GDPR and personal data at work

Poppy99

Are annual leave records regarded as personal data under GDPR? Our leave records cards, (electronic), which are normally just shared with line managers to authorise leave, are going to be stored in a new team drive, accessible to everyone in the team - about 30 plus people. Not sure why this is being done, there were no problems with old system but new senior manager has now decided this is the way forward. We all have different line managers so it is not just a case of one line manager having access to all their direct report leave cards and it being convenient to have them in one place.

As well as annual leave, also on these cards is start date of employment, whether you have taken any special leave like compassionate leave, so I think that the employer is on sticky grounds GDPR wise. 

We are a toxic team, I really don’t want my record being stored in a transparent folder so that others can snoop at it, which they will. Some of us have protected annual leave carried over from a previous employer, which means we get slightly more leave. I can imagine that will cause a bit of rancour and resentment too. I am all for openness and transparency but this seems a somewhat strange change, especially in this GDPR age. 

John_

I can’t see that that’s necessarily protected data.

74jax

People would know if you were off anyway, having it on a chart etc wouldn't make a difference really.
People at my work have different allowances too. It doesn't cause problems, it's just some  people have negotiated more, bought extra days etc 

KatrinaWaves

I think some people are on commission for ACAS. 

[Deleted User]

We're so lucky to have ACAS in this country - a direct line where employees can get advice on their work issues, which is definitely a necessity, with the way some some employers treat their staff. As many people as possible need to know it exists.

General_Grant

John_ said:

I can’t see that that’s necessarily protected data.

I think the rest of us can.

JReacher1

General_Grant said:

John_ said:

I can’t see that that’s necessarily protected data.

I think the rest of us can.

I don’t agree. 

I don’t believe when you are on holiday at work is protected data. It seems pretty obvious that people you work with need to know when you are off work. 

bucksbloke

I'm a HR Manager with responsibility for GDPR. Annual leave records which can be identified to you is personal data. However, annual leave on its own is not sensitive info, and  your employee may be able to justify sharing that data by ensuring your colleagues are prepared.

If we look at other absence such as sickness - your colleagues knowing you are sick is not necessarily sensitive - but knowing the reason why you are sick definitely is. 

gettingtheresometime

Jsacker said:

KatrinaWaves said:

I think some people are on commission for ACAS. 

And I think some people are trolls. 
(edit: though I'm loving the forum post-Blatchford! It's actually much more chilled out overall and even your trolly comment is half-assed here!)

Ah yes there's far more 'I'll tell you what you want to hear than what is actually you're position' going on.

TBagpuss

I think Bucksbloke is correct - knowing whether you are off or whether it is holiday or sickness is unlikely to be data which should be protected but details of why may well be.

I would suggest that you flag it up with HR (or whoever is implementing it) to ask what, specifically, will be visible.

For instance, in our system,   we have an office calendar which everyone can see and which shows who will be in or out on any day, which allows staff to check for clashes before they ask for time off. However, that calendar doesn't show what the reason for the absence is.

Each member of staff can also see their own record, which shows what their entitlement is and how many days they have left, and which days they have already taken or booked and the reason for the booking.

Line managers (who have to authorize absences for their direct reports) can see those details for their direct reports, and senior managers and HR can see everything for everyone.

TBagpuss

Just to add, you should have someone at your company who is responsible for Data Protection - they may be the appropriate person t speak to, as well as / in stead of your line manager or HR.