nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Child Item

gdpr breach at work

LegacyUser

Hi all, long story but I ended up in mediation with a work colleague. She produced a copy of an old contract that I had years ago, that I had no idea she had or should have had. Have spoken to manager about this, but is there any thing else I should be doing.

Thanks

Find more posts tagged with

Quick Links

Comments

Diceicle

She had a copy of your old contract? Is that right?

Lux23

Your employer should be reporting that within the next 72 hours!

Jim2007

aisling 999 wrote: »

Hi all, long story but I ended up in mediation with a work colleague. She produced a copy of an old contract that I had years ago, that I had no idea she had or should have had. Have spoken to manager about this, but is there any thing else I should be doing.

Thanks

We don't even know if it was a in fact a breach... it was a company document, she is an employee and while you may not think that she should have access that does not mean that the company has broken the law in any way.

What is your objective? You have made a complaint to management, was the outcome acceptable or not?

If you make a complaint to the data commissioner, it will kick of an unwelcome inquiry with your employer...

if you loose the complaint, who will you feel about it and what will your future relationship with your employer looking like?

if you win, your employer gets a rap on the knuckles, may be pays a fine and then what, how do you see your relationship with your employer then?

Fritzbox

aisling 999 wrote: »

Hi all, long story but I ended up in mediation with a work colleague. She produced a copy of an old contract that I had years ago, that I had no idea she had or should have had. Have spoken to manager about this, but is there any thing else I should be doing.

Thanks

I don't know Irish law too well, but in Germany that would be considered a breach of confidentiality. Unless, of course, your colleague worked in the HR dept. and had legal access to your file? otherwise I'd imagine you have grounds for complaint.

Ohmeha

There is absolutely no justifiable reason for any colleague of yours to be in possession of on old contract of yours, all employment contract records should only be stored by your HR department

I would suggest if you have a Union run the series of events by them and seek best advice. If you're not in a union and have already spoken to your manager await response from your manager but if you feel their response is not satisfactory you will ultimately have to decide if you feel it's required for pursuing an escalation to your HR department

[Deleted User]

Ohmeha wrote: »

There is absolutely no justifiable reason for any colleague of yours to be in possession of on old contract of yours, all employment contract records should only be stored by your HR department

I would suggest if you have a Union run the series of events by them and seek best advice. If you're not in a union and have already spoken to your manager await response from your manager but if you feel their response is not satisfactory you will ultimately have to decide if you feel it's required for pursuing an escalation to your HR department

It depends on whether it was the op’s signed contract, or the same contract as the op signed. A lot of companies have standard contracts at particular times, these contracts get updated as time goes on.

Op, are you saying he/she produced a copy of your personal signed contract, or a contract the same as the one you signed?

_Brian

Jim2007 wrote: »

We don't even know if it was a in fact a breach... it was a company document, she is an employee and while you may not think that she should have access that does not mean that the company has broken the law in any way.

What is your objective? You have made a complaint to management, was the outcome acceptable or not?

If you make a complaint to the data commissioner, it will kick of an unwelcome inquiry with your employer...

if you loose the complaint, who will you feel about it and what will your future relationship with your employer looking like?

if you win, your employer gets a rap on the knuckles, may be pays a fine and then what, how do you see your relationship with your employer then?

Employees having access to documents about other employees when there is no business need is indeed a gdpr breach.

Prominent_Dawg

Am I the only one wondering what the colleagues reason for having it was?

angel eyes 2012

Prominent_Dawg wrote: »

Am I the only one wondering what the colleagues reason for having it was?

We need more information regarding the actual information on the contract. The OP stated "She produced a copy of an old contract that I had years ago, that I had". That could mean any old contract with a supplier, which wouldn't necessarily pertain to the processing of personal data and therefore Data Protection compliance would not arise. Too easy to make assumptions in this scenario when we don't know the context.

Also, not all data breaches need to be reported to the Data Protection Commission.

Jim2007

_Brian wrote: »

Employees having access to documents about other employees when there is no business need is indeed a gdpr breach.

And as I pointed out in my original post, we don't know the context nor even if it is a breach of the law.

Esse85

If the employee logs a complaint with the data protection, they will tell the employee to issue in writing a query to the employer as to why that happened rather than going investigating it straight away.
If the employer doesn't respond within 30 days then the data protection steps in.

Strumms

Prominent_Dawg wrote: »

Am I the only one wondering what the colleagues reason for having it was?

If I’m a manager in that company I’m certainly wondering what that employee is doing with it, also how they came to be in possession of it. Anywhere I’ve worked documents of a legal and sensitive nature were under lock and key.

Strumms

Jim2007 wrote: »

And as I pointed out in my original post, we don't know the context nor even if it is a breach of the law.

