back to article Former headteacher fined £700 after dumping old pupil data on server at new school

A former headteacher has landed himself in hot water with the UK's data watchdog for downloading personal information on children he previously taught and uploading it to servers at his new school. Darren Harrison, of Twickenham, loaded pupils' data from two primary schools on a USB stick then took it to his new place of work …

  1. ShortLegs

    It begs the question "why?"

    Why would a headmaster - or any teacher - want pupil data from a previous school in his new position. More worryingly, why lie that the data had been deleted, especially so when it is common knowledge that data doesn't just copy itself from a device, but has to be manually copied.

    Is there a transcript of the Court session, and/or the ICO's findings available?

    1. Killfalcon Bronze badge

      Damned if I know. Test data for some sort of database project, maybe? Comparison between progress of kids at the previous schools and his new one?

      1. Teiwaz Silver badge

        It begs the question "why?"

        Why would a headmaster - or any teacher - want pupil data from a previous school in his new position

        I can't think it'd be possible or even wise to headhunt well performing pupils from previous schools for a new post at a struggling one institution.

        But such we have come to with the League Table nonsense.

    2. Anonymous Coward
      Anonymous Coward

      So he can use it as a measure of his ability based on how the pupils from each school did with their education.

      That's all I can think of.

    3. big_D Silver badge

      Personal data covers a lot of sins. It could be anything from contact details, through attendance records and grades, school reports or simply example texts the pupils wrote or example tests, which still had the pupils names on them. Or non-anonymised test data for an application.

      Without context, it sounds bad. But the context would let us know how bad it was. As it is, the news is incomplete and leaves us playing guessing games.

      1. jh27

        Not Personal - Sensitive Personal

        The article says 'sensitive personal data', i.e:

        1. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs;

        2. trade-union membership;

        3. genetic data, biometric data processed solely to identify a human being;

        4. health-related data;

        5. data concerning a person’s sex life or sexual orientation

        As it is a school, I guess it is probably either number 1 or number 4

    4. LDS Silver badge

      "It begs the question "why?"

      They found he after it was suspended. Maybe the reason is connected to that suspension?

    5. Voland's right hand Silver badge

      Why would a headmaster - or any teacher - want pupil data from a previous school in his new position.

      Exactly the reason stated - research.

      The question is why he was engaging in a research activity without agreement from the subjects using his employer resources without an authorization for that.

      The court and the ICO did not dig as deep as they should.

      The fact that he was doing unauthorized research using data on his previous pupils raises an immediate question: "What about the current ones". That question was not asked

      1. Roland6 Silver badge

        The question is why he was engaging in a research activity without agreement from the subjects using his employer resources without an authorization for that.

        Without knowing more about the nature of the research activity and the dataset retained it is difficult to determine the legitimacy of the research activity and use of school resources.

        However, I suspect like many teachers he was tasked with improving standards and one of the ways to improve standards is to collect data and review so as to determine what went well, what could be done better, and what you would do differently, thus the dataset would reflect what he regarded as being relevant and potentially useful. Data can include SATs results, samples of pupils work, etc. Naturally in the school context, it would be normal not to anonymise data, thus the data becomes categorised as personal.

        Thus the issue that was picked up on was the taking a copy of this data outside of the school in which it was originally collected and processed.

        Given with GDPR, the world has changed, it is irritating that the ICO hasn't released more details so that others (ie. general public) can be more aware of what is now regarded as unacceptable data handling and processing.

        1. Cynical Pie

          The truth is this processing would have been inappropriate under the old DPA let alone GDPR.

          The data was originally processed for the purposes of the children's education at their schools of which the parents were notified. Any new processing would be in breach as it wasn't specified at the outset and you couldn't even argue this new use would have been a 'reasonable expectation'.

          That said you'd be astounded (actually this is El Reg so I expect many of you learned colleagues wouldn't be) at how many people I dealt with in my past life at the ICO that didn't consider it a reasonable expectation that if they didn't pay their loan/credit card/mortgage then the lender would share data with bailiffs to get their money back!!

