OP posts:

Bromptotoo · 27/06/2023 10:25

Hoppinggreen · 27/06/2023 08:04

Thank you for all your responses.
If the text was from a parent I would have expected them to say who they were, there was no name on it. I think it was probably a mass text so likely to be an automated one from school.
I was just very surprised that the school would still have my details 4 years later, they must have more than a phone number still on record to know my son was in this teachers class (3 form entry)

If the school still has your records in some sort of database it's simple stuff to extract data for those kids who were in Mrs Jones's class and to mass mail them by SMS to their phone numbers.

There will, I suspect, be at least guidance and probably hard law about how long a school can keep pupil records and the information held per child.

Still having them for minors, at a level of detail that allows matching of a child to a class teacher who left 4 years ago, or the rooms their forms were based in isn't (IMHO) unreasonable. There may be any number of reasons why there was a need to backtrack kid's history.

I was contacted by a former employer several years after I left because they'd found exposed Asbestos in a small number of rooms on one floor. They were able to identify me as having worked in, or close to, that part of the building. Apparently the risk is very low but we were advised to let our GPs know as it might be relevant if we presented with particular symptoms.

Not pretending to be an expert in this stuff, still less whether a memory book for somebody's retiral is legitimate, but I think there