Some advice needed on data protection- quite sensitive

dlpfan2019

Hi all,

This is quite a sensitive one so a little warning on that....

Last year a friend of mine was raped, it had an enormous effect on her ( as you can imagine ) and she ended up coming off the rails a bit, this led to her doing some bits at work that led to her being dismissed- nothing criminal/ arrested for but turning up drunk etc- where she was not dealing with it

During the disciplinary she revealed what had happened to her and she was informed in writing that it will be dealt with in the strictest of confidence, unfortunately they still took the option to dismiss her

In the past year she has been off work and been diagnosed with Post Traumatic Stress Disorder amongst other things and after intensive therapy is now for the first time able to return to work

However, here is where the issue has been, over the last few weeks she has learned that details of what happened to her + details of her disciplinary have been leaked to both staff and to third party ( potential future business connections ) my question is simple really, is this allowed? I get gossiping happens in any job environment but this is very sensitive information and with the third party they were informed by her line manager that he had told them she was dismissed for being drunk constantly and disruptive, this means she now faces the difficult decision to reveal the full extent of what happened to her to a third party

Any advice on whether this breaches GDPR rules would be greatly appreciated

Lomast

What has actually been disclosed as it's not clear, if they have disclosed she was raped them i would thought it were a clear case, if however it's just the fact she was dismissed for being drunk in not so sure as that is true and could be argued that others had reason to know

dlpfan2019

The rape has been revealed to staff members as has details of the disciplinary - she has been contacted by staff members out of the blue about it - and during the disciplinary procedure other information was disclosed to staff not connected to the investigation before it had concluded

In terms of what has been said to third parties I am unsure but will find out but its still a horrible/unnecessary thing to do especially when they are fully aware as the reasons why, its more that details within the investigation seem to have been revealed but I believed ( maybe wrong ) that they were meant to remain private

nicechap

dlpfan2019 wrote: »

Hi all,

This is quite a sensitive one so a little warning on that....

Last year a friend of mine was raped, it had an enormous effect on her ( as you can imagine ) and she ended up coming off the rails a bit, this led to her doing some bits at work that led to her being dismissed- nothing criminal/ arrested for but turning up drunk etc- where she was not dealing with it

During the disciplinary she revealed what had happened to her and she was informed in writing that it will be dealt with in the strictest of confidence, unfortunately they still took the option to dismiss her

In the past year she has been off work and been diagnosed with Post Traumatic Stress Disorder amongst other things and after intensive therapy is now for the first time able to return to work

However, here is where the issue has been, over the last few weeks she has learned that details of what happened to her + details of her disciplinary have been leaked to both staff and to third party ( potential future business connections ) my question is simple really, is this allowed? I get gossiping happens in any job environment but this is very sensitive information and with the third party they were informed by her line manager that he had told them she was dismissed for being drunk constantly and disruptive, this means she now faces the difficult decision to reveal the full extent of what happened to her to a third party

Any advice on whether this breaches GDPR rules would be greatly appreciated

dlpfan2019 wrote: »

The rape has been revealed to staff members as has details of the disciplinary - she has been contacted by staff members out of the blue about it - and during the disciplinary procedure other information was disclosed to staff not connected to the investigation before it had concluded

In terms of what has been said to third parties I am unsure but will find out but its still a horrible/unnecessary thing to do especially when they are fully aware as the reasons why, its more that details within the investigation seem to have been revealed but I believed ( maybe wrong ) that they were meant to remain private

Your friend should contact ICO in the first instance who will decide whether its a breach.

Having said that, the genie is out of the bottle and I can imagine many defences that the ex-employer could mount.

If found to be in breach the ex-employer would be fined and have instructions to improve their data protection processes. I'm not sure how this will help your friend - do you know what it is she wants? if she doesn't want to go to ICO, she could write to ex-employer top person setting out her concerns and asking that no such repetition happens again?

Gavin83

Why did they discuss it with the third party? I find it bizarre that they'd just raise it out of the blue. Did she apply for a job at this third party company?

