Can I be fired for breaching data protection?

AstroTurtle

confusedabouteverything wrote: »

Not to be rude, but your examples of a shop till, and car on a hill aren't comparable.

To loose a 1000 in a normal retail context would require multiple instances of neglect on the same day. Failing to put a car break on a hill is driving without due care and attention and would require a huge disregard for public and personal safety. Thai error, although serious, on most other days would have been of absolutely no consequence to anyone.

Whereaa the other two examples fall outside of simple human error.

On modern till systems such as a bank cashier, Losing £1,000 can be from pressing a button wrong on a system. Same as an email. Those examples where just instances of where accidents could have resulted in someone losing a job. The fact you value health & safety if a car rolled down a hill, means you should value someone's personal identity that in the wrong hands mass fraud could occur or a breach of contract. Imagine if your bank just sent all your information to Joe next door? You'd be on here complaining about them.

You clearly don't value personal or sensitive data as your trying to downplay the severity of what could have been lost.

What has been lost in the email.

Medical details?
Card Details?
Business Information?
Transaction information?
Names & Addresses?
Dates of birth?

There is a reason why firms can be fined up to 20,000,000 million euro's now for miss handling data. Because some people still don't think it's a big deal and just a silly whoopsie.

agrinnall

confusedabouteverything wrote: »

Surely, this can't ruin someone's career

Perhaps your 'friend' is in the wrong career and should be looking for a new one anyway.

BoGoF

Is copying and pasting a career these days?

Doshwaster

BoGoF wrote: »

Is copying and pasting a career these days?

It seems to be the only skill some "journalists" have.

motorguy

stator wrote: »

Mistakes like this do ruin people's careers.
The practice you describe sounds poorly planned from the company's point of view, but it is still the employee's mistake.

I would have thought, provided it was accidental (which it was) and he reported it to his manager as soon as possible and followed company process, then its not gross misconduct.

Trying to cover it up or ignoring it, could be.

Ozzuk

Difficult one, when is a mistake gross misconduct. During my GDPR training (delivered by HR solicitors) they cited a recent example where someone was fired for sending a group email to external parties where the addresses were visible to everyone. I piped up and said he should have used BCC, but much to my embarrassment (as an IT guy!) apparantely even BCC isn't sufficient as you can access the header information.

So yes, it is entirely feasible to fire someone for a data breach -and as the vast majority of breaches are by accident (deliberate breach is a no-brainer gross misconduct, and not just for GDPR) the company will have to decide on a case by case basis what it the most appropriate form of action.

I'd have thought a blanket policy of dismal would be difficult to enforce - our policies for instance state a breach of (any) policy could result in disciplinary action and ultimately dismissal. But if you worked for say the NHS, or GCHQ, any breach could indeed be clear gross misconduct, no second chances etc.

There could be mitaging circumstance that prevent this becoming automatic dismissal - lack of training provision, lack of policies, system issues, low impact etc

iolanthe07

20,000,000 million euros


There aren't that many euros in the world.

AstroTurtle

iolanthe07 wrote: »

20,000,000 million euros


There aren't that many euros in the world.

you're right,

as of 2007 there was 5,361,000,000 1 euro coins in circulation.

Carrot007

Ozzuk wrote: »

I piped up and said he should have used BCC, but much to my embarrassment (as an IT guy!) apparantely even BCC isn't sufficient as you can access the header information.

No the mail server strips out the BCC line before sending. You are correct.


Of course this is what it is meant to happen, someone may have made a crap mailserver without reading the specs these days, but I doubt it would go unnoticed for long.

Dizzy_Ditzy

Ms_Chocaholic wrote: »

I haven't yet completed my mandatory GDPR training :eek:

That isnt an *excuse* - Data Protection Act existed right up until GDPR came in and it would still possibly be a sackable offence to send confidential information to an unrelated person