GDPR -new employer excluding me from communication

LegacyUser

Hi.

I have been employed with an agency for over a decade and no issues with communication via email, phone etc...
I changed agency almost a year ago.
Exact same job, same clients, different agency.

To my astonishment, initial emails, before my contract even started, included around 80 full names of colleagues and their email addresses, ie: not using bcc in emails.
I don't know these colleagues, we all work independently of one another. I recognised some names, they were former colleagues over the years.

I'm very private and only share my details wherever necessary.

I brought this to the attention of my new manager, and told them that I wasn't happy with my personal details being sent to all these people.
They agreed that this shouldn't be happening.
This was weeks before the new GDPR legislation which, let's face it, everyone knew about.

It happened again and I brought it to the attention of another colleague in management- I also know this person better as we've worked together in the past.
The original manager has since left and their position is only being filled in the coming weeks.

Since then I've 2 issues.
Firstly, I'm not receiving some important emails regarding work; I know this as one of my close friends is in the same role and we both changed to this new employer at the same time.
This friend has forwarded me some of these emails, 3 in the last fortnight which were important- none of which I received.

Secondly, work hasn't changed the fact that the remaining names and addresses are still being shared.
On one occasion a personal email to a colleague, was included in a general email sent.

So essentially they removed my name etc...from their list, so I don't receive everything, only some, depending on who in administration is messaging.

Am I totally wrong in thinking that they shouldn't be sharing personal details?
How do I deal with it from here, considering I've already said it twice?
I'm happy in my job but this is annoying as it's so easily rectified. And I don't want to be called a trouble maker when I'm not, I hate confrontation.

https://jrnl.ie/4393714 something not dissimilar to this.

Thank you for reading.

beauf

Contact your or their Data Protection Officer.

OMM 0000

To my astonishment, initial emails, before my contract even started, included around 80 full names of colleagues and their email addresses, ie: not using bcc in emails.

I think you're wrong that you think it's a problem you can see your colleagues names and e-mail addresses on company wide e-mails. It is absolutely normal you should know the names of your colleagues, and how to contact them.

You are absolutely a trouble maker by making a big deal of this. Frankly it is bizarre and extreme behaviour.

I'm not receiving some important emails regarding work

I think the company probably got a bit freaked out by your claim that you don't want your colleagues to know your name and e-mail address, and that you don't want to know their names or e-mail addresses, so they're just excluding you from communications.

I think you should probably apologise to the managers for misunderstanding what GDPR is, and for being so extreme.

I feel I must be misunderstanding something here.

beauf

I assume he switched agency but has the same contact, job. Might be an issue if the original agency found out.

Your name and where your working is personal information but gdpr would only apply if they were using where they didn't need to. Giving it to a third party for advertising or such. They didn't in this case. It's just normal business communication.

The rest of it seems to be that the email lists are poorly managed by whom ever looks after them. I would doubt if there is intent to exclude the op.

In any case the company should have a policy and the data protection officer will be able to tell you what that is.

AndrewJRenko

Are you an employee of the agency or a contractor of the agency?

This sounds more like a contractor scenario, in which case it is a commercial relationship between you and the agency. If they're not doing what you need, you need to have that discussion out with them.

Not using bcc is a bad idea. If you want to get pushy with them, you could report this to the Data Protection Commissioner, though they may have bigger fish to fry.

HandsomeBob

Your link is a blatant breach....the one you describe not so much.

Bcc is rarely used in this day and age when circulating internal emails in a professional environment and is actually asking for trouble.

I assume you were assigned a work domain when contracted to it and that all the other emails were also work domains. If that's the case I can't see an argument for a breach but as others have said report it to the data security team if you feel there has been.

beauf

HandsomeBob wrote: »

..Bcc is rarely used in this day and age when circulating internal emails in a professional environment and is actually asking for trouble......

Where did you get that from.

BCC should be the standard for bulk emails. No?

https://www.itgovernance.co.uk/blog/the-gdpr-affects-the-use-of-email-too

HandsomeBob

beauf wrote: »

Where did you get that from.

