GDPR Question

Undervalued

dlpfan2019 said:

To put it simply - as think I have confused it a bit
- Is his old employer allowed to contact his new employer when not used as a reference- he hasn't disclosed his caution to his new employer for example as no need to under the Rehabilitation of Offenders Act and his worry is they will tell them
- Can he ask for a SAR on whether the information was kept to just the investigation team as they agreed in writing or is that too vague?

Yes - obviously!
It is a free country and they can write to who they please and ask them whatever they like. Whether the former employer should answer their questions, or even reply at all, is another matter.

dlpfan2019

Thanks all, just got advice from ICO who have said the following by live chat

"If they were not a named reference, I cannot think of a reason under data protection legislation that would allow that to happen.

I will say however that if the other employee was acting in their private capacity and not in their capacity as an employee of the organisation, data protection legislation would not apply as it does not cover individuals acting in a private capacity."
"Information about grievances should be kept confidential and should not be disclosed unless there is a legitimate reason requiring that disclosure such as a legal obligation."
Also went on to say that info relating cautions should not be disclosed as considered sensitive data and are spent

Thanks all for your help

KatrinaWaves

Again why are you saying grievance to the ICO when there was no grievance, it was a disciplinary.

i appreciate you are trying to help your friend but you are using incorrect terminology which means different things, and are using second hand info. That is not gonna help them. 

Undervalued

dlpfan2019 said:

Thanks all, just got advice from ICO who have said the following by live chat

"If they were not a named reference, I cannot think of a reason under data protection legislation that would allow that to happen.

I will say however that if the other employee was acting in their private capacity and not in their capacity as an employee of the organisation, data protection legislation would not apply as it does not cover individuals acting in a private capacity."
"Information about grievances should be kept confidential and should not be disclosed unless there is a legitimate reason requiring that disclosure such as a legal obligation."
Also went on to say that info relating cautions should not be disclosed as considered sensitive data and are spent

Thanks all for your help

But, as Katrina has said, it wasn't a grievance. It was a disciplinary that lead to dismissal, for something for which he also received a police caution! That is very different.

I am sorry but I get the distinct impression that you are only interested in opinions that back up your view of the situation! Feeding the ICO a (misleading) line so that you can quote bits of one of their adviser's informal opinions really isn]'t going to help anybody.

dlpfan2019

Sorry you are correct, my terms are wrong, have re-clarified with them
They have said that the advice would remain the same unless there was a legal obligation to do so such as a parliament act 

Comms69

dlpfan2019 said:

Hi all,
Just wondering if anyone can help with some GDPR related questions, am I right in saying the following:

• Grievance Procedures- Need to remain confidential and cannot be passed onto 3rd parties? - was not asked as a reference
• If someone has received a caution for something this cannot be passed on by an employer to 3rd parties- was not asked as a reference
• Are able to request how sensitive data has been used by employer?

A bit of a brief summary, my friend suffered a severe attack ( won't go too much into detail ) , he suffered PTSD inc self destruction. He ended up doing something at work and was dismissed- received a caution for it.As part of the grievance he told his employer the background to the more sensitive elements- the PTSD/attack etc and it was agreed in writing it would remain private only to the investigation team
 
He now is in a new job (has been for 6 months) but has had a couple of 3rd parties/ 2 ex employeees he worked with come to him and say how he heard he was arrested and convicted of offence (not true as cautioned and not arrested) and others detailing the reasons he was sacked.
He has asked a request to see how his sensitive data was used but been told they don't need to tell him this? Should he put in a SAR for this?

Could anyone advise? As far as I was aware the above are all treated as sensitive data- certainly are where I work- and this would be considered a breach of GDPR but wanted to check before I advised him

If he accepted a caution, he accepted guilt. So whilst not a conviction, he basically said "i did it". 

A SAR only provides information they hold, it doesnt provide how it was provided and doesnt account for knowledge. IE if this was said verbally it's not covered by the SAR.

KatrinaWaves

Honestly chances are at the time it was the hot gossip around the office. It may not be right but it’s how it is. If you’re on drugs and getting police cautions, arguing with your manager in work people are gonna find out. 

It will not be the hot gossip anymore. The people who know will have known at the time. They won’t be employing new people and saying’oooh you’ll never guess who got sacked and why!’ To staff who weren’t around at the time. It’s water under the bridge. He needs to just focus on his new job and sobriety. 

General_Grant

What sort of caution - conditional or not?
Straight forward cautions are "spent" immediately but conditional ones are not (takes 3 months).

dlpfan2019

General_Grant said:

What sort of caution - conditional or not?
Straight forward cautions are "spent" immediately but conditional ones are not (takes 3 months).

Hi,
It was a simple one, was issued over 12 months ago now

BrassicWoman

You still haven;t said what line of work it is. So we don't know if it's a legal requirement, which for some jobs goes over and about referencing and DBS requirements.