Sports day programme on website (lots of names included)

[Meldrew]

Hi everyone.

 

Just discovered that the programme for our sports day has been published on our website. Upon checking, it contains what looks like all the different events and which students are taking part in those events and at what times. Must be a couple of hundred student names on there - full firstname and lastname. We actively invite our parents to the sports day, so I imagine the idea is that parents know which event their child is doing at what time, etc.

 

It makes me quite nervous, but struggling to put into words (apart from GDPR says no) on a hot Monday afternoon why this is an issue. The best concrete thing I can think of is: does anyone know that students on the programme are ones that we must not admit exist due to safeguarding issues.

 

Despite pushing GDPR till everyone is sick of it for what seems a lifetime, nobody thought to mention they were going to do this so I could at least perform a DPIA.

 

Thoughts would be appreciated.

 

Many thanks,

 

Meldrew.

[Ditto]

Agreed, it would make me uncomfortable. You have a lawful reason to process this data, but I'm not sure my training really addresses this situation with regards putting the details on a public website. It's probably worth reviewing you privacy notices to see if that gives any guidance - really you'd be wanting to see a statement to say you intend to plan to publish names on the web. I very much doubt anyone would be happy to do so with photos of pupils, and forename+surname can be regarded equally as personal data, but not special category. One area where there is a risk is under the "Integrity and confidentiality" principle. I think it could be argued by publishing the list publicly has breached that requirement. Presumably, it would have been possible to notify each parent of there child's events only. Certainly, if there are names on there that publication causes a safeguarding risk, then the water just got hotter. I agree a DPIA would have made sense. Do you have a DPO to seek guidance from - are they internal/external and have the necessary skills to advise? I'd be very interested to hear what they suggest in this case. BTW, I've seen 3 occurrences 'opt-out otherwise you are in' and have raised the matter to SLT but no constructive response to date - I share you despair!

[elsiegee40]

Should their names be published? This links named students to be at a particular school on a public website.

 

Blow GDPR. Safeguarding trumps everything else.

 

This is a Safeguarding concern and no it most definitely should not be on the school website with children's names. Go straight to your DSL now and raise a safeguarding concern.

 

I did likewise with a school in my governor MAT for something similar a few weeks ago and the document was taken down immediately.

 

Everyone associated with a school has a duty of care with Safeguarding. If you have any concern, you must raise it with the DSL immediately and don’t wait for someone else to do it. The DSL makes the ultimate decision on what happens next.

Edited June 25, 2018 by elsiegee40