local authority data breach

[itsfinallytime]

I have an ongoing issue with the LA over education matters.

What are the potential repercussions for an LA for sending personal data which identifies a child out to a third party?

This was an accidental error but it is very sensitive information.

You need to notify the ICO of the breach. Supposed to be done within 72 hours. If later you need to give reasons for the delay. The council can be fined, I believe.

It is the LA that has 72 hours to report, not the OP. OP can report the breach at any time. However, the LA only have to report the breach if there is likely to be a significant risk to OP's rights and freedoms.

A breach does not automatically lead to a fine. An accidental breach involving a single individual is unlikely to lead to more than a slapped wrist.

Depending on the details, OP may be able to get compensation from the LA for the breach. This would cover any material damage and also compensate for any distress caused.