Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

gdpr breach at work

  • 22-01-2020 11:48am
    #1
    Registered Users Posts: 166,026 ✭✭✭✭


    Hi all, long story but I ended up in mediation with a work colleague. She produced a copy of an old contract that I had years ago, that I had no idea she had or should have had. Have spoken to manager about this, but is there any thing else I should be doing.

    Thanks


Comments

  • Registered Users Posts: 1,799 ✭✭✭Diceicle


    She had a copy of your old contract? Is that right?


  • Registered Users Posts: 7,134 ✭✭✭Lux23


    Your employer should be reporting that within the next 72 hours!


  • Moderators, Business & Finance Moderators Posts: 9,921 Mod ✭✭✭✭Jim2007


    Hi all, long story but I ended up in mediation with a work colleague. She produced a copy of an old contract that I had years ago, that I had no idea she had or should have had. Have spoken to manager about this, but is there any thing else I should be doing.

    Thanks

    We don't even know if it was a in fact a breach... it was a company document, she is an employee and while you may not think that she should have access that does not mean that the company has broken the law in any way.

    What is your objective? You have made a complaint to management, was the outcome acceptable or not?

    If you make a complaint to the data commissioner, it will kick of an unwelcome inquiry with your employer...

    if you loose the complaint, who will you feel about it and what will your future relationship with your employer looking like?

    if you win, your employer gets a rap on the knuckles, may be pays a fine and then what, how do you see your relationship with your employer then?


  • Registered Users Posts: 488 ✭✭Fritzbox


    Hi all, long story but I ended up in mediation with a work colleague. She produced a copy of an old contract that I had years ago, that I had no idea she had or should have had. Have spoken to manager about this, but is there any thing else I should be doing.

    Thanks

    I don't know Irish law too well, but in Germany that would be considered a breach of confidentiality. Unless, of course, your colleague worked in the HR dept. and had legal access to your file? otherwise I'd imagine you have grounds for complaint.


  • Registered Users Posts: 1,870 ✭✭✭Ohmeha


    There is absolutely no justifiable reason for any colleague of yours to be in possession of on old contract of yours, all employment contract records should only be stored by your HR department

    I would suggest if you have a Union run the series of events by them and seek best advice. If you're not in a union and have already spoken to your manager await response from your manager but if you feel their response is not satisfactory you will ultimately have to decide if you feel it's required for pursuing an escalation to your HR department


  • Advertisement
  • Registered Users Posts: 13,864 ✭✭✭✭Dav010


    Ohmeha wrote: »
    There is absolutely no justifiable reason for any colleague of yours to be in possession of on old contract of yours, all employment contract records should only be stored by your HR department

    I would suggest if you have a Union run the series of events by them and seek best advice. If you're not in a union and have already spoken to your manager await response from your manager but if you feel their response is not satisfactory you will ultimately have to decide if you feel it's required for pursuing an escalation to your HR department

    It depends on whether it was the op’s signed contract, or the same contract as the op signed. A lot of companies have standard contracts at particular times, these contracts get updated as time goes on.

    Op, are you saying he/she produced a copy of your personal signed contract, or a contract the same as the one you signed?


  • Registered Users Posts: 18,440 ✭✭✭✭_Brian


    Jim2007 wrote: »
    We don't even know if it was a in fact a breach... it was a company document, she is an employee and while you may not think that she should have access that does not mean that the company has broken the law in any way.

    What is your objective? You have made a complaint to management, was the outcome acceptable or not?

    If you make a complaint to the data commissioner, it will kick of an unwelcome inquiry with your employer...

    if you loose the complaint, who will you feel about it and what will your future relationship with your employer looking like?

    if you win, your employer gets a rap on the knuckles, may be pays a fine and then what, how do you see your relationship with your employer then?

    Employees having access to documents about other employees when there is no business need is indeed a gdpr breach.


  • Registered Users Posts: 986 ✭✭✭Prominent_Dawg


    Am I the only one wondering what the colleagues reason for having it was?