    6. Graham Butler

      Maybe with the intent of contacting them/their parents when of eligible age to enrol in his new school? I don't know what the usual processes are for "marketing" schools, but I imagine there has to be some level of "we're great, come to us" going on.

    7. This post has been deleted by its author

    8. Anonymous Coward
      Anonymous Coward

      I work IT in schools.

      It's not at all UNUSUAL (though it's wrong, I tell them off about it, etc.) for teachers to join a new school, after having just copied their entire profile folder across to a stick, and then expect the IT department to just copy "everything" across to their new user at the new school.

      Coupled in that, for senior staff, are likely to be any number of spreadsheets, CSVs and other data dumps.

      Why? "Because those are my teaching resources and I need them all or I can't teach".

      More generally, it's denied by myself on copyright grounds (e.g. entire copies of textbooks and subscription material that we don't have a subscription for, etc.) but it's not at all unusual to see other school's data in there, even things like privileged information (SEN, medical, etc.).

      1. GruntyMcPugh Silver badge

        @AC "it's not unusual"

        I spent a little time doing IT in junior schools, and I don't think teachers consider Data Protection, or Copyright or anything really. One IT co-ordinator wanted to teach the kids how to use email, so asked me to enroll them on the Internet facing, real email system. Well, Crapita charged us per head, and it could have exposed kids to all sorts of nasties, so that was a 'no'.

        1. Is It Me

          With Office 365 and Google Apps for Education being free for schools it seems insane that Capita wanted money for it.

          Also both of them can be configured so that the pupils can only mail accounts within the some domain etc.

          so can be set up in a useful way.

    9. Random Handle

      >Is there a transcript of the Court session, and/or the ICO's findings available?

      https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/12/former-headteacher-prosecuted-for-unlawfully-obtaining-school-children-s-personal-information/

      (Although this guy is Darren and not David!)

  2. RGE_Master

    "Professional Reasons"???? Like what, finding them again and stalking them?

    This just reeks of something dodgy, also, why would you copy it up, why not just leave it on the USB stick. I don't quite understand the premise of copying a shedload of personal data up there. Not only that, and yes extreme situation, he lost the stick and some child molester got hold of it.

    That fine was poor, the judgement was weak, he should have been given a significantly harsher sentence for that. Hell, someone nicks something from intel and they go to prison, you put hundreds of children at risk and you get fined £700.... Joke, absolute joke.

    1. Anonymous Coward
      Anonymous Coward

      As he was convicted in a court, I presume he's got a criminal record now and as such will probably never teach again so every cloud etc.

      1. Kevin Johnston

        Maybe not, if there was not time inside then it may not class as an offence which prevents him from teaching. A lot of employment (and public service) has thresholds which need to be passed before you are barred, I think to be an elected Public Official it is less than 30 days inside? Probably wrong but you get the idea.

        Just quickly checked and to be a councillor you have to have served less than 3 months yet to be an MP it goes up to less than one year...how perverse is that? The more power you have the more of a criminal you can be

        1. mr-slappy

          IANAL but I am a school governor and I can assure you that he is unlikely to ever get a senior leadership job in teaching again.

          As part of standard school recruitment practices (known as Safer Recruitment) every candidate undergoes a background check, including a DBS which would bring up his record.

          Given the circumstances of his offence it's unlikely he would even be called for an interview.

      2. Anonymous Coward
        Anonymous Coward

        >now and as such will probably never teach again

        Depends on the detail - prohibition isn't necessarily lifetime and teachers can re-apply. All the adjudications are published (link below is the last couple of years - in the scheme of things he's more muppet than master villain)

        https://www.gov.uk/government/collections/teacher-misconduct

    2. Anonymous Coward
      Anonymous Coward

      "finding them again and stalking them?"

      "reeks of something dodgy"

      "lost the stick and some child molester got hold of it"

      "significantly harsher sentence"

      "hundreds of children at risk"

      Eh, my theregister.co.uk bookmark has taken me to the Daily Mail website or some such.

      Some folk really do get themselves over excited. It's a wonder they can nod off at night.

    3. martinusher Silver badge

      Re: Professional Reasons?

      >"Professional Reasons"???? Like what, finding them again and stalking them?

