Query about GDPR

AJS321

Hi,

Here’s a run down of the situation I’ve found myself in.

A few months ago, the company I work for sent a field agent to a customers home to do a home visit, which is fairly routine in my field of work. While they were there the customer began to have what sounds like a mental health crisis and called the police. The field agent remained on the street outside until the police arrived so he could explain his version of events. The police officer was satisfied no crime had been committed and left the matter at that.

The field agent then phoned the office to report the outcome of the visit which is standard practice, I just happened to be the person who answered the phone and I recorded everything on the customers case notes, which again is standard practice. I gave a full account of the police turning up and the fact no crime was committed.

However, the customer has now sent the company a letter saying that while the field agent was at her home she and her children were assured and that he caused some criminal damage to her property. She stated she now intends to initiate a private prosecution against the company and ‘certain named individuals’ involved in her case.

This does sound like empty threats, and even if the case does go to court we most likely have a watertight case as we could produce a police incident report as evidence. But it’s the ‘certain named individuals’ part that’s worrying me. I know the customer has a right under GDPR to request a full copy of their case notes, which is something their letter never mentioned. But if they did request this at a later date, would the company be obliged under GDPR to supply them with my babe and contact details as my name is recorded on the case notes as the person who answered the call when the initial incident happened.

If the customer gets hold of this information then I could be named as a defendant in court. As I’ve already said, it’s most likely an empty threat and we have strong evidence to defend ourselves with. But as someone whose never been to court and never been in trouble with the law before, it’s naturally unnerving.

Is anyone able to offer any advice regarding the GDPR point? Do people think I’m getting worried rather unnecessarily about this?

boo_star

I doubt they'd be able to get your name via an SAR request.

But it's academic anyway, they'd be able to issue a witness summons to compel you to attend court so it doesn't really matter that they couldn't do it vias SAR.

steampowered

If the company hands over the call notes under GDPR, your name should be redacted.

If the company simply hands over your name that would itself be a breach of GDPR.

I think you are worrying unnecessarily. Unfortunately there are crackpots like this who make all kind of ridiculous threats. The fact that the customer suggested a "private prosecution" already tells you that the police have already told her where to go. The chances of the customer actually taking this further are pretty much zero.

ACG

Under GDPR your name would (or should) 100% be redacted.
Whilst the person is entitled to know what information has been held about them, you are also protected under the same GDPR legislation to protect your information from being passed on without consent.

jonnygee2

However, the customer has now sent the company a letter saying that while the field agent was at her home she and her children were assured and that he caused some criminal damage to her property. She stated she now intends to initiate a private prosecution against the company

This is so absurd a proposition it's not worth worrying about. Even if she somehow recruited a lawyer and started the prosecution (extremely unlikely), if the charge is assault against children the CPS would not allow a private prosecution - they would simply take over the case and then probably close the case down immediately anyway.

I used to work in customer service and you get threats like this all the time. You just need to gain a slightly thicker skin.

Undervalued

jonnygee2 wrote: »

This is so absurd a proposition it's not worth worrying about. Even if she somehow recruited a lawyer and started the prosecution (extremely unlikely), if the charge is assault against children the CPS would not allow a private prosecution - they would simply take over the case and then probably close the case down immediately anyway.

I assume you must be reading

children were assured

In the OP as "children were assaulted" ? Otherwise I see no mention of any alleged assault, only "criminal damage"?

I agree it is incredibly unlikely that a private prosecution will be made as the costs are huge. So unless this individual has very substantial means or is being funded by some other body it really isn't going to happen.

In the remote chance it did, then there are other ways she or her lawyers could obtain the necessary names and information so the SAR under the GDPR aspect is largely academic.

Comms69

AJS321 wrote: »

Hi,

Here’s a run down of the situation I’ve found myself in.

A few months ago, the company I work for sent a field agent to a customers home to do a home visit, which is fairly routine in my field of work. While they were there the customer began to have what sounds like a mental health crisis and called the police. The field agent remained on the street outside until the police arrived so he could explain his version of events. The police officer was satisfied no crime had been committed and left the matter at that.

The field agent then phoned the office to report the outcome of the visit which is standard practice, I just happened to be the person who answered the phone and I recorded everything on the customers case notes, which again is standard practice. I gave a full account of the police turning up and the fact no crime was committed.

However, the customer has now sent the company a letter saying that while the field agent was at her home she and her children were assured and that he caused some criminal damage to her property. She stated she now intends to initiate a private prosecution against the company and ‘certain named individuals’ involved in her case. - best of luck to her. Private prosecutions cost tens of thousands, if not hundreds of thousands, of pounds.

This does sound like empty threats, and even if the case does go to court we most likely have a watertight case as we could produce a police incident report as evidence. But it’s the ‘certain named individuals’ part that’s worrying me. I know the customer has a right under GDPR to request a full copy of their case notes, which is something their letter never mentioned. But if they did request this at a later date, would the company be obliged under GDPR to supply them with my babe and contact details as my name is recorded on the case notes as the person who answered the call when the initial incident happened. - I doubt it. Usually would be identified as Employee (initial, number, whatever) or redacted

If the customer gets hold of this information then I could be named as a defendant in court. As I’ve already said, it’s most likely an empty threat and we have strong evidence to defend ourselves with. But as someone whose never been to court and never been in trouble with the law before, it’s naturally unnerving. - this will never see the inside of a court room

Is anyone able to offer any advice regarding the GDPR point? Do people think I’m getting worried rather unnecessarily about this?

Yes, you are worried over nothing

AJS321

Thanks for all the advice. All things considered I’m probably worrying about nothing.