  • Registered Users Posts: 894 ✭✭✭angel eyes 2012


    Am I the only one wondering what the colleagues reason for having it was?

    We need more information regarding the actual information on the contract. The OP stated "She produced a copy of an old contract that I had years ago, that I had". That could mean any old contract with a supplier, which wouldn't necessarily pertain to the processing of personal data and therefore Data Protection compliance would not arise. Too easy to make assumptions in this scenario when we don't know the context.

    Also, not all data breaches need to be reported to the Data Protection Commission.


  • Moderators, Business & Finance Moderators Posts: 9,921 Mod ✭✭✭✭Jim2007


    _Brian wrote: »
    Employees having access to documents about other employees when there is no business need is indeed a gdpr breach.

    And as I pointed out in my original post, we don't know the context nor even if it is a breach of the law.


  • Advertisement
  • Registered Users Posts: 8,235 ✭✭✭Esse85


    If the employee logs a complaint with the data protection, they will tell the employee to issue in writing a query to the employer as to why that happened rather than going investigating it straight away.
    If the employer doesn't respond within 30 days then the data protection steps in.


  • Registered Users Posts: 24,694 ✭✭✭✭Strumms


    Am I the only one wondering what the colleagues reason for having it was?

    If I’m a manager in that company I’m certainly wondering what that employee is doing with it, also how they came to be in possession of it. Anywhere I’ve worked documents of a legal and sensitive nature were under lock and key.


  • Registered Users Posts: 24,694 ✭✭✭✭Strumms


    Jim2007 wrote: »
    And as I pointed out in my original post, we don't know the context nor even if it is a breach of the law.

    If the employee came into possession of it without authorization it’s a breach, theft. If the employer enabled the employee and authorized him to take it without a legitimate business reason it’s a breach of GDPR.


  • Registered Users Posts: 25,594 ✭✭✭✭Mrs OBumble


    Strumms wrote: »
    If the employee came into possession of it without authorization it’s a breach, theft. If the employer enabled the employee and authorized him to take it without a legitimate business reason it’s a breach of GDPR.

    That depends on where they got the contract from ( the other party to the contract may have handed it over), and whether it not it actually contains personally identifying data ( it may be generic).


  • Moderators, Business & Finance Moderators Posts: 9,921 Mod ✭✭✭✭Jim2007


    Strumms wrote: »
    If the employee came into possession of it without authorization it’s a breach, theft. If the employer enabled the employee and authorized him to take it without a legitimate business reason it’s a breach of GDPR.

    But you don't know any of this, the is the point. Until have factual information about the situation, your opinion is as useful as a chocolate tee pot.


  • Registered Users Posts: 8,235 ✭✭✭Esse85


    What if a company has contracts that include salary details, copies of drivers licence, and head shot photographs of employees stored on the cloud with no security and available for all to see?


  • Registered Users Posts: 27,989 ✭✭✭✭AndrewJRenko


    Esse85 wrote: »
    What if a company has contracts that include salary details, copies of drivers licence, and head shot photographs of employees stored on the cloud with no security and available for all to see?
    That would be really insane. Take it to the Data Protection Commissioner or a friendly reporter.


  • Registered Users Posts: 24,694 ✭✭✭✭Strumms


    Jim2007 wrote: »
    But you don't know any of this, the is the point. Until have factual information about the situation, your opinion is as useful as a chocolate tee pot.

    We know that the employee came into possession of another employees contract...that they shouldn’t have procured it and they shouldn’t have been given it or taken it.

    In a company the only people who should have access to my contract are management, HR & legal... line colleagues, the cleaners, receptionist and whoever else are just not entitled to see it. If they are given it, asked to go get it, told to read it it’s inappropriate and wrong.

    So you can go and throw around whatever hyperbole about chocolate teapots or about any other household item made from confectionery that you wish, the contract contains personal information, by law a company must not enable that to be accessed by people who have no business with it.


