Data breach?

yellowcrayon

Hi All.

Just hoping to get a few opinions on this please....

I became very ill last month and ended up in hospital for quite a while for treatment.
During this time, I kept my manager and MD updated to let them know what was happening.
During my stay, I received a number of texts from employees with well wishes saying they knew I was in hospital AND knew the reason why.

The only person who knew I was there apart from the managers was my husband.

Is this allowed? Can they just tell people my medical issued?

Thank you all in advance.

yellowcrayon

I realise I should have said that one of the ladies in the office said it was my manager that told her.

pummice

Did the lady say A/ I know what your illness is or B/ I know you are suffering from X?

yellowcrayon

pummice wrote: »

Did the lady say A/ I know what your illness is or B/ I know you are suffering from X?

The girl who told me said in a text kinda like...

"Hi yellowcrayon, sorry to hear you're in hospital with a pulmonary embolism. 'john' was telling me about it at work today,'

splinter65

yellowcrayon wrote: »

The girl who told me said in a text kinda like...

"Hi yellowcrayon, sorry to hear you're in hospital with a pulmonary embolism. 'john' was telling me about it at work today,'

Everyone you work with was kind enough to offer you comfort when you were ill. I think that’s very nice.
I personally would be touched.
No, your boss shouldn’t have told everyone you had suffered a pulmonary embolism.

yellowcrayon

splinter65 wrote: »

Everyone you work with was kind enough to offer you comfort when you were ill. I think that’s very nice.
I personally would be touched.
No, your boss shouldn’t have told everyone you had suffered a pulmonary embolism.

I was really appreciative of the messages and obviously my colleagues weren't to know that my condition was private.
In the same situation, I would also send my colleague a text to make sure they were ok.

Thank you for the answer.

Path123

I would just be having a conversation with your manager if it's something that bothered you. I can definitely see where you're coming from- are you considering taking it further?

yellowcrayon

Path123 wrote: »

I would just be having a conversation with your manager if it's something that bothered you. I can definitely see where you're coming from- are you considering taking it further?

It did bother me if I'm being honest. I didn't tell family or friends what was happening so was a little upset when my manager decided to gossip.

I spoke to the company director about it and they said it was probably a slip of the tongue and to stop being so sensitive.

I don't know if I want to take it further because I don't actually know if it was a breach.

TheBoyConor

Technically it is a s breach of personal data. And sensitive personal data at that because it's health related information.
You could report it to the data protection commissioner. You would be entitled to do so but I think it would be a good idea to get legal advice beforehand .

yellowcrayon

TheBoyConor wrote: »

Technically it is a s breach of personal data. And sensitive personal data at that because it's health related information.
You could report it to the data protection commissioner. You would be entitled to do so but I think it would be a good idea to get legal advice beforehand .

Thanks v. much for your reply.

I may talk to my solicitor informally because I'm dealing with house/will stuff with him anyway.

I think my only problem is the girl who said "John told me" doesn't want to be brought into this and management won't entertain me unless I give her name to them.

I can’t tell if this is a large or small company you work for. Generally speaking, only HR would be informed of the nature of your illness but often, employees are happy to share the specific details with their line management too, if not too sensitive - but there’s generally no onus on you to do this unless company policy states differently.

BUT, if you didn’t want everyone to know the nature of your sick leave, I think you should have mentioned this to the managers when speaking to them first.

If you had a broken arm, or an appendicitis, it’s likely you wouldn’t be thinking the way you are now. Obviously, whatever your illness, it’s a more sensitive subject. And fair enough- while strictly speaking, the managers should have checked with you first before telling the staff, so yes, they’re in the wrong, I think you also should have conveyed your wishes as to what message they would convey to the wider staff- obviously people are concerned about you.

Did you say anything to them around confidentiality or otherwise in terms of who they could tell or how they should explain your absence ? It’s something they should have done anyway, but like I said, some illnesses are more sensitive than others- maybe they felt whatever illness you had wasn’t particularly a sensitive one?

I’d have a discussion with them on your return around process and procedure on communicating illnesses and also express your disappointment but after that, I’m not sure what more can be done now.

Jim2007

yellowcrayon wrote: »

I think my only problem is the girl who said "John told me" doesn't want to be brought into this and management won't entertain me unless I give her name to them.