BCC should be the standard for bulk emails. No?

https://www.itgovernance.co.uk/blog/the-gdpr-affects-the-use-of-email-too

Doesn't say whether it was an internal mail or a mail to external recipients/clients. Based on the attached sounds like the latter which of course is a stone wall breach.

LegacyUser

OMM 0000 wrote: »

I think you're wrong that you think it's a problem you can see your colleagues names and e-mail addresses on company wide e-mails. It is absolutely normal you should know the names of your colleagues, and how to contact them.

You are absolutely a trouble maker by making a big deal of this. Frankly it is bizarre and extreme behaviour.

I think the company probably got a bit freaked out by your claim that you don't want your colleagues to know your name and e-mail address, and that you don't want to know their names or e-mail addresses, so they're just excluding you from communications.

I think you should probably apologise to the managers for misunderstanding what GDPR is, and for being so extreme.

I feel I must be misunderstanding something here.

OP here.
You are misunderstanding.
I think you calling me a trouble maker isn't fair.
I'm very respected and valued in my work.
If I was a trouble maker I could report the agency for this, I'm trying to sort it out without causing hassle.

I do not need to know these colleagues names or email addresses. And they don't need to know mine.
They don't work directly with me.
They live and work hours away from me.
I have no reason to contact them or them me.
We are merely employed by the same agency- that is the only similarity.

To repeat what I've said in original post, I've never had this experience before with previous employers.
And they had far more employees than this organisation. bcc was always used.

I've attended Data Protection talks before, so feel I know what I'm talking about.
I know the agency isn't going to use my personal details inappropriately, but I can't say that about anyone else who can access this information.

@beauf- I agree that the intent isn't to exclude me.
It's like the administration staff doesn't know how to manage their list properly.
I don't feel it's my place to tell them how to do this.
And having relayed it twice to management, nothing has changed.

@AndrewJRenko I'm employed by the agency, who won the tender for this particular contract.

@HandsomeBob- in the decade I've worked in my current position, I've only ever seen bcc used for bulk emails.

While these are internal emails, there has already been an error where a specific email for one employee was accidentally sent to all employees.
This shouldn't have happened.

Having read the link from beauf, I really do feel the issue is that the administration staff just doesn't know how to edit emails, use bcc etc..but is it my place to say this?

I'm not making a mountain out of a molehill.
I'm merely trying to do my job as best I can, but these emails are relevant to work and clients, yet I'm not receiving them.

Thank you all for your input, I appreciate it.

beauf

See dumb stuff with emails, every other week at work.

You might just want to find out is there a workflow, work guild lines around email lists.

Just be the squeaky wheel and bug them till they fix it.

Pelvis

Are these personal email addresses you are seeing?

EdgeCase

A lot of people seem to be unable to understand the difference between CC and BCC.

It's not 1996, and people should be well used to email at this stage, yet I still get emails like this from various individuals and agencies from time to time, exposing entire mailing lists sometimes. Even after GDPR it's still a once in a while occurrence.

When I get an email like that, I usually respond to the sender (only) and point out that they've accidentally used CC instead of BCC and, for data protection reasons, they might consider using BCC in future.

Usually it's caused by one individual who doesn't know how to use Outlook. You'd be surprised at how IT illiterate some people in offices can be. In a lot of cases, they can barely use a the software they're using every day.

skallywag

Annoyingly annoyed wrote: »

I brought this to the attention of my new manager, and told them that I wasn't happy with my personal details being sent to all these people

OP, can you please clarify, are you speaking about the names and work email addresses of colleagues who all work at the same company? E.g. something like pat.murphy@company.com, silvia.smith@company.com, etc? And you would be annoyingly.annoyed@company.com, etc.

Or is it the case that private addresses were shared, e.g. p.murphy@gmail.com, silvia.s@outlook.com, etc?

skallywag

EdgeCase wrote: »

When I get an email like that, I usually respond to the sender (only) and point out that they've accidentally used CC instead of BCC and, for data protection reasons, they might consider using BCC in future

I would have the same Q as I put to the OP above.

