Whilst off work, a letter sent by management relating to absence was sent and had a NHS Covid19 isolation note enclosed for another member of staff, with their name and date of birth on.
This was clearly a mistake but also a serious breach of data protection, how serious is this and what course of action is best?
ANNOUNCEMENT : ALL OF ROYAL MAIL'S EMPLOYMENT POLICIES (AGREEMENTS) AT A GLANCE (Updated 2021)... HERE
ANNOUNCEMENT : PLEASE BE AWARE WE ARE NOT ON FACEBOOK AT ALL!
Important Data Protection query
-
yellowbelly
- Posts: 3713
- Joined: 23 Jun 2015, 15:51
- Gender: Male
Important Data Protection query
How serious? - you can order anybody's birth certificate with name and DOB, if it had had their address, NI number, pay number etc on it I would
be a bit more concerned.
What course of action to take? - It depends on if you want to drop someone in the mire - theoretically according to the .gov.uk website it's the person whose information
has been not kept secure who should make the complaint, if you know them you might want to let them know what has happened, then it's up to them what
do to about it.
Alternatively, if you want to do something about it, if you know who sent it you might want to have a quiet informal word to the effect that
'Look boss, this came in a letter to me, it's not mine, don't think this should have happened'. More formally raise a grievance or report it to
the RM DPO yourself, but IMHO it's not a 'serious' breach and if it was me I'd have more important things to be concerned about at the moment.
https://www.gov.uk/data-protection/make-a-complaint
be a bit more concerned.
What course of action to take? - It depends on if you want to drop someone in the mire - theoretically according to the .gov.uk website it's the person whose information
has been not kept secure who should make the complaint, if you know them you might want to let them know what has happened, then it's up to them what
do to about it.
Alternatively, if you want to do something about it, if you know who sent it you might want to have a quiet informal word to the effect that
'Look boss, this came in a letter to me, it's not mine, don't think this should have happened'. More formally raise a grievance or report it to
the RM DPO yourself, but IMHO it's not a 'serious' breach and if it was me I'd have more important things to be concerned about at the moment.
https://www.gov.uk/data-protection/make-a-complaint
Make a complaint
If you think your data has been misused or that the organisation holding it has not kept it secure, you should contact them and tell them.