data protection issues.

[scoolabuse123]

I am asking for help, my children have a long running issue with their grandma interfering with school. The children do not like grandma.

School have released 7 years of school reports to grandma without my consent.

What can I do legally? They have broken all data rules, how can I protect my children? I'd like some help before I seek legal help.

I would get legal advice

I'm looking at legal advise, but I need to follow the procedures before I sue them.
HOW can I make them accountable for this massive abuse of trust:??

Hi OP, this is really bad! It must be very stressful for you. It is definitely a data protection breach.

Legally, you can make a complaint to the Information Commissioner's Office (ICO). Google report breach to the ICO and there's an online form. What will then happen is the ICO will get in touch with the school to investigate what happened. It takes ages but they will follow up every breach report. Based on what you've said, they will likely find it's a data protection breach and ask the school to ensure they have measures in place to stop it happening again.

Technically the ICO could fine the school (or Local Authority / Academy Trust if they are the data controller), but it's unlikely. Even if they do, the fine would go to general treasury funds and not to you.

I guess it depends what you want the outcome to be. An ICO investigation would be a massive headache for the school. It would make them up their game and ensure this doesn't happen again. But it can't undo what's already happened, in that the data is already shared with grandma, and you wouldn't be compensated in any way.

It might be better in the long run to try and sort it out with the school directly and keep relations with them reasonably okay.

I hope that's useful and I'm sorry this has happened to you.

Also there are a lot of no win no fee solicitors out there who will sue on your behalf for data breaches. If you go down that route be sure to do your homework and read reviews. Some are them are fine but some are very unscrupulous. It's quite a new field and can be hard to prove detriment in terms of distress (as in when you've not lost money).

I would:-

1. Make a complaint to the governors and ask for immediate steps to be put in place to prevent a recurrence
2. Report to the data protection officer at the academy trust (if part of an academy)
3. Report to the ICO
4. Seek legal representation on a no win no fee

There should be a nominated Data Protection Officer at the school and a complaints process. You can complain direct to the ICO but agree that may not address whatever has happened and prevent further issues. Is it also a potential Safeguarding issue?

That's dreadful OP.

1. I'd ask for it in writing confirming details of exactly what they've handed over, date it was sent , format (written or online) and who released the information, and who authorised it. Just school reports or did they share other information from the school records? Make them account for every page that was sent.
2. Ask for full copies of each child's records just so you can check what's been recorded there (as they're playing fast and loose with confidential data.
3. Make a complaint using the school's complaints procedure - include details of any discussions you've had with the school about grandparents / access etc. Details will be on their website.

This can then be escalated as a complaint to the governors once you've had their response.

1. Contact the IOC as suggested - they have a helpline here:

ico.org.uk/make-a-complaint/

It's unbelievable what they've done.

The first question is whether or not at sometime in the past the school have been given permission to divulge information to the grandma. If this is the case and the school can produce the evidence of that agreement then the school have not done anything wrong.
You need to get that information from the school in writing as to who can receive information.
If there is no such agreement in place then you need to make a formal complaint to the school and see what reaction you get from them, before you go to the ICO. You do need to emphasise to the school that you need to be made aware of all information that has been divulged to grandma and the reason for this.
If this is simply 7 years worth of annual school reports then this is at the bottom end of the scale in terms of data breach. If it involves other more personal information then this is far more serious and either you or the school need to take it to the ICO.
I would not have thought that unless this was a serious breach of data that there would be any ability to sue the school.

That definitely looks like a data breach to me as a headteacher. Point 1 of Goats post is absolutely correct - write at this stage and ask the questions as to how this happened (is there any possibility that school were "conned" by the grandparent?). It is most likely a member of office staff or teacher who is unaware of data rules and who has not thought about this and needs to be made aware of their responsibilities (ie I suspect that no one authorised this).

Once you know what has happened, you can frame your complaint correctly. Any complaint in a school is directed towards a resolution ... what do you want to happen next?

OMG. Massive breach. How do they even know who she is.