Sensitive information about pupils was leaked to parents and students following a data breach at Greensward Academy, in Hockley, Essex.

A teacher at the school accidentally shared a mock examinations timetable via Google Classroom, unaware that the document also contained sensitive information. The document was shared with students and parents of students in year 11.

The sensitive information contained details such as:

  • Addresses
  • School meal status
  • Deprivation status
  • Exam dispensation
  • Special education needs

Parents and children (who wished to remain anonymous) made the following statements:

“It’s just unacceptable for this to happen. Some kids might not want other kids to know these things about them. Because sadly, when it comes to stuff like free school meals, they might be mocked or looked down upon.”

“Kids are going around saying other people are on benefits. Some of my friends are on there and they’re not comfortable that other people know their disabilities or if they are getting free meals”

The documents was posted online on 17 January 2022 and it was received after five days. The school sent a letter informing the parents of the data breach; and explaining what measures were taken in response to the incident.

Mr Tom Gibbs-Digby, education support manager of the school stated:

“At Greensward Academy, we take the security of personal data extremely seriously; and work hard to ensure we work within the GDPR regulations to keep your personal data secure.”

“The information was only visible to Year 11 students and their parents/carers registered with Greensward Academy and was not visible to any other outside parties, companies or organisations.”

“The incident was reported immediately and has been logged with our data controller as a data breach. An investigation has taken place and the staff involved have been given training and guidance in an effort to ensure that this does not happen again.”

Schools hold confidential information about their pupils and parents, and, like any other data controller,  they have a duty to protect it against unauthorised access and data leaks.

If you or your children have been affected by a data breach by a school or other educational establishment, please get in touch with DRM Legal and one of our expert solicitors will advise if you have a claim for compensation.