Data protection issue or not

WorriedOrNot

Hello

I'm not sure where to go for advice and I'm hoping someone might be able to help or at least point me in the right direction.

I'm going through a redundancy situation at work my division merged with another and I now have a new line manager and multiple people are doing the same job which isn't needed hence the redundancy but this isn't the issue its just background.

My new line manager advised that we have had a certain number of applications for voluntary redundancy and still needed to lose another certain number to meet the target loss. The numbers didn't add up so I sent my line manager an extract of a report from the company intranet which everyone can view and shows the numbers of hours everyone works to explain my point.

She has now stated that she has concerns about my conduct that I could have broken data protection and that colleagues may raise grievances against me. I don't feel that I have done anything wrong and that saying Flossie works 30 hours, Bobby works 20 etc to my line manager is such an awful thing. In fact I don't think I have done anything wrong at all.

I'm hoping someone with more knowledge than me might be able to help. I have a meeting with her next week where she has advised we will discuss this so it would help to determine my approach.

Thanks

sangie595

Why on earth did you need to circulate peoples working hours? Your boss is right - you should not have done it. Other peoples working hours, however you obtained the information, is none of your business, and certainly nothing at all to do with redundancy. I am reading this as you "nominating" other people for redundancy. Because why else would their working hours be relevant.?

stevemLS

If the information is freely available to all on the intranet to say you have breached the DPA is utter rubbish.

I can't see any issue with publishing that data on the intranet either. Presumably it is in the form of structures with post title, post holder and hours?

DandelionPatrol

sangie595 wrote: »

Why on earth did you need to circulate peoples working hours? Your boss is right - you should not have done it. Other peoples working hours, however you obtained the information, is none of your business, and certainly nothing at all to do with redundancy. I am reading this as you "nominating" other people for redundancy. Because why else would their working hours be relevant.?

That is ridiculous. The information is in the open on the company intranet:

WorriedOrNot wrote: »

My new line manager advised that we have had a certain number of applications for voluntary redundancy and still needed to lose another certain number to meet the target loss. The numbers didn't add up so I sent my line manager an extract of a report from the company intranet which everyone can view and shows the numbers of hours everyone works to explain my point.

All OP has done is to interpret the information. If there is a breach of Data Protection, it is the employer who has breached it. The interpretation of that data is not a breach of DP

NewShadow

You may want to have a look at these in advance of your meeting:

https://ico.org.uk/media/for-organisations/documents/1068/data_sharing_code_of_practice.pdf

https://ico.org.uk/media/for-organisations/documents/1128/quick_guide_to_the_employment_practices_code.pdf

I would suggest you have done nothing wrong in sharing information that was published internally and available to all staff.

You could say you are very sorry if you have inadvertently done anything wrong, but you are confused, if this is sensitive and restricted personal data as per the act, as to how you (and everyone else that works with you - including your manager) could freely access information that should be restricted?

SeduLOUs

sangie595 wrote: »

I am reading this as you "nominating" other people for redundancy. Because why else would their working hours be relevant.?

I didn't see that. OP stated 'numbers not adding up' so I assumed it was something about whole time equivalents not being correctly accounted for.

i.e. if 1 whole time member of staff needs to go to make the 'target', that means either one person who works 40 hours, or two people who work 20 hours each, or four people who work 10 hours each, or any other combination.

Can't see how you could be in breach of data protection for something already in the 'public' domain (i.e. within the work environment). Sounds like manager doesn't like having her mistakes pointed out!

Tigsteroonie

It may simply be that your boss isn't aware this information is on the company intranet (not everybody has time to look at every page/report) - so I would grab a screenshot or two that includes the intranet URL, ready to take to the meeting.

DandelionPatrol

Tigsteroonie wrote: »

It may simply be that your boss isn't aware this information is on the company intranet (not everybody has time to look at every page/report) - so I would grab a screenshot or two that includes the intranet URL, ready to take to the meeting.

Agree. And the devious follow through for OP is that if any issues arise, they could raise the matter of the information being on the intranet with the Information Commissioner’s Office.

If the ICO uphold the complaint, then the company is in the wrong. And if they don't, then OP has done nothing wrong.

WorriedOrNot

Hello

Thanks for all the feedback just to give a bit more information I didn't circulate the hours I only emailed my new line manager who should already know who worked what hours but didn't.

For simplicity and not to give exact numbers my line manager said there were 30 FTE in the pool for selection and that we needed to lose 10 that 2 full time and 4 part time people had applied for voluntary redundancy and that we now need to lose 4 people. I knew from working with them that none of the part time people worked more than 0.6 so it didn't add up I was trying to explain this not show who should be selected for redundancy.


The line manager has since said that the original figure of 30 was wrong and is actually less. Does this change anything? The information is there for thousands of people to see its not password protected.

Tigsteroonie

Figure of 30 could be wrong but could be a genuine mistake or slip of the tongue, they probably meant a headcount of 30 but that could equate to e.g. 20 FTE. Issue for the manager to consider is their reduction in terms of FTE; they can then work out, after voluntaries, how many FTE need to be lost and then the possible permutations. Just because they have to lose e.g. 1.2 FTE doesn't mean they select two people whose FTE adds up to 1.2.

Sorry, just thinking out loud.

OP, I don't think you have to worry about the actual figures. Your only concern is that she thinks you have breached DPA by emailing the data, when you didn't because they are in the company intranet. Unless you also speculated in the narrative ...?

WorriedOrNot

Hello

There was no speculation, my email was purely on numbers. No suggestion was made of anything let alone who should be made redundant.

I just wanted to understand how many jobs still need to go and now the new line manager is scheduling formal meetings, mentioning conduct issues, breaches of data protection and I think it's all going too far.