  • Registered Users Posts: 25,594 ✭✭✭✭Mrs OBumble


    Strumms wrote: »
    .... In a company the only people who should have access to my contract are management, HR & legal... line colleagues, the cleaners, receptionist and whoever else are just not entitled to see it. If they are given it, asked to go get it, told to read it it’s inappropriate and wrong.

    In many small companies the receptionist performs some functions that an HR department would if it existed.


  • Registered Users Posts: 1,799 ✭✭✭Diceicle


    Strumms wrote: »
    We know that the employee came into possession of another employees contract...

    We don't know that. We're assuming that.
    Op said 'She produced a copy of an old contract that I had years ago' - thats all we know. From that description it COULD be her actual contract (which I'd agree would be a breach) or it could be a boilerplate contract template which contrained the standard T&Cs. OP needs to clarify.


  • Advertisement
  • Moderators, Business & Finance Moderators Posts: 9,921 Mod ✭✭✭✭Jim2007


    Strumms wrote: »
    We know that the employee came into possession of another employees contract...that they shouldn’t have procured it and they shouldn’t have been given it or taken it.

    No you don't. You don't know what was being discussed at the time and you don't know if the person should have had a copy and you don't know the company business. All you actually know is that the OP was unhappy to find out that this person had access to a copy of a contract.

    For all you know it could be a management consulting company where it is common for all sales guys to have access to CVs etc... because they will be submitting them in proposals to clients etc....

    Making so may assumptions on such little information is nonsense.


  • Registered Users Posts: 24,694 ✭✭✭✭Strumms


    In many small companies the receptionist performs some functions that an HR department would if it existed.

    I agree, I worked for a similar company before where until expansion and the requirement for full time HR locally, a PA was designated and trained for the responsibility. if that’s the case they will have received the relevant mandatory training and authorization to access employee info/files ....they will also be made known to employees as having this training and authority...


  • Registered Users Posts: 24,694 ✭✭✭✭Strumms


    Jim2007 wrote: »
    No you don't. You don't know what was being discussed at the time and you don't know if the person should have had a copy and you don't know the company business. All you actually know is that the OP was unhappy to find out that this person had access to a copy of a contract.

    For all you know it could be a management consulting company where it is common for all sales guys to have access to CVs etc... because they will be submitting them in proposals to clients etc....

    Making so may assumptions on such little information is nonsense.

    Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.


  • Registered Users Posts: 25,594 ✭✭✭✭Mrs OBumble


    Strumms wrote: »
    Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

    You don't have a clue about how consulting companies work.

    CVs like you describe are routinely sent - and hell, the information is there on LinkedIn anyways. This is done with the consent of the employees, there is no breach.


  • Registered Users Posts: 9,499 ✭✭✭runawaybishop


    Strumms wrote: »
    Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

    I see CVs of potential contractors from multiple companies during the tender process. There is no GDPR breech if this is done with permission.


  • Registered Users Posts: 5,200 ✭✭✭hots


    Strumms wrote: »
    Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

    That literally happens all the time.


  • Registered Users Posts: 166,026 ✭✭✭✭LegacyUser


    Thanks for replies. It was my contract, not a generic one. The person who had it was the clerical officer in the business I work in, and the employer had no idea she had it


  • Moderators, Business & Finance Moderators Posts: 9,921 Mod ✭✭✭✭Jim2007


    Strumms wrote: »
    Your post is nonsense, there is not one reputable company sending their employee CVs or contracts to clients or prospective clients... an information pack of relevant information about an employee is fine... a CV, with work history, contact/personal information, college details... to customers? Get a grip, data protection forbids it... anyone trying that is widening their door to a massive lawsuit.

    Stop embarrassing yourself, you are way out of your depth. You are making wild assumptions about the OP's situation and you have clearly not got the foggiest idea about the consulting industry.


  • Registered Users Posts: 166,026 ✭✭✭✭LegacyUser


    Thanks for replies. It was my contract, not a generic one. The person who had it was the clerical officer in the business I work in, and the employer had no idea she had it... Is there any thing else I should do, apart from reporting it to my manager


  • Advertisement
Advertisement