Are you referring to a list of company email addresses or private addresses?

antix80

More than likely the person sending the emails doesn't know enough about computers to use BCC let alone mailmerge. Might be worth sending them a screenshot of how to show the BCC field in outlook.

listermint

skallywag wrote: »

OP, can you please clarify, are you speaking about the names and work email addresses of colleagues who all work at the same company? E.g. something like pat.murphy@company.com, silvia.smith@company.com, etc? And you would be annoyingly.annoyed@company.com, etc.

Or is it the case that private addresses were shared, e.g. p.murphy@gmail.com, silvia.s@outlook.com, etc?

This is an important question.

Wabbit Ears

It makes a difference if its a work e-mail address but Joe.bloggs@gmail.com becomes your 'work' email address if you are a contractor with an agency and that is the e-mail you gave them for use in contacting you on agency related business.

Granted someone not understanding BCC is the root of OP's problem but going full GDPR/Dataprotection over it was massive overkill and hardly surprising that he's been just removed from distribution lists. Whoever got a boll0cking over it has gone 'fcuk that guy' and complied with the request to not display his name and address in the easiest way possible, to just not send him any mails anymore.

be careful what you ask for, you might just get it!

LegacyUser

OP here.

These are personal emails.
annoyinglyannoyed@gmail.com, all are personal email addresses.
And all of our names.
If it was a company email address, this wouldn't be an issue.

One of the reasons I've not addressed it with Data Protection, is that I don't want anyone getting hassle over it and I don't need it myself. Who does?

Apologies, because of anonymous posting, there's a delay in my replies being shown.

LegacyUser

Actually when I brought it up with the manager, it was a very relaxed conversation and they agreed that it wasn't right.
Likewise, on the second occasion when it was addressed with the acting manager.
I'd hate anyone to think I was aggressive or demanding in my approach.

Having said that, I've no idea how the manager told the administration staff.

So while I'm not receiving all mail, any I have received, has been to my address only, but my close friend/colleague receives all their emails as before, without bcc.

Thanks Mods.
Please close this thread, I know what I need to do.

Thanks everyone for your input.

OMM 0000

Annoyingly annoyed wrote: »

I'm not making a mountain out of a molehill.

Yeah you are.

This is a complete non-issue.

If this is bothering you so much to post on boards, I don't understand how you're going to be able to handle real problems in the workplace.

Have you ever heard of the phrase choose your battles? If you're trying to make everyone in the world follow every rule and process as exact as possible, you're going to have a very stressful life.

beauf

Won't be a non issue when the same person does the same with some other list and they get hit with a fine, and then it goes public.

skallywag

I think the OP really needs to answer the Q I put, in order to get some context. If it was 'normal work style' email addresses in question, where everyone ends with @company.com, etc, then it's completely unreasonable behavior, and actually verging on erratic. If it's private addresses on the other hand then I would side with the OP.

OMM 0000

beauf wrote: »

Won't be a non issue when the same person does the same with some other list and they get hit with a fine, and then it goes public.

I don't think the GDPR folk care about this though. This is literally employees seeing their colleagues e-mail addresses. I would consider this to be normal.

For example, we're supposed to be allowed view a website if we've rejected their cookies, but loads of websites don't allow this... and no GDPR fine.

my3cents

antix80 wrote: »

More than likely the person sending the emails doesn't know enough about computers to use BCC let alone mailmerge. Might be worth sending them a screenshot of how to show the BCC field in outlook.

iirc The BCC field is hidden by default in a standard install of Outlook so anyone who can't look under the hood is never going to see it.

beauf

OMM 0000 wrote: »

I don't think the GDPR folk care about this though. This is literally employees seeing their colleagues e-mail addresses. I would consider this to be normal.

For example, we're supposed to be allowed view a website if we've rejected their cookies, but loads of websites don't allow this... and no GDPR fine.

...thats why I said another list... as in one that might have personal or sensitive data.

beauf

skallywag wrote: »

I think the OP really needs to answer the Q I put, in order to get some context. If it was 'normal work style' email addresses in question, where everyone ends with @company.com, etc, then it's completely unreasonable behavior, and actually verging on erratic. If it's private addresses on the other hand then I would side with the OP.

