Former headteacher fined £700 after dumping old pupil data on server at new school

A former headteacher has landed himself in hot water with the UK's data watchdog for downloading personal information on children he previously taught and uploading it to servers at his new school.

Darren Harrison, of Twickenham, loaded pupils' data from two primary schools on a USB stick then took it to his new place of work, Isleworth Primary School, where he was deputy head.

Six months into that role Harrison was suspended, and a subsequent IT audit revealed that he'd transferred the "large volumes of sensitive personal data" on his former students at Spelthorne Primary and The Russell School to the Isleworth server.

The Information Commissioner's Office said Harrison had no lawful reason to process the data, which meant he breached data protection legislation. Nor did he give a valid explanation as to how the data was transported, "stating he had deleted" the information from his USB stick.

Q: If Pesky Pepper had a peek at patient papers, at how many patient papers did Pesky Pepper peek? A: 231

READ MORE

In a later interview with the ICO, Harrison told the watchdog he took the information for "professional reasons". He appeared before Ealing Magistrates' Court to admit two offences of unlawfully obtaining personal data in breach of s55 of the Data Protection Act 1998.

Harrison was fined £700 and told to cough £364.08 in costs and a victim surcharge of £35.

"Children and their parents or guardians have the right to expect that their personal data is treated with respect and that their legal right to privacy is adhered to," said Mike Shaw, the ICO's criminal investigation group manager.

"A headteacher holds a position of standing in the community and with that position comes the added responsibility to carry out their role beyond reproach." ®