Look the breach has occurred and it can't be undone. In the big picture is is a minute breach, one single data point to a group of close colleagues and friends, by a manager who made a genuine mistake. And the person who's data was disclosed is aware of the situation.

You could report it and the company will have to go and explain it, but the DP staff being reasonable people will see for what it is, something trivial. They will remand the company and tell them to take steps to ensure it will not happen again. This will most likely result in a memo or a HR handbook change and then everyone will want to know why and they will know eventually because people will talk no matter what you do.

You need to decide what you want out of this, because in the end it will all die down except that you'll be seen as someone who makes waves for no good reason, some you'd prefer not to have to work with in case they'd do it on you, someone you'd prefer not to have on your team etc... it is up to you to decide.

Augme

yellowcrayon wrote: »

Path123 wrote: »

I would just be having a conversation with your manager if it's something that bothered you. I can definitely see where you're coming from- are you considering taking it further?

It did bother me if I'm being honest. I didn't tell family or friends what was happening so was a little upset when my manager decided to gossip.

I spoke to the company director about it and they said it was probably a slip of the tongue and to stop being so sensitive.

I don't know if I want to take it further because I don't actually know if it was a breach.

In generally I'd be happy to let this slide once the company were told that I expected this to never happen again. And in return if expect an apology and then to hold their hands up.

However since they have not done this and given their reaction I'd be fairly pissed off and would definitely push it further. It seems their attitude to serious data breached is very lad which really isn't a good sign either.

Ohmeha

Deleted User wrote: »

BUT, if you didn’t want everyone to know the nature of your sick leave, I think you should have mentioned this to the managers when speaking to them first.

It's not the OPs responsibility to remind their manager not to breach data protection regulations by disclosing the nature of their personal illness to their colleagues

Ohmeha

Ohmeha wrote: »

It's not the OPs responsibility to remind their manager not to breach data protection regulations by disclosing the nature of their personal illness to their colleagues

I did make that clear in my post if you cared to read it.

yellowcrayon

Augme wrote: »

In generally I'd be happy to let this slide once the company were told that I expected this to never happen again. And in return if expect an apology and then to hold their hands up.

However since they have not done this and given their reaction I'd be fairly pissed off and would definitely push it further. It seems their attitude to serious data breached is very lad which really isn't a good sign either.

Thank you for your reply.

This was my line of thinking as well.. I would have let it slide if they'd have said "feck, we didn't realise it was so serious, sorry about that".

But they're response was fairly poor, and I've been treated very unfavourably ever since.

yellowcrayon

[Deleted User] wrote: »

I did make that clear in my post if you cared to read it.

Hi there, admittedly, I didn't state to management to keep the info confidential. I assumed that it would be a given but I realise that maybe I should have.

skallywag

Your manager was definitely out of line for disclosing the reason for your sick leave, there is no doubt about that. Your company director is also way wide of the mark by brushing it off by telling you that you that you are being oversensitive. I definitely believe that you would have a case here if you wish to pursue it.

That said, is that something that you really want to do though? How is everything else at work in general? If you go down the road of going to a solicitor etc. you will face a high probability of ending any meaningful career path within that company. It is not the way that things should be, but it is often the case that you will be marked from then on, even though you are 100% in the right.

By the way OP, I assume that you know that you are in no way obliged to name the reason why you are in hospital? I was once in hospital myself for a reason which I did not want my colleagues to know about, I just told my boss at the time that I am in hospital, will probably be back within a week, my boss wished me all the best and asked no more. I then produced a letter from the hospital saying that I was there for that week, and it made no mention of the reason either.

Something else strikes me about your post.

You mention that a colleague sent you a message saying 'sorry you are in hospital with x'. I find this very odd. If I was to send such a message I would say something like 'sorry to hear you are in hospital, get well soon!' etc. I would not send something like 'sorry to hear you are in hospital after a heart attack...' etc. I really do not see why your colleagues would make mention to the condition, even if they know what it is. That is just plain insensitive.

Strumms

There isn’t a gray area. Your employer should have refrained from disclosing any information...


If I was concerned about an employee and colleague who was out of the business for health reasons I’d see nothing wrong with asking a supervisor “ how is Lisa doing, any news ? “... though if I’m the manager... “ ok Strumms, as soon as we have any information that we can pass onto you we’ll be sure to let you know.