Former headteacher fined £700 after dumping old pupil data on server at new school A former headteacher has landed himself in hot water with the UK's data watchdog for downloading personal information on children he previously taught and uploading it to servers at his new school. Darren Harrison, of Twickenham, loaded pupils' data from two primary schools on a USB stick then took it to his new place of work …
It begs the question "why?"
Why would a headmaster - or any teacher - want pupil data from a previous school in his new position. More worryingly, why lie that the data had been deleted, especially so when it is common knowledge that data doesn't just copy itself from a device, but has to be manually copied.
Is there a transcript of the Court session, and/or the ICO's findings available?
It begs the question "why?"
Why would a headmaster - or any teacher - want pupil data from a previous school in his new position
I can't think it'd be possible or even wise to headhunt well performing pupils from previous schools for a new post at a struggling one institution.
But such we have come to with the League Table nonsense.
Personal data covers a lot of sins. It could be anything from contact details, through attendance records and grades, school reports or simply example texts the pupils wrote or example tests, which still had the pupils names on them. Or non-anonymised test data for an application.
Without context, it sounds bad. But the context would let us know how bad it was. As it is, the news is incomplete and leaves us playing guessing games.
The article says 'sensitive personal data', i.e:
1. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs;
2. trade-union membership;
3. genetic data, biometric data processed solely to identify a human being;
4. health-related data;
5. data concerning a person’s sex life or sexual orientation
As it is a school, I guess it is probably either number 1 or number 4
Why would a headmaster - or any teacher - want pupil data from a previous school in his new position.
Exactly the reason stated - research.
The question is why he was engaging in a research activity without agreement from the subjects using his employer resources without an authorization for that.
The court and the ICO did not dig as deep as they should.
The fact that he was doing unauthorized research using data on his previous pupils raises an immediate question: "What about the current ones". That question was not asked
The question is why he was engaging in a research activity without agreement from the subjects using his employer resources without an authorization for that.
Without knowing more about the nature of the research activity and the dataset retained it is difficult to determine the legitimacy of the research activity and use of school resources.
However, I suspect like many teachers he was tasked with improving standards and one of the ways to improve standards is to collect data and review so as to determine what went well, what could be done better, and what you would do differently, thus the dataset would reflect what he regarded as being relevant and potentially useful. Data can include SATs results, samples of pupils work, etc. Naturally in the school context, it would be normal not to anonymise data, thus the data becomes categorised as personal.
Thus the issue that was picked up on was the taking a copy of this data outside of the school in which it was originally collected and processed.
Given with GDPR, the world has changed, it is irritating that the ICO hasn't released more details so that others (ie. general public) can be more aware of what is now regarded as unacceptable data handling and processing.
The truth is this processing would have been inappropriate under the old DPA let alone GDPR.
The data was originally processed for the purposes of the children's education at their schools of which the parents were notified. Any new processing would be in breach as it wasn't specified at the outset and you couldn't even argue this new use would have been a 'reasonable expectation'.
That said you'd be astounded (actually this is El Reg so I expect many of you learned colleagues wouldn't be) at how many people I dealt with in my past life at the ICO that didn't consider it a reasonable expectation that if they didn't pay their loan/credit card/mortgage then the lender would share data with bailiffs to get their money back!!
This post has been deleted by its author
I work IT in schools.
It's not at all UNUSUAL (though it's wrong, I tell them off about it, etc.) for teachers to join a new school, after having just copied their entire profile folder across to a stick, and then expect the IT department to just copy "everything" across to their new user at the new school.
Coupled in that, for senior staff, are likely to be any number of spreadsheets, CSVs and other data dumps.
Why? "Because those are my teaching resources and I need them all or I can't teach".
More generally, it's denied by myself on copyright grounds (e.g. entire copies of textbooks and subscription material that we don't have a subscription for, etc.) but it's not at all unusual to see other school's data in there, even things like privileged information (SEN, medical, etc.).
@AC "it's not unusual"
I spent a little time doing IT in junior schools, and I don't think teachers consider Data Protection, or Copyright or anything really. One IT co-ordinator wanted to teach the kids how to use email, so asked me to enroll them on the Internet facing, real email system. Well, Crapita charged us per head, and it could have exposed kids to all sorts of nasties, so that was a 'no'.
>Is there a transcript of the Court session, and/or the ICO's findings available?
https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/12/former-headteacher-prosecuted-for-unlawfully-obtaining-school-children-s-personal-information/
(Although this guy is Darren and not David!)
"Professional Reasons"???? Like what, finding them again and stalking them?
This just reeks of something dodgy, also, why would you copy it up, why not just leave it on the USB stick. I don't quite understand the premise of copying a shedload of personal data up there. Not only that, and yes extreme situation, he lost the stick and some child molester got hold of it.
That fine was poor, the judgement was weak, he should have been given a significantly harsher sentence for that. Hell, someone nicks something from intel and they go to prison, you put hundreds of children at risk and you get fined £700.... Joke, absolute joke.
Maybe not, if there was not time inside then it may not class as an offence which prevents him from teaching. A lot of employment (and public service) has thresholds which need to be passed before you are barred, I think to be an elected Public Official it is less than 30 days inside? Probably wrong but you get the idea.