      You'd be surprised how many people out there are really not interested in children as sex toys. Some individuals are actually interested in nurturing them by helping to educate them and guide them towards adulthood. They might even make a career of it.

      Teaching is increasingly a crap job that only a naive idiot would attempt. I've been married to a (thankfully now retired) teacher for my whole working life so in addition to seeing first hand how they get abused I've had to subsidize their vocation (they need to be married to a decent earner). This fellow did what many teachers do, they keep records of their charges to track how effective their teaching is over time. His mistake was to transfer 'computer' records instead of just keeping his old grade books.

      Honestly, do parents feel their offspring are so unique that the world is lying in wait just to use them for their evil perversions? How weird.

    4. Ucalegon

      "Hell, someone nicks something from intel and they go to prison, you put hundreds of children at risk and you get fined £700.... Joke, absolute joke."

      Not wishing to get too side tracked but in fairness to the courts and indeed most public bodies at least it went to court.

      Personally, I'm still waiting for the first, UK, senior banker to be charged with anything over the 2008 banking crisis...Society has some quirks still.

  3. John Savard Silver badge

    Puzzling

    Why on Earth would he risk detection by placing data on the server of a school concerning students who are not at that school?

    One would have expected him to do any processing on that data he felt he needed to do for "professional reasons" on his computer at home.

    1. Test Man

      Re: Puzzling

      Because he was an idiot.

      Logic doesn't always apply.

    2. myhandler

      Re: Puzzling

      The fact the fine is small points to it being a stupid idea on his behalf, rather than any nonsense imagined by the Daily Mail reader in our midst.

      Processing data at home would be far worse though, wouldn't it?

      He then lied when he realised it was a serious mistake and thought the "bumbling idiot" defence might work.

      I think the lie will stop him teaching again.

    3. Billius

      Re: Puzzling

      My guess would be that he wanted to compare metrics between the schools, maybe so he could go on to say that under his rule, the school's grades, attendance, etc improved when he arrived.

      1. Danny 14 Silver badge

        Re: Puzzling

        copies of sats results is personal data. It wouldnt be beyond the realm of impossibility that a head teacher had a copy of SATS results from a previous school. Comparisons with learning trends at schools are not uncommon.

  4. localzuk

    Those asking "why?"

    Going by all the teachers I know and have worked with for the last 13 years? Its probably just a case of him having copied his personal drive and the shared drive when he left each school, then dumped the lot on the new school's server.

    A lot of teachers have a poor grasp of the idea of data security of copyright. The idea that the work they've done at a school doesn't belong to them and they have no entitlement to it is an alien concept. The idea that they need to be careful with data is similarly often an alien concept. They simply don't think about that.

    Teachers suffer from a sort of tunnel vision - they only care about what specific thing they're doing at that time, and ignore everything else. So, he likely didn't even consider what he was doing when he did it.

    1. Danny 14 Silver badge

      Re: Those asking "why?"

      after going through a couple of subject access requests we ran a few inset sessions on how to anonymise data so that it is useful but not data. Works a treat in minutes and emails, means i dont have to go on a redaction spreee too.

  5. zapper

    Its simple

    copy the USB to your personal space. Lesson plans you have been using since year dot. oops two zipped files of last years student list also got copied...... and you have now committed a crime.

    Not a stalker, Not a 'pedo' Not a dailymail reader in sight.....

    Z

  6. 10forcash Bronze badge

    Victim surcharge of £35

    Is that each?

  7. e^iπ+1=0

    Pee dough

    'nuff said.

    1. Danny 14 Silver badge

      Re: Pee dough

      idiot.

  8. Will Godfrey Silver badge
    Childcatcher

    He had been a primary school teacher

    They are strange. Very strange.

    I once went to the retirement party of a woman who has spent her entire working life doing secretarial work. The result was we were a mix of people from all walks of life, making for an extremely interesting party. There was one small group though that coalesced in one corner of the room and didn't interact with any of the rest of us - they were all primary school teachers!

    1. Danny 14 Silver badge

      Re: He had been a primary school teacher

      ive found the opposite, most primary school teachers work together and party harder with adults. senior school teachers tend not to trust each other and booze more than submarine sailors in port.

