Data Protection

Power_Button

Hi,

Just a quick query regarding data protection. My boss has created a spreadsheet where the entire department enters their holiday requests for the year.

However, he has also entered how many days each person has carried forward from last year and how many days they have left for this year.

Would this be a breach of the data protection act as a person's holiday balance is no concern to anyone but the boss and the person.

livedadream

No issue. Your holiday entitlement is not private personal data.
It's publication within the company is for business needs.

toadfly

Wouldnt think so. We have a holiday tracker as well in our dept, it just makes it easier to see what you have. Who else would care? Dont see an issue TBH

x43r0

Nope - Doesn't lie within the bounds of DPA as far as I know

We've got an internal scheduling tool which shows time for all billable staff (including holidays) and anyone can see anyone else's holidays

Mrs OBumble

livedadream wrote: »

No issue. Your holiday entitlement is not private personal data.
It's publication within the company is for business needs.

By that logic, it would be OK to put everyone's salary into the same spreadsheet! Shure it's just another number from their employment contract, just like their leave entitlement.


OP, I can see why a manager might think it's ok, especially if everyone gets the same holiday entitlement. But in reality holiday entitlements can vary for all sorts of reasons. Some people work part time. Some have been there forever and have longservice leave, or really really old contracts. Some agree more leave in exchange for less holidays. Some are just better negotiators. Etc.

Same with carry-overs: even if there's a policy of no more than X days, you can almost guarantee there will be exceptions agreed for whatever reason.


That said, it's not clear cut, and the point can be subtle.

I would identify something that could be sensitive about what is in the spreadsheet now (eg Millie was allowed to carry over extra days because she was in hospital last year and couldn't use her leave up, and then get someone who the manager trusts to quietly point out to him/her can be inferred from the spreadsheet.

Even better if the trusted person knows enough about spreadsheets to show the manager how to link one that only he can see to read from the public one, so the manager still have the summary but the workers cannot see it.

amcalester

Mrs OBumble wrote: »

By that logic, it would be OK to put everyone's salary into the same spreadsheet! Shure it's just another number from their employment contract, just like their leave entitlement.


OP, I can see why a manager might think it's ok, especially if everyone gets the same holiday entitlement. But in reality holiday entitlements can vary for all sorts of reasons. Some people work part time. Some have been there forever and have longservice leave, or really really old contracts. Some agree more leave in exchange for less holidays. Some are just better negotiators. Etc.

Same with carry-overs: even if there's a policy of no more than X days, you can almost guarantee there will be exceptions agreed for whatever reason.


That said, it's not clear cut, and the point can be subtle.

I would identify something that could be sensitive about what is in the spreadsheet now (eg Millie was allowed to carry over extra days because she was in hospital last year and couldn't use her leave up, and then get someone who the manager trusts to quietly point out to him/her can be inferred from the spreadsheet.

Even better if the trusted person knows enough about spreadsheets to show the manager how to link one that only he can see to read from the public one, so the manager still have the summary but the workers cannot see it.

The OP asked is there a Data Protection issue with doing this and was answered correctly.

What you're talking about is something different and falls under common sense.

Slydice

Power_Button wrote: »

Would this be a breach of the data protection act as a person's holiday balance is no concern to anyone but the boss and the person.

Could be.

https://www.dataprotection.ie/docs/Case-Study-3-2001-Employee-Performance-Ratings-Disclosed/123.htm

I also confirmed that the failure to implement appropriate access restrictions contravened the security requirements of the Act (section 2(1)(d)), and that the resulting dissemination of the file to other unauthorised staff members amounted to an incompatible disclosure of the personal data (contrary to section 2(1)(c)(ii) of the Act).

That's for appraisal though which would be a strong-case of sensitive data. I'd say amount of carry-over of annual leave is a weak case but might fall under the same area.

Contact the data protection office and ask em:
https://www.dataprotection.ie/docs/Contact-us/b/11.htm

livedadream

Mrs OBumble wrote: »

livedadream wrote: »

No issue. Your holiday entitlement is not private personal data.
It's publication  within the company is for business needs.

By that logic, it would be OK to put everyone's salary into the same spreadsheet!   Shure it's just another number from their employment contract, just like their leave entitlement.


OP, I can see why a manager might think it's ok, especially if everyone gets the same holiday entitlement.    But in reality holiday entitlements can vary for all sorts of reasons.   Some people work part time.  Some have been there forever and have longservice leave, or really really old contracts.   Some agree more leave in exchange for less holidays.  Some are just better negotiators.    Etc.

Same with carry-overs:  even if there's a policy of no more than X days, you can almost guarantee there will be exceptions agreed for whatever reason.


That said, it's not clear cut, and the point can be subtle.

I would identify something that could be sensitive about what is in the spreadsheet now   (eg Millie was allowed to carry over extra days because she was in hospital last year and couldn't use her leave up, and then get someone who the manager trusts to quietly point out to him/her can be inferred from the spreadsheet.      

Even better if the trusted person knows enough about spreadsheets to show the manager how to link one that only he can see to read from the public one, so the manager still have the summary but the workers cannot see it.

it is clear cut bumble, he asked a question: is it a breach of data protection and i answered.

the in's and outs of if it is good practice or not wasnt questioned.

no need to try to pick an argument there are plenty of threads that people would love to go back and forth with you on im sure.

Irish_Elect_Eng

Mrs OBumble wrote: »

By that logic, it would be OK to put everyone's salary into the same spreadsheet! Shure it's just another number from their employment contract, just like their leave entitlement.

That prompts the question, why not share salary information?

I worked at two companies where, by policy the salaries & bonus terms of every employee was public knowledge, and available on the company Intranet. It gave the employees a lot of knowledge when it came to negotiating their salaries.

To be honest the only beneficiary of salary secrecy is the company.

Is there any law that prevents sharing this information?
After all your salary is not personal information, it is more like business data.

Edit: Noted that on an old contract there was an opt-out for employees in some countries, but I do not remember anybody doing so.

livedadream

Nothing in company law or employment law...