Just quickly checked and to be a councillor you have to have served less than 3 months yet to be an MP it goes up to less than one year...how perverse is that? The more power you have the more of a criminal you can be
IANAL but I am a school governor and I can assure you that he is unlikely to ever get a senior leadership job in teaching again.
As part of standard school recruitment practices (known as Safer Recruitment) every candidate undergoes a background check, including a DBS which would bring up his record.
Given the circumstances of his offence it's unlikely he would even be called for an interview.
>now and as such will probably never teach again
Depends on the detail - prohibition isn't necessarily lifetime and teachers can re-apply. All the adjudications are published (link below is the last couple of years - in the scheme of things he's more muppet than master villain)
https://www.gov.uk/government/collections/teacher-misconduct
"finding them again and stalking them?"
"reeks of something dodgy"
"lost the stick and some child molester got hold of it"
"significantly harsher sentence"
"hundreds of children at risk"
Eh, my theregister.co.uk bookmark has taken me to the Daily Mail website or some such.
Some folk really do get themselves over excited. It's a wonder they can nod off at night.
>"Professional Reasons"???? Like what, finding them again and stalking them?
You'd be surprised how many people out there are really not interested in children as sex toys. Some individuals are actually interested in nurturing them by helping to educate them and guide them towards adulthood. They might even make a career of it.
Teaching is increasingly a crap job that only a naive idiot would attempt. I've been married to a (thankfully now retired) teacher for my whole working life so in addition to seeing first hand how they get abused I've had to subsidize their vocation (they need to be married to a decent earner). This fellow did what many teachers do, they keep records of their charges to track how effective their teaching is over time. His mistake was to transfer 'computer' records instead of just keeping his old grade books.
Honestly, do parents feel their offspring are so unique that the world is lying in wait just to use them for their evil perversions? How weird.
"Hell, someone nicks something from intel and they go to prison, you put hundreds of children at risk and you get fined £700.... Joke, absolute joke."
Not wishing to get too side tracked but in fairness to the courts and indeed most public bodies at least it went to court.
Personally, I'm still waiting for the first, UK, senior banker to be charged with anything over the 2008 banking crisis...Society has some quirks still.
The fact the fine is small points to it being a stupid idea on his behalf, rather than any nonsense imagined by the Daily Mail reader in our midst.
Processing data at home would be far worse though, wouldn't it?
He then lied when he realised it was a serious mistake and thought the "bumbling idiot" defence might work.
I think the lie will stop him teaching again.
Going by all the teachers I know and have worked with for the last 13 years? Its probably just a case of him having copied his personal drive and the shared drive when he left each school, then dumped the lot on the new school's server.
A lot of teachers have a poor grasp of the idea of data security of copyright. The idea that the work they've done at a school doesn't belong to them and they have no entitlement to it is an alien concept. The idea that they need to be careful with data is similarly often an alien concept. They simply don't think about that.
Teachers suffer from a sort of tunnel vision - they only care about what specific thing they're doing at that time, and ignore everything else. So, he likely didn't even consider what he was doing when he did it.
They are strange. Very strange.
I once went to the retirement party of a woman who has spent her entire working life doing secretarial work. The result was we were a mix of people from all walks of life, making for an extremely interesting party. There was one small group though that coalesced in one corner of the room and didn't interact with any of the rest of us - they were all primary school teachers!
The have such precision so that the details aren't scrutinised. If they claimed £400, people would say "isn't it funny that your expenses came to such a round number? Especially when nothing is sold in whole pounds"
Perhaps they bought 92 things whose price ended with 99p?
Note that precision and accuracy are different things though.
To those asking why he did it I would reply that we can imagine a lot of possible reasons, some of which may or may not be bad intentions, but in this way we miss the real issue, what could be the consequences? Copied data can no longer be tracked, it was found only because the teacher was naive, but the same data could have easily been lost or sold for a song, since teachers don't have a high income sooner or later they might be tempted to cash the data they have.
How come it was so easy to put everything on a USB stick? If many comments, I am reading here, are right the personal folder of a teacher in a normal school might contain all the data about the pupils instead of containing just links to the student records. So with just few clicks a teacher can download everything. If that's true it means that a lot of schools rely on an amateurish way of structuring the data that is prone to abuse or accidental leaks.
*ALL* schools rely on random spreadsheets for something or other, for one simple reason - there isn't a single data tool for schools that can do everything they need in one package. So, schools end up with various products that regularly don't fully integrate with each other. So you end up with exports of data.
Also, take into account the fast moving target that is the DFE. They bring in new schemes and programmes constantly, so developers often don't have much time to get things in place - and schools less so. So, more spreadsheets.
Finally, throw into the mix a shrinking budget, lack of data expertise and urgency in generating a lot of information at times, and spreadsheets rule in schools. Especially in Primary Schools.
Also, teachers are all individual agents. Each will be given tasks, or will create them. And find their own ways of performing them. So, need to mangle some data, bung it into a spreadsheet. Need a little database? Bung that in a spreadsheet too. (Databases like Access are too complex for the casual user and old fashioned flat database programmes seem to have vanished)
"verb
verb: download; 3rd person present: downloads; past tense: downloaded; past participle: downloaded; gerund or present participle: downloading
/daʊnˈləʊd/Submit
1.
copy (data) from one computer system to another, typically over the Internet."
He copied data from one system to another, using the medium of a USB stick. Technically, it fits in the definition of "download".
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