You missing the contractor angle. Agencies don't like it when contractor change agencies but continue to work the same contract.

Not GDPR. But this email list basically tells the contractors who maybe from different agencies who is still working there.

OMM 0000

beauf wrote: »

...thats why I said another list... as in one that might have personal or sensitive data.

Ah yeah ok, missed that, I'm drinking pints.

my3cents

beauf wrote: »

You missing the contractor angle. Agencies don't like it when contractor change agencies but continue to work the same contract.

Not GDPR. But this email list basically tells the contractors who maybe from different agencies who is still working there.

Is anyone else missing the contractor angle where it is stupid for one agency to give away all the email addresses of its contractors so they can be handed to another agency if someone moves?

Its just bad practice from the agencies point of view.

robarmstrong

Annoyingly annoyed wrote: »

I do not need to know these colleagues names or email addresses. And they don't need to know mine.
They don't work directly with me.
They live and work hours away from me.
I have no reason to contact them or them me.
We are merely employed by the same agency- that is the only similarity.

Right, are we talking personal email addresses as in joe.soap@gmail.com or are we talking corporate email addresses as in joe.soap@yourcompany.com?

You're not receiving mails because someone has more than likely either purposefully or accidentally removed you from a Distribution List (Exchange/Active Directory etc).

EDIT - only seeing the OPs reply now as it was delayed due to Anon posting - disregard

uncommon_name

robarmstrong wrote: »

You're not receiving mails because someone has more than likely either purposefully or accidentally removed you from a Distribution List (Exchange/Active Directory etc).

Purposefully, to stop him moaning. But it didn't work very well.

seamus

beauf wrote: »

Where did you get that from.

BCC should be the standard for bulk emails. No?

Not for internal mails. I only see BCC used on internal mails where it might be important to hide the recipients from one another.

For example, if HR were to send a group email to the people on the pension scheme notifying them of a change, then the recipients on that email should not be able to see who else is on the pension scheme. So HR will use BCC.

But for general company emails, updates, information, etc, BCC is never used.

robarmstrong wrote: »

Right, are we talking personal email addresses as in joe.soap@gmail.com or are we talking corporate email addresses as in joe.soap@yourcompany.com?

You're not receiving mails because someone has more than likely either purposefully or accidentally removed you from a Distribution List (Exchange/Active Directory etc).

This. It sounds to me like the OP (and his colleagues) may not be assigned emails addresses by the company as they are agency workers and perhaps are receiving emails to their personal addresses. In this scenario, the OP's address has been removed from one or more distribution lists because that was the only way to satisfy their complaint.

In this case, it's perfectly appropriate (or at least permissible) for a company to "reveal" the details of all recipients of a mail. If the OP doesn't like his personal email address being visible to the rest of his colleagues, then it would be advisable for him to set up a new account for this purpose alone and ask the company to add this to their lists.

DaraDali

Also for him to be excluded from other emails is quite common, I have email lists/google groups etc, I would remove contractors/temp staff or any I class not a full time employee of the company from these groups with the HR approval's from any company wide email's.It's none of their business if they are a contractor there.

Like the other posters said if the OP is using a work email address he has no reason to even try and complain about GDPR in the workplace sharing his work email/phone with anyone they wish.

beauf

seamus wrote: »

...
But for general company emails, updates, information, etc, BCC is never used.

...

If one of those emails gets outside, to someones personal account, or any account thats comprised, expect a lot of spam and worse.

beauf

DaraDali wrote: »

Also for him to be excluded from other emails is quite common,....

He's not on lists he should be on, and was previously.

skallywag

seamus wrote: »

But for general company emails, updates, information, etc, BCC is never used.

Agree with this.

We are actually strongly discouraged from using bcc in any situation, as it can go spectacularly wrong. Imagine the situation where the person who is on bcc does not realize it, and replies to all, i.e. to those in the cc and to fields. It's going to become immediately apparent what this person was on bcc and the you are running the chance of the others getting extremely pissed off, etc. OK, you could just bcc everyone I suppose, but then you are receiving a mail which is usually obviously addressing a group, but has just been sent to you, which also smacks of insincerity, and can also cause confusion.

