GDPR Question

dlpfan2019

Hi all,
Just wondering if anyone can help with some GDPR related questions, am I right in saying the following:

• Grievance Procedures- Need to remain confidential and cannot be passed onto 3rd parties? - was not asked as a reference
• If someone has received a caution for something this cannot be passed on by an employer to 3rd parties- was not asked as a reference
• Are able to request how sensitive data has been used by employer?

A bit of a brief summary, my friend suffered a severe attack ( won't go too much into detail ) , he suffered PTSD inc self destruction. He ended up doing something at work and was dismissed- received a caution for it.As part of the grievance he told his employer the background to the more sensitive elements- the PTSD/attack etc and it was agreed in writing it would remain private only to the investigation team
 
He now is in a new job (has been for 6 months) but has had a couple of 3rd parties/ 2 ex employeees he worked with come to him and say how he heard he was arrested and convicted of offence (not true as cautioned and not arrested) and others detailing the reasons he was sacked.
He has asked a request to see how his sensitive data was used but been told they don't need to tell him this? Should he put in a SAR for this?

Could anyone advise? As far as I was aware the above are all treated as sensitive data- certainly are where I work- and this would be considered a breach of GDPR but wanted to check before I advised him

dlpfan2019

_shel said:

 They can share all of that because you ultimately give your permission by handing over your employers contact details for them to obtain a reference. 

No sorry opposite was the case,
They were not asked for an reference
The other 3rd parties mentioned that have been told are not related to his employment but through a line manager basically gossiping outside of work

KatrinaWaves

I feel there’s a part missing here. He did something at work that he received a police caution for? Who raised a grievance? Do you mean as part of the disciplinary he told them that he had PTSD? 

Is it beyond the realms of possibility that the severity of what he did at work, requiring a police caution, was known to other people at work, not just the management dealing with the ’grievance’

dlpfan2019

Sorry was not clear, my fault
I mean as part of the disciplinary he told them. What he received a police caution for was outside of work but he declared it in his disciplinary - he took drugs to cope- silly but its done. He had in writing it would be contained just to the investigation team

BrassicWoman

What kind of work is it? If for example he is in a school, there’s a legal obligation to pass on some kinds of info to future employers.

dlpfan2019

To put it simply - as think I have confused it a bit
- Is his old employer allowed to contact his new employer when not used as a reference- he hasn't disclosed his caution to his new employer for example as no need to under the Rehabilitation of Offenders Act and his worry is they will tell them
- Can he ask for a SAR on whether the information was kept to just the investigation team as they agreed in writing or is that too vague?

KatrinaWaves

Okay that’s quite different. Was what happened at work drug related? Again, I feel if someone was on drugs at work it would be pretty obvious to most people around and not a huge leap to assume they were sacked for that.

Generally speaking, what is this person hoping to gain from this? A SAR isn’t going to include information about who they gossiped about the disciplinary too. 

dlpfan2019

KatrinaWaves said:

Okay that’s quite different. Was what happened at work drug related? Again, I feel if someone was on drugs at work it would be pretty obvious to most people around and not a huge leap to assume they were sacked for that.

Generally speaking, what is this person hoping to gain from this? A SAR isn’t going to include information about who they gossiped about the disciplinary too. 

I think the aim is basically just to get them to stop saying things to third parties, especially as its been wrongly said he was arrested and convicted of an offence so its inaccurate. I think due to the sensitive nature of the attack/PTSD he wants to ensure only those who were given permission to have that information have done.
No at work was not drug related, he was turning up late etc and was arguing with his line manager - again PTSD related

unforeseen

The fact that the story that the 2 ex-employees heard is inaccurate makes me think that it came from another source, probably outside work especially if there are 3rd parties involvef

Do you have any evidence that his employer was passing the information on to the new employer? 

nicechap

dlpfan2019 said:

Hi all,
Just wondering if anyone can help with some GDPR related questions, am I right in saying the following:

• Grievance Procedures- Need to remain confidential and cannot be passed onto 3rd parties? - was not asked as a reference
• If someone has received a caution for something this cannot be passed on by an employer to 3rd parties- was not asked as a reference
• Are able to request how sensitive data has been used by employer?

A bit of a brief summary, my friend suffered a severe attack ( won't go too much into detail ) , he suffered PTSD inc self destruction. He ended up doing something at work and was dismissed- received a caution for it.As part of the grievance he told his employer the background to the more sensitive elements- the PTSD/attack etc and it was agreed in writing it would remain private only to the investigation team
 
He now is in a new job (has been for 6 months) but has had a couple of 3rd parties/ 2 ex employeees he worked with come to him and say how he heard he was arrested and convicted of offence (not true as cautioned and not arrested) and others detailing the reasons he was sacked.
He has asked a request to see how his sensitive data was used but been told they don't need to tell him this? Should he put in a SAR for this?

Could anyone advise? As far as I was aware the above are all treated as sensitive data- certainly are where I work- and this would be considered a breach of GDPR but wanted to check before I advised him

Whilst a caution is not technically a conviction, it is an admission of guilt.  So unless you are party to the actual references/ off the record discussions, arguing over such a point of definition is futile.   

A SAR will not reveal if one of the investigation team has verbally told someone else the contents, or part of the investigation.  

If he is in new employment, and is doing OK, I would suggest he distances himself from these 3rd parties/ ex employees (I presume you mean colleagues - see how easy it is to use wrong words like conviction & guilty?), and makes a judgement call about whether to tell his current employer about his caution & disciplinary at previous work.  That or just put all the gossip behind him and hope for the best.

dlpfan2019

unforeseen said:

The fact that the story that the 2 ex-employees heard is inaccurate makes me think that it came from another source, probably outside work especially if there are 3rd parties involvef

Do you have any evidence that his employer was passing the information on to the new employer? 

Thanks for the reply,
I should have been clearer in the OP, the third parties/ ex employees have all cited his previous line manager as telling them hence why he knows who it is. I should say as well part of the reason he knows is that he is in the same kind of industry as before so the third parties are people he dealt with in both jobs.

I was just under the impression that both disciplinaries and criminal records- although I thought cautions were removed instantly anyway- were protected data? I suppose that is what I am trying to ascertain for him