Is this really a breach of data or just plain ridiculous???

[ishouldprobablygettherapy]

So I need to send birthday party invites out fairly soon. My daughter has not long started reception. I've asked the teacher yesterday morning if I can please have a list of either all of the children in the class with the girls highlighted, or just a list of the girls. So I am able to write the invites with my daughter.
This is a fairly normal question - in my opinion.. as how else would you go about it ? (No school WhatsApp groups etc)
She told me this was probably not possible, and they will have to essentially hold a talk about this, as handing out the children's names is not allowed.
I can somewhat understand.. but on the other hand I find it ridiculous.
When I was at school (which isn't really that long ago) we are able to request register lists from the teacher to play with at breaks, lunchtimes ... and they weren't accounted for and nearly always came home.
Forgive me if I'm being stupid... but I cannot think of another way to go about doing the invites without having the children's names !!
What do I do?

That sounds logical to me.

Our school gives out a list of first names. I can't see how that's a data breach it doesn't identify anyone.

Our school doesn't give out lists of names, but they do get a Microsoft Teams account from P2 and the entire class (including both names, a photo and email address) are in the Team. It makes no sense!

Can one parent try to start a class contact list and WhatsApp group - it does make life much easier.

On the class WhatsApp group we have asked parents for all children's and a parents name to put on a spreadsheet and be shared. I think everyone agreed to do it but they didn't have to.

Previous head said no to any class lists, present head has said yes to first names only.

As a data protection lawyer this knee jerk “no because GDPR” drives me bonkers. The work around is for the school to send comms home asking for parents to consent for data (names) to be shared on an opt in basis. If the school doesn’t have the tech or the capacity to administer or monitor responses then the low tech way is for an email to go out with a parent volunteer’s details and for people to message him/her with their details if they would like their child (and their) details to be collated and circulated to the class.

we use the parent volunteer system
at my DD’s school and has worked smoothly for 4 years.

It completely is a data breach. This happened at my daughters school and I complained. My child has a protection order and her details should not be shared. Also in that class are looked after children too.

Life isn't all roses and parties done children haven't had a safe start to life and need protecting which takes priority over party invites, school nativity films, sports day photos and anything else that breaches confidentiality.

I'm in the profession too. What's petty about protecting vulnerable children?

I don't know if it has changed as it is a couple of years since mine left school but we were refused a list of names for Christmas cards then we went to the Christmas concert and the children's names were in there with what part they were playing.

In a programme, I meant.

My son has had invited with ‘to my friend’ on and the party child gives them out.

How would a class list with first names only endanger vulnerable children?
We aren't even allowed to give those to parents.

It's both.

For the sake of an example, suppose the normal school policy is to provide a list of names on request.

In one class you have twenty children and one child has a specific safeguarding concern.

• Do you give, on request, a list of nineteen names and single out the twentieth child as different? This creates a GDPR issue from a safeguarding issue because it now associates a second (and sensitive) data point with the name.
• Do you not hand out a list for this class, although you do for the other classes? Indicating that one or more children in that specific class have something different about them and triggering the latent Miss Marples amongst the parents' WhatsApp group.

Schools aren't social secretaries. So it's far easier to blanket ban lists of names and avoid all this.

I genuinely don't understand how this is an issue for children who must not be identified - if only the first name is given out, how is that different from a child coming home and saying "I sat next to Sarah today"? Surely by half way through the first year, most kids will be able to give the names of a reasonable number of kids in the class?

I'm not being goady, just genuinely don't understand the difference.

It’s not a GDPR issue but (as an expert in it for commercial companies) I’ve found schools have no clue and label everything ‘gdpr’. They just don’t understand.

why are you only inviting the girls though? How weird.

I imagine there are about 15 girls in the class so print 15 invitations and ask the teacher/TA to put them in book bags. It's unusual not to have a class whatsapp these days though, are you sure you haven't inadvertently been missed off one? If your daughter is anything like my kids and their friends they will be friends with both boys and girls in infants, are you sure she wouldn't want to invite some boys too? Can you sit down with her and get a list of names?

If it's not class lists it will be be someone posting does anyone know who X's mum from year 2 on a open page. The more rules you try to enforce in the world of social media and smarts phones just leads to some kid missing out and be upset either way. Because their no list, they aren't on it or mum is on Facebook etc

We aren't allowed sports day etc photos so people just sneak them. The kids who's parents follow the rules then get upset that they don't have one. The go pro we use is smaller than the palm of my hand before you add in smart phones etc. Then when they go to parties parents post photos and it continues.

GDPR doesn't account for the social media age. The reality is nothing is private anymore like it or not. Data security is just a race between the good and bad hackers to out do each other.

It would be better if the looked after child was allowed to adopt a new school name to use for things like this.

Our school won't hand out girls only or boys only etc parties it's whole class only. We just send in postcard like invites with no names on and a few extra to account for the ones that get lost before they make it home.

OP try and start a parents Facebook or WhatsApp going forward, within a few weeks you should be able to build a class list which you can add to. It's also good if you want to organise a smaller activity like a play date.

Yes that would be a personal data breach most likely as parents/ children haven't consented for their data to be shared with you and there's no other basis on which sharing in that way would be permitted. A lot has changed in the data protection world in the last 10 years.

As a data protection lawyer this knee jerk “no because GDPR” drives me bonkers. The work around is for the school to send comms home asking for parents to consent for data (names) to be shared on an opt in basis. If the school doesn’t have the tech or the capacity to administer or monitor responses then the low tech way is for an email to go out with a parent volunteer’s details and for people to message him/her with their details if they would like their child (and their) details to be collated and circulated to the class.

Agreed however it is no because of gdpr unlsss this workaround is put in place because there's no lawful basis on which to share the data.

Since when?! Sounds like paranoid overkill.

It's not remotely creepy, ffs! Class lists used to be issued for the asking not so long ago.

It would be better if the looked after child was allowed to adopt a new school name to use for things like this.

@sleepyscientist I despair of some of the BS I read on MN but this has really shocked me. So, I’m just checking that you genuinely think it would be okay for a child who has lost everything and been wrenched from the family they love, no matter how potentially neglectful or abusive, to then have to be stripped of their actual name and given a new name? Because, you know, party mums and party invitations.

@BrontëParsonage It's not about the mums e.g we are having a trampoline party this year, imagine being the only kid not invited as they can't be named. It's only a name and will stop them missing out. I've never been known by my legal name and neither has DS. A lot of Asian families choose a British name to be known as so the kids don't stand out. In fact DS even has the wrong spelling of his full name on school documents.

You could even do it so they all pick a nickname at the start of the year.

Our school requested consent and then names, addresses and email addresses all distributed to the whole year. Even the celebs details were included!