They'll be some debate about whether this breaches GDPR and even if it does the outcome is unlikely to be nothing more than a slap on the wrist, fines have been practically non existent at the moment and will likely only exist for the more serious breaches. Besides she wouldn't see any of this money.

What is she looking for as an outcome? I agree with nicechap, if it's simply to stop it happening again then she needs to speak to the company.

Marvel1

I would seek advice/contact the ICO to see if it what is, they may be fined and obviously the payout (if any) won't go to her BUT it wouldn't matter to me personally (if it was me), !!!! em, they need to learn it is not acceptable.

jonnygee2

During the disciplinary she revealed what had happened to her and she was informed in writing that it will be dealt with in the strictest of confidence

However, here is where the issue has been, over the last few weeks she has learned that details of what happened to her + details of her disciplinary have been leaked to both staff and to third party

What happened exactly, how did the third party find out? Work of mouth or official communication? If unsure she should use SARs to find out.

Generally speaking, no this is not okay. This would be considered 'highly sensitive data', making it a serious breach of data protection. It also potentially falls under the malicious communications act - it is hard to see why a company would start telling third parties about a rape of an ex employee with out some kind of malicious intent.

I think I would be seeking legal advice from a lawyer with knowledge of data protection breaches.

I would seek advice/contact the ICO to see if it what is, they may be fined and obviously the payout (if any) won't go to her

An ICO fine would not go to her, but if the ICO did fine them or even slap them on the wrist, this could be used as a platform for an individual compensation claim under the data protection act.

dlpfan2019

Thanks all for the replies,

I am pretty certain she has no intention of making it an official complaint with the ICO unless she really needs to, she has been through enough over the last few months in her recovery and has a police investigation into what happened to her ongoing so will not want to add to her stress

She simply wants them to stop really which is why I was checking as to whether it was a potential GDPR breach first before she writes to them

What she does know for sure happened though is:

- While the work investigation was ongoing staff were informed of the disciplinary process details and what the case against her was even staff in other departments that had no connection with her

- Staff later were informed of the rape against her - she knows of at least 3 who were told

- The third party were 2 businesses she was connected to while she was employed who were told specific details of the investigation and one was told about the rape- she assumes more may have been told

I will sit with her tomorrow and draft something up

She has been through hell and we live in a small town which I think the real issue is now as she does not want people to know and the thought of people knowing about it is making her mental health worse again, I want to help her address this now before it becomes too big an issue

jonnygee2

I am pretty certain she has no intention of making it an official complaint with the ICO unless she really needs to, she has been through enough over the last few months in her recovery and has a police investigation into what happened to her ongoing so will not want to add to her stress

I can understand this. It's not great that people get away with this stuff, but for your friend I can understand why this is best.

Pertinent points for the letter are:

- This is highly sensitive information (which has a different level of protection to normal personal information)
- There was no consent to share this information and you have a written statement that the information would be kept confidential
- The personal affect the sharing of the information has had on her, and the potential affects of further unlawful disclosures

For the avoidance of doubt you should also explicitly withdraw any permission for them to store or share her personal data beyond what they are legally entitled to keep. They are probably entitled to keep all of it, but it means they will need to be even more careful with how it is stored or shared.

She should also write to the third parties, telling them she understands that they have become party to personal information about her which she would not want shared, and request that erase any written reference to her, and take steps to prevent any further unlawful disclosure, again highlighting the potential affects on her.

That said, so many people know now, there may be no way to complete stem further spreading of the information.

dlpfan2019

Hi all just an update and quick question,

Letter went off and no reply,

She is due to start a new job on Monday, she did not have to give her previous employer as a reference on this, am I right in saying that her past employer cannot just make contact with her new ones to bad mouth her and mention the disciplinary?

That is what she is worried about currently

BrassicWoman

dlpfan2019 wrote: »

She is due to start a new job on Monday, she did not have to give her previous employer as a reference on this, am I right in saying that her past employer cannot just make contact with her new ones to bad mouth her and mention the disciplinary?

they could in theory advise of factual information but
a) how would they know where she is going?
b) is anyone there spiteful enough to make the effort?

low risk.