Headteacher who breached data protection laws fails to overturn finding that she brought profession into disrepute

In Aquilina v Secretary of State for Education a headteacher sought to argue that the regulator had incorrectly interpreted statutory provisions relating to the conduct of teachers after it had found that she had shared confidential emails with her husband and, in doing so, may have brought the teaching profession into disrepute. 

Facts

Mrs Aquilina was the headteacher of a school from 2015 until 2020. She shared confidential information about some of her pupils with her husband, Canon Aquilina, to obtain his advice. That information included identifying a child who was involved with social services; information about a child who had alleged she had been inappropriately touched by another pupil; and an email from a parent expressing their child's feelings of being embarrassed and humiliated after a fight with another pupil.

Canon Aquilina provided some pastoral support on an informal basis to the school but was not employed to do so. 

The unlawful disclosure of the information came to light after a parent made a data subject access request (DSAR).

Mrs Aquilina was dismissed. The school referred her to the Teaching Regulation Agency and a professional conduct panel (PCP) reviewed the case. It was satisfied that her conduct breached Teacher's Standards, specifically that:

• Teachers uphold public trust in the profession and maintain high standards of ethics and behaviour
• Teachers must have proper and professional regard for the ethos, policies and practices of the school
• Teachers must have an understanding of, and always act within, the statutory frameworks which set out their professional duties and responsibilities

The panel found that she had committed misconduct, but not gross misconduct, and it was satisfied that she was not guilty of unacceptable professional conduct.

It did, however, find that Mrs Aquilina had engaged in conduct that could bring the profession into disrepute on the basis that it was a ‘basic and essential requirement that teachers do not share confidential information’, she had been a headteacher at the school for over five years, was an experienced teacher and had gone through relevant training. She should, therefore, have been aware that her actions had been unprofessional and wrong and were likely to undermine public trust in the profession.

The panel then considered whether to recommend that the Secretary of State issue a prohibition order to prevent her from being able to teach in the future. There are two aspects to this. It has to be an appropriate and proportionate response, and be in the public interest. It decided against making a referral because Mrs Aquilina's conduct was at the ‘less serious end of the possible spectrum’. She had also apologised and accepted responsibility for what she had done and was not likely to make the same mistake again. 

The Secretary of State agreed with the PCPs decision and said that publishing the findings against Mrs Aquilina was sufficient to address her misconduct.

That would have been an end to the matter but for Mrs Aquilina's decision to bring a judicial review of the PCPs finding that her conduct may have brought the teaching professional into disrepute.

Legal framework

The Secretary of State is responsible for regulating teachers' conduct and for holding a list of teachers who have been prohibited from teaching. 

The legal framework governing the regulation of teachers is contained in Part 8 of the Education Act 2002 and the Teachers' Disciplinary (England) Regulations 2012. Guidance as to the process to be followed is set out in separate guidance: Teacher misconduct: disciplinary procedures for the teaching profession, 2020. S141B of the Education Act 2002 gives the Secretary of State discretion to investigate a case where a person is guilty of unacceptable professional conduct or conduct that may bring the teaching profession into disrepute.

Outcome of Judicial Review proceedings

Mrs Aquilina said that the two limbs to section 141B are mutually exclusive. She argued that the first applies to professional conduct and the second to non-professional conduct. This meant that once the PCP has concluded that the conduct in question is professional (i.e. it relates to teaching) the issue is whether that conduct is unacceptable. It was not open to the PCP to conclude that conduct is professional but not unacceptable but can, nonetheless, bring the teaching profession into disrepute. 

The Hight Court rejected Mrs Aquilina's arguments. It held that the wording of section 141B was intended to capture a wide range of conduct and it was correct for the PCP to decide where the line needs to be drawn in a particular case.  

Lessons for other schools and colleges

1. Referrals to the Teacher Regulation Agency

You can only report serious teacher misconduct to the Teacher Regulation Agency. Serious misconduct is any behaviour that could result in a teacher not being allowed to teach again. This includes:

• sexual misconduct, including assault, abuse or harassment
• violent behaviour
• serious failure to protect the safety and wellbeing of pupils
• alcohol or drug misuse
• fraud or serious dishonesty
• discrimination or harassment
• promoting extreme political or religious views

This decision demonstrates that data protection breaches can also trigger a referral.

2. Training

We recommend that you ensure that the training you provide to staff on data protection is:

• up to date and repeated at least every two years
• explains the legal framework 
• clearly sets out who is responsible for making sure data is processed securely and the different levels of knowledge required for governors and trustees, senior leaders and all other staff
• explains that children are considered to be vulnerable data subjects; and
• provides realistic case studies to highlight the issues teachers may have to deal with including how to report personal data breaches and how to deal with requests for information 

The DfE has recently updated its guidance on data protection in schools which explains who is responsible for making sure data is processed securely in a school. It explains that senior leaders need to have more knowledge than teachers as they are more likely to have to decide when it is appropriate to share data about children to other people. Mrs Aquilina did receive training on GDPR, but it was fairly generic, doesn't appear to have been tailored to a school setting and was clearly lacking in detail given that she genuinely believed that she could share emails with her husband to obtain his counsel under the terms of the privacy notice the school provided to its pupils. 

We can help

We have provided bespoke data protection training to a number of education clients to help senior leaders and other members of staff understand what they can and can't do in terms of sharing data. Please get in touch with Joanne Bone for more information. 

Our newsletters

We publish monthly employment and education newsletters. If you'd like to be added to the mailing list, please let me know.