Data protection breach - Scotland- what can I do?

[Buzzlightyearsbumchin]

A teacher in my child's school was given confidential information about a mental health condition my child has. This information was given to the teachers in an email that was clearly marked as confidential.

The teacher then made 2 remarks that made it clear to the class what my child's condition is. Teacher admits this but said this was an accident.

There were then 2 very clear incidents within the same week of the teacher allowing bullying in the class regarding the condition.

The school didn't inform me, the teacher gave a half hearted apology to my child and they are trying to sweep it under the carpet now.

They have shrugged and asked what they can do but I want to push further with this.

The data protection breach alone is very serious but I'm not sure what I can do from here as the school isn't taking it seriously trying to cover their backs.

My child's education has been impacted as I have pulled my child out of the class and there are no other teachers available, friendships have been impacted and my child's mental health has been impacted too.

As the school have conducted an investigation that I'm not satisfied with where do I go to escalate my complaint and what should I be asking for?

Thank you

Sorry to read this. Escalate it to the schools governors next.

@mummyeme

Scotland. No governors.

You could take it up with the QIO who has responsibility for the school. Legal team at the LA is another possibility.

Head of Education, your own Councillor, MSP, ombudsman are all other avenues available.

Report them to the Information Commissioner's Office - not the Scottish one that only deals with Freedom of Information (Scotland) Act, the UK one that deals with UK wide data protection www.ico.org.uk.
I think they actually have a representation in Edinburgh.
They may do nothing more than write them a letter telling the school it got it wrong and offer guidance about getting it right.

Check out the school’s complaint procedure and escalate it according to their procedure so you can say that you have jumped through all the required hoops.

Have you explicitly asked them if they have reported themselves [to whoever it is that is appropriate for Scottish data protection] for their serious and repeated breach of the regulations? Maybe ask them if you can have the reference number so you can add a victim impact statement to the breach info (not sure there is such a thing but doesn’t hurt to mention it!) and that might put a rocket under them to make them realise you are taking this seriously and they need to too.

Then concurrently report it to the data peeps and get then to sort it out...

Data Commissioner, like others have said

ico.org.uk/for-the-public/

They even give a template letter to use to raise your concerns

ico.org.uk/for-the-public/

In my experience - not a lot! My daughters SEN records (and many others) were found in a cupboard in the Village Hall (next to the school) available to anyone who went in there. I went through the school complaints process, ICO and Head of Education for our county. Not much happened. ICO acknowledged it was a breach and spoke to the school but I think, with limited resources, they are more interested in big corporations falling foul of the rules. Education dept gave a half-hearted apology but said that as long as school had followed it's process they could not get involved.
It seems staggering to me that there is independent body a parent can go to to discuss an issue that has not been resolved.
Good luck!

What do you want to happen at end?
Fulsome apology, place at another school?

A lady took a picture of a class list for the estranged partner of the parent of someone in the class and was criminally prosecuted by the ICO recently. it has cost the lady about £1500 and she will have a criminal record.

Today the UK's new Data Protection Act 2018 has received Royal assent. People need to take data privacy seriously.

"Former council worker fined for sharing personal information about schoolchildren and parents via Snapchat

A former local authority education worker who illegally shared personal information about schoolchildren and their parents has been prosecuted.

Samira Bouzkraoui, 24, took a screenshot of a council spreadsheet concerning children and their eligibility for free school meals before sending it to the estranged parent of one of the pupils via Snapchat.

The image included the names, addresses, dates of birth and National Insurance numbers of 37 pupils and their parents. She also sent a copy of a school admission record relating to another child.

The defendant was at the time employed as an apprentice in the schools admissions department of Southwark Council and had received training in data protection. She declined to answer any questions when interviewed by the Information Commissioner’s Office (ICO).

Bouzkraoui, of Scovell Road, London, appeared before Westminster magistrates and admitted three offences of unlawfully obtaining and disclosing personal data, in breach of s55 of the Data Protection Act 1998. She was fined £850 and was also ordered to pay £713 costs.

ICO Criminal Enforcement Manager Mike Shaw said:

“This is yet another example of how people whose jobs give them access to personal data can end up in serious trouble after allowing temptation to get the better of them.

”Parents have the right to know that their personal information, and that of their children, is being treated with respect and in accordance with the law. Anybody who ignores that right and that law has to accept the consequences.”  "

Follow the complaints prociedure the school outline or go to the LA and ask them what to do, but don’t let it lie.

She should be suspended pending an investigation and then dismissed. Data breaches are not a small thing. Doesn’t matter if she made one silly comment or sent out detainee files: she is not safe to be in the possession of private information.

Do not let them sweep it under the rug!

Hi my daughters primary school sent out an email today to all parents within her year. Within this email the school have disclosed her name and the first line of her address without the house number. This is a breach of data clearly. I have already called the school regarding this but who do I report this to outwith the school?

You can report it to the ICO (Information Commissioner's Office) but I doubt they will do anything for a relatively minor breach like this.