If the employee came into possession of it without authorization it’s a breach, theft. If the employer enabled the employee and authorized him to take it without a legitimate business reason it’s a breach of GDPR.

Mrs OBumble

Strumms wrote: »

If the employee came into possession of it without authorization it’s a breach, theft. If the employer enabled the employee and authorized him to take it without a legitimate business reason it’s a breach of GDPR.

That depends on where they got the contract from ( the other party to the contract may have handed it over), and whether it not it actually contains personally identifying data ( it may be generic).

Jim2007

Strumms wrote: »

If the employee came into possession of it without authorization it’s a breach, theft. If the employer enabled the employee and authorized him to take it without a legitimate business reason it’s a breach of GDPR.

But you don't know any of this, the is the point. Until have factual information about the situation, your opinion is as useful as a chocolate tee pot.

Esse85

What if a company has contracts that include salary details, copies of drivers licence, and head shot photographs of employees stored on the cloud with no security and available for all to see?

[Deleted User]

Esse85 wrote: »

What if a company has contracts that include salary details, copies of drivers licence, and head shot photographs of employees stored on the cloud with no security and available for all to see?

That would be really insane. Take it to the Data Protection Commissioner or a friendly reporter.

Strumms

Jim2007 wrote: »

But you don't know any of this, the is the point. Until have factual information about the situation, your opinion is as useful as a chocolate tee pot.

We know that the employee came into possession of another employees contract...that they shouldn’t have procured it and they shouldn’t have been given it or taken it.

In a company the only people who should have access to my contract are management, HR & legal... line colleagues, the cleaners, receptionist and whoever else are just not entitled to see it. If they are given it, asked to go get it, told to read it it’s inappropriate and wrong.

So you can go and throw around whatever hyperbole about chocolate teapots or about any other household item made from confectionery that you wish, the contract contains personal information, by law a company must not enable that to be accessed by people who have no business with it.

Mrs OBumble

Strumms wrote: »

.... In a company the only people who should have access to my contract are management, HR & legal... line colleagues, the cleaners, receptionist and whoever else are just not entitled to see it. If they are given it, asked to go get it, told to read it it’s inappropriate and wrong.

In many small companies the receptionist performs some functions that an HR department would if it existed.

Diceicle

Strumms wrote: »

We know that the employee came into possession of another employees contract...

We don't know that. We're assuming that.
Op said 'She produced a copy of an old contract that I had years ago' - thats all we know. From that description it COULD be her actual contract (which I'd agree would be a breach) or it could be a boilerplate contract template which contrained the standard T&Cs. OP needs to clarify.

Jim2007

Strumms wrote: »

We know that the employee came into possession of another employees contract...that they shouldn’t have procured it and they shouldn’t have been given it or taken it.

No you don't. You don't know what was being discussed at the time and you don't know if the person should have had a copy and you don't know the company business. All you actually know is that the OP was unhappy to find out that this person had access to a copy of a contract.

For all you know it could be a management consulting company where it is common for all sales guys to have access to CVs etc... because they will be submitting them in proposals to clients etc....

Making so may assumptions on such little information is nonsense.

Strumms

Mrs OBumble wrote: »

In many small companies the receptionist performs some functions that an HR department would if it existed.

I agree, I worked for a similar company before where until expansion and the requirement for full time HR locally, a PA was designated and trained for the responsibility. if that’s the case they will have received the relevant mandatory training and authorization to access employee info/files ....they will also be made known to employees as having this training and authority...

Strumms

Jim2007 wrote: »

No you don't. You don't know what was being discussed at the time and you don't know if the person should have had a copy and you don't know the company business. All you actually know is that the OP was unhappy to find out that this person had access to a copy of a contract.

For all you know it could be a management consulting company where it is common for all sales guys to have access to CVs etc... because they will be submitting them in proposals to clients etc....

Making so may assumptions on such little information is nonsense.

Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

Mrs OBumble

Strumms wrote: »

Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

You don't have a clue about how consulting companies work.

CVs like you describe are routinely sent - and hell, the information is there on LinkedIn anyways. This is done with the consent of the employees, there is no breach.

runawaybishop

Strumms wrote: »

Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

I see CVs of potential contractors from multiple companies during the tender process. There is no GDPR breech if this is done with permission.

hots

Strumms wrote: »

Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

That literally happens all the time.

LegacyUser

Thanks for replies. It was my contract, not a generic one. The person who had it was the clerical officer in the business I work in, and the employer had no idea she had it

Jim2007

Strumms wrote: »

Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

Stop embarrassing yourself, you are way out of your depth. You are making wild assumptions about the OP's situation and you have clearly not got the foggiest idea about the consulting industry.

LegacyUser

Thanks for replies. It was my contract, not a generic one. The person who had it was the clerical officer in the business I work in, and the employer had no idea she had it... Is there any thing else I should do, apart from reporting it to my manager