Data Protection

Sticky_Wicket

I work for an employer that provides a highly sensitive end user i.e child sexual abuse or something similar.

The employer has 2 office locations.

I am being told to take case files from one location, store them at home/in the car overnight and take them to the 2nd location the next day. I am uncomfortable in doing this as i cannot guarantee their security.

I work between two locations and sometimes a remote location. I cannot take from one location to another in same day as they will not permit me to leave early to do this - oh and I would then be able to claim for the travel which they dont want to do.

Can my employer force me to do this?

Ta muchly

TimBear

I don't know about whether they can force you to do that or not but it's highly risky, because as you say, you can't guarantee the security of the sensitive documents.

Are there only hard copies? Do you have a server you can back up on to which you can access from both locations?

Ms_Chocaholic

Is there anyway you can store them safely at home; do you have a lockable cabinet of any description at home.

marleyboy

Can you not encrypt the data so as to make it useless to any prying eyes without decryption?

ValHaller

You should not take any responsibility yourself for the security of the data in your own home. You should in writing (email at least) ask the employer to confirm that they require you to transfer <specified sensitive data> between sites, storing it at home overnight and to confirm that they accept full responsibility for compliance with data protection. Don't do it - even encrypted - without written confirmation - and keep your request and any confirmation safe at home.

My bet is that no manager will want to provide such confirmation. But you may find yourself on the end of verbal ultimatums. If that happens, get the matter referred to HR for a ruling on whether the instruction is lawful. My strong feeling is that if you do this, your employer will be in breach of the Data Protection Act.

With idiot managers, this will be hard, but if you are any kind of professional in this field, it is a stand you need to take.

Sticky_Wicket

These are hand written case notes including all their personal details, nothing is encrypted.

I don't have a lockable cupboard in my home, why would i need one and i dont see it as my responsibilty to have one for this purpose.

I just feel really uncomfortable with the whole situation. No doubt i would be disciplined if anything happened my home but i do have emails telling me to do this.

ValHaller

Sticky_Wicket wrote: »

I just feel really uncomfortable with the whole situation. No doubt i would be disciplined if anything happened my home but i do have emails telling me to do this.

I think that you need a little more than the emails - I would feel uncomfortable. You need evidence that you have raised the Data Protection issue and that the employer confirms that the proposal is acceptable.

paddyrg

Also - insurance - if yours is a personal car but you're effectively using it for commercial purposes, it may invalidate your insurance and the company's paperwork and indemnity insurances would almost certainly have something to say about asking you to leave their sensitive data in a car park overnight on a regular basis. Might be worth raising as another reason why you feel uncomfortable doing this.

LittleVoice

paddyrg wrote: »

Also - insurance - if yours is a personal car but you're effectively using it for commercial purposes, it may invalidate your insurance and the company's paperwork and indemnity insurances would almost certainly have something to say about asking you to leave their sensitive data in a car park overnight on a regular basis. Might be worth raising as another reason why you feel uncomfortable doing this.

Where does the OP say the suggestion is that it is left in a car park? It doesn't even say "regularly" but that might be implied.

Many people put their car in a locked garage overnight, not in a car park.

Why do the files have to be transferred from one location to another? Why do they need to be transferred from one to the other? Is it for case reviews with managers/other professionals or to have them immediately available when seeing clients?

Sticky_Wicket

The files are usually kept in my house overnights and I am asked to do this on a weekly basis.

Closed files are kept in one location but we have case workers across three locations. If a case file is reopened i need to get it from the closed case files and transfer it to the relevant worker at another location. The problem is that i am not per permitted to travel to the separate location the same day unless i do it in my own time and at my own expense.

Managers want the information, restrict how I do it and then advise me it is 'my problem' how I do it.

If anything went wrong, I don't doubt they would deny they had asked me to do this and it would be my head on the block - but i don't want to appear unreasonable.

GrannyKate

I am assuming you do not work for the public services but for a body which has a contract with a local authority or health service body.
Data Protection is a personal responsiblity for everyone so you are right to protect yourself and your clients as far as possible.
Your employer will have been required to have Data Protection policies and procedures in order to win this contract which would definitely have included information governance training for staff - have you had any training?
A lot of staff have to move sensitive personal data as part of their role (think of district nurses for instance) and much of this does not lend itself easily to computers although it is gradually happening. It is not unreasonable for you to ask for a lockable container for the files as they are so sensitive. Do not leave them in your car overnight and when moving them they should be in the boot out of sight - not on the back seat.
I agree for the most part with ValHaller but do not think it would necessarily be unlawful to ask staff to carry files between sites as much of health and social care would not operate without this process. The employer needs to move the minimum amount of personal data possible but still be able to provide the service safely and effectively which may or may not require the entire file. The employer should also consider whether it is necessary for you to have access to the entire file in order to fulfil your role. This will rather depend on what you are doing with clients. Your employer does have a duty to have written procedures in place to manage data and you have a duty to follow these and to raise any concerns you may have with your employer. I would suggest that you approach your employer for their policies and procedures and ask for a meeting to discuss your worries with their governance lead.

(I am a retired governance manager for public services)