Parent wants us to remove logs from My Concern citing GDPR

[titch]

Not sure where we stand with this, but I know there are some fairly well-versed people on here.

 

We had a SAR for a previous pupil and so we pulled all the info as requested. They have come back and claimed inaccuracies in some of the many entries in myconcern. From a safeguarding angle we are always advised to log anything of concern on there however small. The claims are that the some of the comments from other pupils and staff are unverified witch is likely true but schools not being a court of law probably every record in my concern is not 100 percent verified and often holds opinions and recollections of other pupils and staffs best efforts of accuracy.

 

I am worried if we react to this request, it is a slippery slope to our safeguarding system being useless.  

 

That have stated the below as reasoning:

 

These records, detailed below, are in clear breach of the UK GDPR principles of accuracy, fairness, and data minimisation under Article 5, and their retention causes significant distress and potential harm to our child. Pursuant to Articles 16 and 17 of the UK GDPR, we require corrective action as outlined below. 

 

Any comments or advice greatly appreciated. 

[synaesthesia]

As long as those data points in MyConcern are clearly stated as "opinion" or observations during interview etc, then they should absolutely remain in place and GDPR has no say in the matter. Just because they don't like what they've seen, doesn't mean it should be struck from record. They might not agree that "pupil X called pupil Y an absolute Z" and want it struck, but if pupil Y said that's what happened, it needs to stay on record.

[Andrew_C]

Send it to the lawyers.  Above our pay-grades.

[TheHyperTechie]

What @synaesthesiasaid... records have to be accurate from what the teacher/staff member observed. I don't believe the content needs to be proven true. e.g. "Pupil A reported that..." rather than "Pupil A definitely did..."

 

 

Edited June 11, 2025 by HyperTech

[Ditto]

If you have a DPO, send it that way. If not, get one! In the meantime, pass it to the head.

[Koldov]

Sorry, can't help with any practical advice.

 

13 minutes ago, titch said:

their retention causes significant distress and potential harm to our child.

 

Interesting clause... I wonder how that's proven? Test case imminent...? I would imagine neither the parents or the child  knew about these incidents being recorded until the SAR (although it may be distressing now to know your misdemeanours have been recorded somewhere official) and potential harm being what exactly...? Do these reports on the safeguarding platform follow them from school to school, will it put them on 'the radar' of the next school? Are they like a criminal record....  will it stop them getting a job in the future...? /s

 

Isn't this a 'safeguarding trumps all' type of scenario and all 'concerns' should be recorded?

 

I mean (bear with the extreme example)...

 

child A says to teacher X, that child B is bullying child C (neither child B or C will talk about it), so not recorded, as hearsay.

child A says to teacher Y, that child B is bullying child C (neither child B or C will talk about it), so not recorded, as hearsay.

child A says to teacher Z, that child B is bullying child C (neither child B or C will talk about it), so not recorded, as hearsay.

child B stabs child C...

 

No reports, no flags, no escalation, no intervention... why didn't the school see it coming, why wasn't anything done about it...?

 

Have you reached out to MyConcern...? I would certainly hope they wouldn't wash their hands of it and say how it's used is up to the end-user... it's possible, but I would think they might be well versed in what the GDPR stance is with what can and cannot be held on their platform?

[sigma]

You can also seek guidance from the ICO.

[PotNoodleTech]

DPO

HEAD

LA (or trust) LEGAL TEAM

ICO

 

Frankly I would consider anything in myconcern to be integral to the running of the school, thus the parents request would not be actionable...but....

 

...I am not a lawyer - you need a Lawyer for this kind of crazy

Edited June 11, 2025 by PotNoodleTech

[TechMonkey]

I know it will be very subjective but where does myconcern data sit in the context of a SAR.  If there is an investigation or concerns about the parents, surely they shouldn't be able to get hold of it just because a SAR has gone in for the child?

[Steve21]

Only my personal opinion but the stated article refers to "Under Article 16 of the UK GDPR individuals have the right to have inaccurate personal data rectified."

 

Surely "The claims are that the some of the comments from other pupils and staff are unverified" - is not personal/inaccurate data. If it's been said it's a logged fact that's it be said (unless you've specifically worded it that the student "did" such things etc)

e.g. "StudentA reported StudentB as saying XYZ" is a correct report in it's log it's been reported. Not that it's a fact that StudentB said such item.

As others said obviously it's above IT management on that one, but unless it's been written badly in the way it's been input I can't see how you'd need to remove any of it (There's also then the flip side question as to how can you prove that it's inaccurate as well?)

Steve

[Gongalong]

As I'm sure others have said, they are reported opinions/comments from other students, these aren't factual inaccuracies about their child. Definitely escalate to your DPO, and always worth a call to the ICO helpline.

[Mike_B]

It's not really possible to give specific advice, based on what you have told us. As others have said, if you have a DPO or legal team then it needs to be escalated to them. You will need to share the full context of the comments with them, to enable them to form an opinion.

[Koldov]

15 hours ago, TechMonkey said:

I know it will be very subjective but where does myconcern data sit in the context of a SAR.  If there is an investigation or concerns about the parents, surely they shouldn't be able to get hold of it just because a SAR has gone in for the child?

 

That's a good question! Where does the scope of a SAR end? How much can you redact? Pretty heavily I'd hope. I could foresee all sorts of negative things happening with records from a safeguarding platform being accessed by the 'wrong' person...

 

Is it 'On this date, Pupil A has an entry recorded in MyConcern for behaviour' OR is it the actual record verbatim 'Pupil A did (or said) this to pupil B' , or...?

 

If a certain type of parent has a certain type of child, I'm sure they wouldn't need much ammunition to start making trouble for the other child involved or their parents, even redacted they'd know who it was. I'm guessing the SAR was put in because they know the school has recorded information about them and various incidents...

[synaesthesia]

1 hour ago, Koldov said:

 

That's a good question! Where does the scope of a SAR end? How much can you redact? Pretty heavily I'd hope. I could foresee all sorts of negative things happening with records from a safeguarding platform being accessed by the 'wrong' person...

 

Is it 'On this date, Pupil A has an entry recorded in MyConcern for behaviour' OR is it the actual record verbatim 'Pupil A did (or said) this to pupil B' , or...?

 

If a certain type of parent has a certain type of child, I'm sure they wouldn't need much ammunition to start making trouble for the other child involved or their parents, even redacted they'd know who it was. I'm guessing the SAR was put in because they know the school has recorded information about them and various incidents...

 

It's rare that anything in MyConcern/Cpoms should ever find its way into the scope of an SAR, that record isn't far off the confidentiality levels of criminal records, social care etc. You could argue easily for a blanket "nope" but it's a grey fence that the ICO will sit on forever.

[paulkerton]

This. It absolutely is not a job for IT. You cannot be the poacher and game keeper at the same time.

 

19 hours ago, Ditto said:

If you have a DPO, send it that way. If not, get one! In the meantime, pass it to the head.