Right to confidentiality - Advise please

dreamypuma

Hi All,

I'm after a bit of advice on behalf of a friend that I am supporting.

My friend underwent a medical procedure 3 years ago, something that she shared only with closest of family, friends and her immediate line manager in confidence. Leave for recuperation was agreed with her GP and (then) line manager, and documented in accordance with policy.

Fast forward three year. My friends line management has changed, and the individual now responsible seems less that endeared to my friend for nothing but personal reasons. Fortunately my friend has not risen to any bating from this new manager and continued dutifully, with her contracted role despite, underlying unsettlement.

This manager has now accessed historical leave records for her own personal reasons and not for reasons she is privileged. The details of my friends medical condition was then witnessed to have been shared with staff in the office, and the Manager's colleagues, who have no privilege to this information.

This has caused my friend considerable upset, for what is an emotive and personal matter.

I feel my friend was afforded confidentiality from her line manager, who owes them a duty of care. We feel there has been a breach of this duty, and would like this addressed. The incident is also within the public sector office.

We propose to raise a formal grievance.

Based on the above, is there any advise that can be offered? Particular steer on employee rights would be welcome.

ohreally

dreamypuma wrote: »

The details of my friends medical condition was then witnessed to have been shared with staff in the office, and the Manager's colleagues, who have no privilege to this information.

This may be a DPA breach as the information is sensitive and needs handled as such.

Is there a disability element and is she a union member?

dreamypuma

There isn't a disability issues that is related to the breach of confidentially.

My friend does have an ongoing and declared medical issue that requires reasonable adjustment.

This seems to be the root cause of her line managers ongoing grievance with my friend, however cannot be evidenced so we need to park this line of thought to focus on the confidentiality.

My friend was part of a Union, but left due to their ineffectiveness in previous incidents with fellow colleagues.

The manager is known to the union for previous incidents. Unfortunately escalations against her seem to mysteriously get dismissed by management.

With regards to the DPA issues, does there have to been (or prospect of being) a tangible loss for there to have been a breach?

daytona0

But it wasn't shared "in confidence" with the previous manager! The manager "documented [it] in accordance with policy."

So my immediate thought is:

Why is manager A privy to the information which is stored on you friend's work file, but manager B (who has taken over their responsibilities) isn't?

So I personally think the new manager IS privileged to access that information!! The only real argument, in that respect, is whether or not the COMPANY lawfully retained that information in the first place! That's a totally different question and has nothing to do with the new manager. In fact, it has more to do with the old manager and their possible inability to follow the correct process.

It is, however, concerning that you mention information was shared to other staff! That is potentially very naughty. It would be interesting to know in what context it was shared, and to whom it was shared to (other managers, low level employees, boardroom members? etc). I cannot fully rule out the possibility that there was a completely legitimate reason for sharing it, and your "friend" is just using it as ammo...

dreamypuma

So for clarity, I am not saying that a new manager is not privileged to that information, of course they are. They are for the purposes of fulfilling the contracted duty.

We have evidence that the information was not accessed for the purposes of fulfilling her role or anything related to this. We know why this was accessed, so this is not for debate.

The information was shared with the team that she manages, (my friends colleagues). The Managers colleagues were also managers, but had no line responsibility to my friend, nor are they manager within the same business unit as my friend. One is actually the managers on/off boyfriend, the other her brother. ( I hope this puts the situation in context)

-taff

She could ask to speak to HR and say she's concerned that her personal medical history has been shared without necessity to other BULs and individuals who have no need to know.
She could ask HR what protocols they have in place to stop this happeneing, and what are their protocols if it's found that this has happened.
She could then say she has witnesses to say this has happened to her and that she is understandably upset but unsure of the correct procedure to document or complain about this.
She should also if possible, get whoever is in charge of her manager to sit in on this meeting or even two levels above, as they are unlikely to be involved in any pettiness.

If they are aware there is a problem, they will probably have a word with her manager.

She should also document this kind of thing in a diary, dates etc, what happens when she is baited etc, to show an ongoing bullying problem

steampowered

dreamypuma wrote: »

With regards to the DPA issues, does there have to been (or prospect of being) a tangible loss for there to have been a breach?

This is an area where the law has been in a state of flux. It used to be that you needed to prove tangible loss.

However, in light of a recent case brought against Google, it is now possible to claim damages for distress without demonstrating a tangible loss.

In reality, it isn't usually a good idea to sue your current employer. Best to deal with it through a grievance if possible.

angelin77

Hi
If you are concerned that your friends personal data has been misused, I would suggest you go on the Information Commissioner's Office (ICO) website which is full of information regarding data protection. They have an online chat facility or you can email them about your concerns. They can advise if a breach of data protection law has been breached. I have found them to be very helpful.

TELLIT01

Isn't this a question of medical / personal confidentiality rather than data misuse? It shouldn't be acceptable for a manager to discuss one employees medical situation with anybody else without a valid reason.
I would certainly be taking it up with the HR department (if they exist) as a matter of urgency.