Data Protection

GrannyKate

I would be reluctant to give more detailed advice without knowing more about the type of organisation this is but appreciate that you need to be cautious in what is said on an open forum.

Does your job description say that it is your responsiblity to take files to the other sites or has this just crept into your role? It really depends how far you want to put your head above the parapet as to how you approach this. In the first instance you need to pursue it with your managers in writing - you could lodge it as a grievance if they are not taking your concerns seriously. They also need to address the fact that your car insurance will not cover business use unless you have paid to add it on. Transporting office files for other people is business use.
Custom and practice is a nonsense concept where it involves breaking the law. If you are willing to transport the files during your working day to the other sites (is there secure overnight storage there?) then say so, ask for mileage and make sure your insurance covers you. If no compromise is forthcoming you could respond to the case workers by saying no and just referring them to the manager. I assume that they are not willing to collect the files and keep them in their own homes overnight.

Sticky_Wicket

Ta muchly Granny Kate

My job description does not state it is my responsibility to transport files. The problem is that support workers are located in one office but over three locations and all closed files are stored in one location - if they need access to the closed file (someone accessing the service again) then they need the closed case file.

We also receive new clients, which are received in one location but are needed in another location. The referral details are scanned and e-mailed across and then the details placed in an internal envelope for me to transport - sometimes I am not even aware of the content until it is opened at the other end. Again all internal envelopes are kept in my home overnight.

The managers have never questioned how/where they are kept overnight and is it reasonable to expect me to transport them the same day outside working hours sometimes in excess of 35 miles?

The managers ignore the how and why and appear to not want to know, only that it is done.

If I refuse to just comply with what is being asked of me, they will see it as me being awkward and attempt to cover their tracks, it is not the first concern I have raised!

GrannyKate

Only you can know how things are at your workplace. I would always advise caution in the current job market but you do need to protect yourself by putting your concerns in writing about both data protection and your car insurance cover. Any transportation of files should be done in working hours not your own time. There is nothing in your job contract one presumes that requires you to provide overnight storage for highly confidential data and this is not the action of a responsible employer.

Yes there is a logistic and practical problem to be addressed but that is the manager's problem not yours. They are probably not nearly as complacent about this as they might appear to be to you. You will have done the right thing if you clearly advise them of your views and concerns. Whether you want to actually refuse to take the files home is really a matter only you can decide on.

Sticky_Wicket

Ok a change of stance here from my employer.

I attempted to be diplomatic here and approached my employer requesting written clarification on the practice of me moving files between two offices but retaining them overnight in my home.

One manager called me into a meeting and on arrival another manager was present. I actually found it very threatening and did consider walking out but decided to ride it out.

I was told in no uncertain terms that they were not aware of the practice of me taking home case files overnight and they had no knowledge of this. In addition, it was my role to identify issues and take appropriate action and in this case as I was aware of there being an issue, through my admission of being uncomfortable, they considered I had breached the data protection policy and they were going to carry out an investigation which could lead to dismissal.

They are denying they asked me to do this, denied any knowledge of the practice and in their opinion absolved themselves of blame.

I did ask them to clarify what Data Protection training I had received and that i had not been provided with any guidance as there was no procedure in place and was advised 'that's your responsibility'.

Does anyone know where I stand with this? I raise a problem and now they are back peddling in an attempt to cover their tracks.

GrannyKate

Ouch - but from your earlier posts I assume you are not at all surprised - thankfully there has not been an incident prior to their dropping you in it.
You need to make sure you retain any emails or correspondence you have had re moving files specially requests from case workers. I note that have not told you how the files were supposed to move between sites so they need to provide you with the procedure you should have been following (assume there isn't one). In the NHS the moving of all data has to be tracked and risk assessed and with such sensitive data your employer should have a similar procedure.
It is the responsiblity of the Data Controller (this is not you but the person registered with the Information Commissioner) to ensure there are policies and procedures in place.
You need to think back to when you started doing it - who told you that was how it should be done; who refused to allow you to take notes across in work time; who did you first advise of your concerns; what responses did you get; which case workers said what etc and do keep anything you have in writing including emails which are perfectly valid in law. It is not your reposnibility to provide your own DPA training and as I mentioned before their contract to provide this service almost certainly contains a clause requiring them to train staff.
I sympathise with your position but to continue as before would probably have been an unacceptable risk.

Sticky_Wicket

Thanks Granny Kate.

In all honesty I am expecting them to turn this on it's head. I did raise that various members of staff, including management had e-mailed me to 'bring back' named individual files.

Management are arguing that 'bring back files' night does not mean retaining them in my house overnight. So over a period of time, they request files when I am at one location and i hand them over the following morning - how do they think they materialised?

I was asked who had instructed me to do this but in all honesty I cannot remember but I know 100% i did not adopt the practice without being told. Case workers have and still do take files home overnight when they attend remote locations - in some instances they retain them at home for a period of 2-3 days at the weekend. Is this acceptable practice?

I expect management to be covering their tracks and agreeing to absolve themselves of any responsibility and take action against me and report that they have effectively 'removed the risk'.

I suppose i will just have to wait it out and take legal advice.

ValHaller

I agree with GK. Your employer has shown itself to be quite backstabbing. You need to gather your evidence.

If it does go to investigation and disciplinary, they should strictly get other managers to conduct these, I believe, as these managers would be raising the complaint. But if they do it themselves, let them, it becomes grounds for appeal.

GrannyKate

Don't concern yourself too much with what the Case Workers are doing. They will be bound by their own code of practice - basically such confidential material should be kept securely at all times unless there is an overriding professional reason for having it on your person. Case workers could be in the wrong for instructing you to follow an unsafe practice.

What you need from the employer is their procedure for transferring sensitive material between sites - with such highly sensitive material there should be a written protocol for this which you have been made aware of/and trained on at induction. I assume you have been instructed to stop the practice immediately so it will be interesting to see how they operate next week. From what you say they have not explained how the material was supposed to get to the other sites overnight. I suspect professionals are supposed to collect and return it themselves. If this goes to a disciplinary the managers are going to have to explain themselves at some point.

slenderkitten

any documents of a sensitive nature or has a level of security requirement should not be moved around as you are doing so without proper process in place if any problem should occur. i would tell my employer about your concerns and refuse to do it as you do not want to be liable for anything.

Sticky_Wicket

Granny Kate I was given no training on data protection or procedure and i have never seen a written protocol on the movement of sensitive information between locations.

I was handed written handover notes from the previous post holder of what my job entailed and literally had to get on with it and ask if i had any questions.