  9. The Nazz Silver badge

    Costs of £364.08

    An enquiring mind wonders what the 8p was for?

    Probably cost the CPS, or whoever, far more than 8p to tally the costs so precisely.

    1. F Seiler

      Re: Costs of £364.08

      Likely the result of a factor applied on the total or a part.

      It is for example 148% of 246 (resp. 26% off of 492).

    2. Anonymous Coward
      Anonymous Coward

      Re: Costs of £364.08

      The judge counts the number of pees he has during a trial, in this case he had 8 pees. Helps them remember for when they go to the doctors.

      1. Jay Lenovo Silver badge

        Re: Costs of £364.08

        8P ?

        A coy suggestion to the guilty about the significance of change?

        Or maybe whatever numbers the judge found in his lunchtime fortune cookie.

    3. Anonymous Coward Silver badge
      Headmaster

      Re: Costs of £364.08

      The have such precision so that the details aren't scrutinised. If they claimed £400, people would say "isn't it funny that your expenses came to such a round number? Especially when nothing is sold in whole pounds"

      Perhaps they bought 92 things whose price ended with 99p?

      Note that precision and accuracy are different things though.

  10. clyde666

    teachers

    Goodness sake folks, this is a school teacher we're talking about.

    Some of you actually expect him (or her) to have an understanding of how computers work ...

  11. devTrail

    The wrong question

    To those asking why he did it I would reply that we can imagine a lot of possible reasons, some of which may or may not be bad intentions, but in this way we miss the real issue, what could be the consequences? Copied data can no longer be tracked, it was found only because the teacher was naive, but the same data could have easily been lost or sold for a song, since teachers don't have a high income sooner or later they might be tempted to cash the data they have.

    How come it was so easy to put everything on a USB stick? If many comments, I am reading here, are right the personal folder of a teacher in a normal school might contain all the data about the pupils instead of containing just links to the student records. So with just few clicks a teacher can download everything. If that's true it means that a lot of schools rely on an amateurish way of structuring the data that is prone to abuse or accidental leaks.

    1. localzuk

      Re: The wrong question

      *ALL* schools rely on random spreadsheets for something or other, for one simple reason - there isn't a single data tool for schools that can do everything they need in one package. So, schools end up with various products that regularly don't fully integrate with each other. So you end up with exports of data.

      Also, take into account the fast moving target that is the DFE. They bring in new schemes and programmes constantly, so developers often don't have much time to get things in place - and schools less so. So, more spreadsheets.

      Finally, throw into the mix a shrinking budget, lack of data expertise and urgency in generating a lot of information at times, and spreadsheets rule in schools. Especially in Primary Schools.

      1. Terry 6 Silver badge

        Re: The wrong question

        Also, teachers are all individual agents. Each will be given tasks, or will create them. And find their own ways of performing them. So, need to mangle some data, bung it into a spreadsheet. Need a little database? Bung that in a spreadsheet too. (Databases like Access are too complex for the casual user and old fashioned flat database programmes seem to have vanished)

  12. J.G.Harston Silver badge

    He didn't download it, he copied it.

    He didn't load it to a USB stick, he saved it to a USB stick.

    Gave up at that point.

    1. devTrail

      You're being a bit fussy here, after all the action results in taking the data from a server and saving the data on a local drive.

    2. localzuk

      "verb

      verb: download; 3rd person present: downloads; past tense: downloaded; past participle: downloaded; gerund or present participle: downloading

      /daʊnˈləʊd/Submit

      1.

      copy (data) from one computer system to another, typically over the Internet."

      He copied data from one system to another, using the medium of a USB stick. Technically, it fits in the definition of "download".

      1. SWCD

        "He copied data from one system to another, using the medium of a USB stick. Technically, it fits in the definition of "download"."

        It may fit that definition there... but the OP, me, likely you, and most other readers on here can make a distinction between a copy and a download surely?

        1. localzuk

          That's the thing though, words are what people use them for. I'd suggest more people would use "download" in the loose method used here than use it just in the more limited way technical people would use it.

          Example - literally.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019