Gdpr breach

Melc123

I am after some advice. I have done something silly. My work colleague text me his self isolation note due to him having to self isolate. 

We both work two jobs, both jobs are the same place. He only told one of our workplace that he had to self isolate but not the other one, I mention this to the other employment to let him know that he was self isolate from the other job. He asked to see a copy of the self isolation, I know I shouldn’t have but I sent myself isolation as I was upset. The only reason why I had this self isolated note was because he text on my personal mobile.

I am worried now that in my current job I’m going to get the sack due to GDPR what are your thoughts?

elsien

What’s happened in the month since the situation arose?

https://forums.moneysavingexpert.com/discussion/6312857/gdpr#latest

Melc123

Since it’s happened to my work colleague got a written warning for breaking Covid rules and not self isolating 

he has put a grievance in against me forgiven his personal details out. This is still under investigation

NCC1701-A

Melc123 said:

I am after some advice. I have done something silly. My work colleague text me his self isolation note due to him having to self isolate. 

We both work two jobs, both jobs are the same place. He only told one of our workplace that he had to self isolate but not the other one, I mention this to the other employment to let him know that he was self isolate from the other job. He asked to see a copy of the self isolation, I know I shouldn’t have but I sent myself isolation as I was upset. The only reason why I had this self isolated note was because he text on my personal mobile.

I am worried now that in my current job I’m going to get the sack due to GDPR what are your thoughts?

Melc123 said:

Since it’s happened to my work colleague got a written warning for breaking Covid rules and not self isolating 

he has put a grievance in against me forgiven his personal details out. This is still under investigation

What responsibility has Company 2 to ensure confidentiality of info which it has not managed or provided?  Whilst I can understand (but not agree) your colleague being annoyed at you, I can't see how company 2 could uphold the grievance as its not info they generated, managed or held before you shared it with them.  

Bradden

Jillanddy said:

You have a legal responsibility under the Health & Safety Act to safeguard the health of yourself and others at work. What he proposed to do appears to have put that at risk, so I would argue that you had a legal duty to disclose since he didn't. And as he voluntarily sent you something then he was informing you of his status and disclosing it was the correct and lawful thing to do. He should have disclosed. He didn't. He is at fault. His written warning proves that. 

Whilst that is true they could have disclosed this without forwarding the document which appears to be the issue.

Bradden

@Jillanddy I Beleive the colleague has raised a grievance for breach of GDPR and subsequently the employer is invstigating the issue.. so it's gone beyond the "storm in a teacup" and is potentially a serious disciplinary issue now. - which is why the OP was adivsed not to share the document in the original thread.  The employer could find that the OP is at fault as there was no need to disclose the doucment itself to report their concerns.

My advice would be to focus on the fact the manager requested to see it.. and the employee complied. This shifts the blame onto the manager for requesting it.

74jax

I'm just jumping in here, as it's rather interesting (to me anyway) and I've a question - purely to settle my curiosity - had the OP got sent the Self Isolation Notice via a work route (ie worked in HR or the Manager of the self isolating employee) and THEN forwarded it on, so in effect forwarding on a work piece of data, would this be looked at differently?  

Bradden

@74jax I beleive in the situation you've described that would be permissable under GDPR as they would have a legitimate interest in processing the data.
It partially depends on what is in the employers policy regarding data protection and disclosure.

It may also depend on how the data was transmitted.. work email could be seen as legitimate compared to using a private email account for example.

The  other factor I can think of is whether they could claim protection as a whistleblower but I'm not expert enough to advise on whistleblowing in this situation.

Savvy_Sue

I'm trying to work out what the breach is.

I haven't seen a self isolation note, but apart from "you need to self isolate", what information could possibly be in it that the employer doesn't  already know?

Name, address, Nino, date of birth ... all known. 

I think the 'friend' is trying it on, upset to be caught out.