In general bcc is looked on as sneaky behaviour. The way we handle it is to just forward the original mail to the recipients who you do not want to call out on the original.

Coming back to point of contractors, I'm also of the opinion that a dedicated work address should be setup for business matters, kept separate from ones private address.

skallywag

Annoyingly annoyed wrote: »

These are personal emails.

Well in that case you are completely justified in your reaction, in my book at least.

beauf

skallywag wrote: »

Agree with this.

We are actually strongly discouraged from using bcc in any situation, as it can go spectacularly wrong. Imagine the situation where the person who is on bcc does not realize it, and replies to all, i.e. to those in the cc and to fields. It's going to become immediately apparent what this person was on bcc and the you are running the chance of the others getting extremely pissed off, etc. OK, you could just bcc everyone I suppose, but then you are receiving a mail which is usually obviously addressing a group, but has just been sent to you, which also smacks of insincerity, and can also cause confusion.

In general bcc is looked on as sneaky behaviour. The way we handle it is to just forward the original mail to the recipients who you do not want to call out on the original.

Coming back to point of contractors, I'm also of the opinion that a dedicated work address should be setup for business matters, kept separate from ones private address.

I don't think reply all works like that. Also there are valid cases where you don't want people to know everyones email.

my3cents

skallywag wrote: »

Agree with this.

We are actually strongly discouraged from using bcc in any situation, as it can go spectacularly wrong. Imagine the situation where the person who is on bcc does not realize it, and replies to all, i.e. to those in the cc and to fields. It's going to become immediately apparent what this person was on bcc and the you are running the chance of the others getting extremely pissed off, etc. OK, you could just bcc everyone I suppose, but then you are receiving a mail which is usually obviously addressing a group, but has just been sent to you, which also smacks of insincerity, and can also cause confusion.

In general bcc is looked on as sneaky behaviour. The way we handle it is to just forward the original mail to the recipients who you do not want to call out on the original.

Coming back to point of contractors, I'm also of the opinion that a dedicated work address should be setup for business matters, kept separate from ones private address.

Once a email with bcc recipients hits a mail server it then treats the emails as being sent to individual recipients so each bcced address gets an email with just the single recipients email address, so no way can you reply to a bcc list as you can only see your email address and no one elses thats the point of bcc.

Franz Von Peppercorn

GDPR keeps getting invoked although I’ve yet to see a case brought against major data hoovering companies, never mind small companies who might have not used a bcc for internal email.

rd1izb7lvpuksx

my3cents wrote: »

Once a email with bcc recipients hits a mail server it then treats the emails as being sent to individual recipients so each bcced address gets an email with just the single recipients email address, so no way can you reply to a bcc list as you can only see your email address and no one elses thats the point of bcc.

In the proposed scenario, Skallywag is talking about an email sent to several people as recipients or CCs and to at least one person as BCC. The ordinary recipients and CCs can see the BCC, but if the BCC replies to all, they'll reply to everyone, and everyone will now know that there were BCC recipients.

BCCs replying to too many people and side-chain emails with sensitive information being folded back into the full recipient list are two of the most common mess-ups in corporate email.

scamalert

Sage Handsome Waiter wrote: »

In the proposed scenario, Skallywag is talking about an email sent to several people as recipients or CCs and to at least one person as BCC. The ordinary recipients and CCs can see the BCC, but if the BCC replies to all, they'll reply to everyone, and everyone will now know that there were BCC recipients.

BCCs replying to too many people and side-chain emails with sensitive information being folded back into the full recipient list are two of the most common mess-ups in corporate email.

yeah its usually same people that you need to tell to switch if off and on as well. Lack of basic pc skills is the issue, that said OP blows a bubble over nothing, unless messed up with using your personal email and getting constant spam, just ask to get new email issued problem solved. This GDPR crap is a bit over the top somehow people just year back survived without it for decades.

rd1izb7lvpuksx

scamalert wrote: »

yeah its usually same people that you need to tell to switch if off and on as well. Lack of basic pc skills is the issue, that said OP blows a bubble over nothing, unless messed up with using your personal email and getting constant spam, just ask to get new email issued problem solved. This GDPR crap is a bit over the top somehow people just year back survived without it for decades.

