Horizon Academy Trust says it has launched an internal investigation and notified the Information Commissioner’s Office
The school has reported the data breach to the ICO (stock photo)(Image: PA)
An investigation is under way at a Hull school after a data breach in which sensitive information was sent to parents. The mother of a child who is due to start at East Park Primary School in September claims she was sent detailed and highly sensitive information in an email sent to the parents of new starters set to join classes at the Cavendish Road school in September.
The information was included in a spreadsheet attached to the emails in error. The school forms part of the Horizon Academy Trust which runs nine schools across Hull and Bridlington, including East Park Primary School which has more than 500 pupils.
It is believed the email was sent to a number of parents of pupils due to begin their first primary school year at East Park Primary School this autumn. The mother, who didn’t want to be named, said she was horrified and mortified by the contents of the spreadsheet.
The unnamed mother received the email last Thursday. She said: “I started to realise to my horror, as I was reading it, that this is all the personal information of every child about to start school, not only containing every child’s name, date of birth, address and telephone number but private comments from parents when they applied on the online application.
“It included reasons why they want their child to go to the school and other personal details. Each entry included a box which had comments that parents had added themselves when they applied for the school.
“I think it’s shocking behaviour from the school to have made this mistake and it’s upsetting and worrying as a parent to know that personal information has potentially been shared with every other parent in the class. I contacted a lady from the trust for the school, and she was mortified, took my details, and explained that there would be steps taken.
“I know mistakes happen, but this is a massive mistake and data breach because you’re putting every single child now at risk. I’ve deleted the email. Obviously, I would never share it or anything like that. But it’s potentially been shared with 40-odd parents.”
She added: “I don’t think I want to send my child to the school now because I personally don’t have any trust in them after this data breach.”
Hull Live has seen copies of a second email which was sent out by the trust, asking parents to delete the emails. The email says: “Apologies in my initial email, I attached an incorrect spreadsheet which was not intended for you, please delete this email immediately and do not open the spreadsheet.
“If you have already opened the spreadsheet, please delete this from your device and do not share any of the information with anyone else. Once this has been deleted please could you confirm you have done this via email. Again, apologies for this, we have attempted to recall the initial email but we are unaware if this has been fully successful at this time. If you have concerns, please do not hesitate to contact the school.”
Under UK GDPR regulations, organisations have to notify the Information Commissioner’s Office (ICO) of a personal data breach within 72 hours of becoming aware of it, if the incident is likely to result in a risk to individuals’ rights and freedoms.
A statement from Horizon Academy Trust said: “The Data Breach that affected incoming pupils at East Park Primary School was immediately reported to the Information Commissioner’s Office (ICO) by our Data Protection Officer.
“All affected families are being contacted by the school directly to provide support. A full internal investigation is underway to establish how this happened. We take data protection incredibly seriously.”
Did you know you can make Hull Live a preferred source of Hull news in Google, which will mean you get more of our breaking news, exclusives, and must-read stories straight away? Here’s more information about what this means and how to do it – you can also do it straight away by clicking here .