Assisting a school with a data disclosure dispute

Nick Hobden recently assisted a secondary school in relation to a dispute over the disclosure of personal data.

Our client provided both personal and sensitive special category data, regarding the former teacher, to a number of schools outside of the European Economic Area (EEA) over the course of a couple of years. The former teacher became aware of this and raised a complaint to our client threatening legal action over data protection breaches.

The matter was very complex as it involved disclosures under the old Data Protection Act 1998 and General Data Protection Regulations/Data Protection Act 2018. Therefore a two-pronged response was required along with in-depth knowledge of the relevant legislation.

The Employment team assisted our client in drafting various letters detailing justification of:- how our client had processed the information justly and fairly; and why our client had released this data to an organisation outside of the EEA.

In addition, we undertook research on the organisations in receipt of the personal data.

We advised our client that they should notify the Information Commissioner’s Office (ICO) of a potential breach just to be safe. We are pleased to say that, with the assistance of our explanatory letters, the ICO found that the incident described would not be classified as a breach.

Further, following our robust response, our client has not received any further correspondence from the teacher giving peace of mind that the matter had been concluded and the complaint was not progressed any further.