Yeah, I don't think the OP has anything to complain about. However, I think GDPR is absolutely necessary, and I hope it's enforced with teeth.

It takes so little data to uniquely fingerprint a person, and the opportunities for abuse is innumerable.

my3cents

Sage Handsome Waiter wrote: »

In the proposed scenario, Skallywag is talking about an email sent to several people as recipients or CCs and to at least one person as BCC. The ordinary recipients and CCs can see the BCC, but if the BCC replies to all, they'll reply to everyone, and everyone will now know that there were BCC recipients.

BCCs replying to too many people and side-chain emails with sensitive information being folded back into the full recipient list are two of the most common mess-ups in corporate email.

If there are CCed recipients then of course they will get a reply to the reply all. However anyone that was BCCed won't even get a reply.

All that has happened is that the CCed recipients will know there is at least one BCCed recipient. The don't see the whole BCCed list.

If a BCCed list is used for all the contractors in the OP's scenario then no one will get a reply other than the sender in the reply all scenario.

alexmalalex

OMM 0000 wrote: »

Yeah you are.

This is a complete non-issue.

If this is bothering you so much to post on boards, I don't understand how you're going to be able to handle real problems in the workplace.

Have you ever heard of the phrase choose your battles? If you're trying to make everyone in the world follow every rule and process as exact as possible, you're going to have a very stressful life.

You're being an asshole IMO

The OP sounds like an experienced professional, not a newbie millennial. It is perfectly valid for the OP not to want to have their email shared with other people. The company is being incompetent and breaching data protection.

AndrewJRenko

Franz Von Peppercorn wrote: »

GDPR keeps getting invoked although I’ve yet to see a case brought against major data hoovering companies, never mind small companies who might have not used a bcc for internal email.

See Case Study 2


https://www.dataprotection.ie/sites/default/files/uploads/2018-12/AR2008.pdf

AndrewJRenko

seamus wrote: »

In this case, it's perfectly appropriate (or at least permissible) for a company to "reveal" the details of all recipients of a mail. If the OP doesn't like his personal email address being visible to the rest of his colleagues, then it would be advisable for him to set up a new account for this purpose alone and ask the company to add this to their lists.

It's not appropriate at all. If the colleagues don't need to see the email address, it shouldn't be revealed to them. Privacy by design.

rd1izb7lvpuksx

AndrewJRenko wrote: »

It's not appropriate at all. If the colleagues don't need to see the email address, it shouldn't be revealed to them. Privacy by design.

I build privacy-oriented systems for a living, and you're picking an odd hill to die on. Avoiding group email is not by itself privacy-by-design.

AndrewJRenko

Sage Handsome Waiter wrote: »

I build privacy-oriented systems for a living, and you're picking an odd hill to die on. Avoiding group email is not by itself privacy-by-design.

That's true, by itself it is not privacy by design - but sending a group email to people who don't need to see the email addresses of other recipients is not privacy by design.

scamalert

alexmalalex wrote: »

You're being an asshole IMO

The OP sounds like an experienced professional, not a newbie millennial. It is perfectly valid for the OP not to want to have their email shared with other people. The company is being incompetent and breaching data protection.

company should use GDPR breach to fire OP for using colleagues to obtain blocked emails.


there has to be rules and groups in places also people briefed on company policies to keep confidential data to themselves or only those related, but making exception for every snowflake that their email wouldn't be visible to no one is like asking a boot.

Franz Von Peppercorn

AndrewJRenko wrote: »

See Case Study 2


https://www.dataprotection.ie/sites/default/files/uploads/2018-12/AR2008.pdf

Years before GDPR.

Mrs OBumble

OP, register an email account like AnnoyingAnnoyedGuest.atWork@gmail.com and tell work that this is your new email for all work purposes, and ask them to add it to all relevant groups etc.