Gdpr breach at work?

It may not breach Gdpr but it also may be that hr data is stored in a place that can be accessed without appropriate controls.

I get hr data as part of my finance job (so the other 4 senior finance team who approve payroll can also see it saved dowb)

But it's used for that basis only.

So I would raise with hr. Either she found it via a system she shouldn't have access to. Or she accessed that system /asked someone else for data she doesn't need. maybe not all sackable offences but inappropriate really.

If in fact she googled and found out via asking op's external friends that is also inappropriate at work and needs a hr discussion on boundaries. It's slightly bullying to go off and find out something a person doesn't want to speak about (which is not work related) and tell them that you got that information anyway. It's definitely unprofessional.

@B1indEye "How does ones brother in law know the time of one's birth? I don't even know what time I was born, this thread is quite an eye opener"

He's married to my sister. She worked, back then, four days per week in the butcher-shop with him.

Is your birthdate and birth-time, your mass and length/height at birth not on your mother's hospital discharge card?

I have mine, my daughter's and my son's at my house. (I have photos of all seven of my grandchildren's). Now that I am in my eighth calendar decade on the planet, I am about to offer to let my daughter or daughter-in-law take them as I further downsize my house and space.

That manager sounds very creepy!

How does ones brother in law know the time on ones birthday? I don't even know what time I was born, this thread is quite an eye opener

But you're looking for information about her!!! Could be in the same boat!

Yes, it's really strange.

I was quite happy to give away my dob in my 20s

Once I hit my mid 40s and was working with people younger than me, not so keen!

Age discrimination is a thing, people treat you differently, generally unconsciously but they do.

I have a real birthday and one for websites where they ask for it - I knock about 15 years off on those 😉

I'm sure finding out peoples birthdays are quite easily accessible.

How?
If you want to reassure the OP it’s really easy and she is making g something out of nothing , you need to tell her how you can find that dirt of information easily.

I'm sure finding out peoples birthdays are quite easily accessible.
Op, I'm not going to lie, it's a bit odd that you want to hide your age AND your birthday, most people dont do both but guess you have legitimate reasons?
Anyways yes you can report her at the risk of jeopardizing your work relationship and making things awkward for yourself.
I guess if you are an introverted and private person,you wouldn't find this an issue anyway.
I mean IMO I would be flattered that someone is even interested in my birthday- it shows interest

It would be more likely she got it from social media than NHS data base. Have you checked your privacy settings? Do you have any mutual friends? Or does she know anyone in real life who could have told her. It's a weird fact to violate GDPR for, she could literally lose her job. And strange that she told you she knew it's like she was getting one over on you for not telling her.

You can find someone's DOB if they have any records with Companies House. To do that just involves a quick and legal Google search.

I highly doubt she's accessed the OP's NHS records. That's not easy to do, anyone who has to NHS databases has training that makes it very very clear you can only access records that you need to for work purposes, plus when you do try and look up someone you have "no relationship" with it prompts you and you have to say why you are trying to access it

I didn't say they rely on it. It is one of the pieces of information some sites ask for, as part of multi-factor ID. One of the sites is one of my banks! Only as part of the secure on-line sign in - on the app it is face/fingerprint. Which I have often thought sounds very secure, but I wonder how secure it would be if pushed. But maybe I have just seen too many of those films where the baddy gets in using a lifted fingerprint ....

sounds like she has snooped somewhere she shouldn’t but you also sound a bit odd OP

I don't need the extra waistline or bigger arse of constant birthday cakes and sugary laden slices and biscuits. My last job locations before retirement were on staffs of 38-55 people which means birthday events at work occur with amazing regularity.

When pressed for the date of my birthday, I say I don't give it and I choose to NOT celebrate it.

I take my own morning snack and lunch to work. I prefer to not have friends from my work.

In my last role before retirement, my line manager made it her business to discover my birthday ... so much so that I worked on past my 60th birthday for almost seven and a half weeks. She was "another one" of the four people who did not share her birthday at that workplace.

She telephoned me (out of the blue) about three months after retirement and said she knew my birthday. She revealed what she'd "discovered" and she was spot on ... she knew my birthday, the location of my birth and was within ten minutes of the time I was born.

She, moments later, revealed that she'd discovered the information by pestering her local suburban butcher, my brother-in-law.

She also revealed during the phone call that her own birthday was the same date ... [cue Twilight Zone theme] ... ACTUALLY the exact same day. Further her
birth-time was about 5-10 minutes after mine. We were pretty much identical ages.

She claimed she'd told no one else and said that my secret was safe. Her detective work was self-satisfying, it seems.

She'd really done nothing illegal but, all the same, I realised that in-depth privacy is a bit illusory. We usually have workmates and line-managers who just go along with us when we say we don't want to share "personal info".

Interesting. I don't think I have any online accounts which require my DOB as part of the security processes.

I had always been told that it was unwise to use such info, so tbh, I would have some concerns about any sites that relied on this info for security.

Have you read the thread? It’s already been explained by several posters.

I woudn't say you couldn't find me online but I think it would be difficult.

I wouldn't say it was weird for not wanting to disclose your birthday, but it is certainly unusual.

There's also nothing wrong with wanting to separate work and private lives, but some people seem a bit militant about that. I keep my work and private life relatively separate, but I've been where I work for a very long time so my work colleagues who have also worked there for a long time will have an idea of my general age and relationship status given I went off on maternity leave etc.

OPs colleague has clearly crossed a boundary by going out of her way to get information OP didn't want her to know. Whether this is worth bothering with depends on how the colleague has got this information.

I'm "weird" about my birthday because it happens to be the anniversary of my sister's death. I don't share the date with colleagues because I don't want some forced office jollification. I prefer to deal with the day in my own way and I don't see why I should have to explain any of this to all and sundry. If that makes me weird, so be it.

How??

I mean that was the OP question right? She wondered how that colleague got those details (I’d also want to know why in earth she thinks it’s ok to push to want to offer a card etc…to someone who does p her best to NOT be involved in that sort of things) .

So if you think it’s that easy to get the info, it would be a great idea to explain how. Knowing her team doesn’t know btw….

I agree with the posters who think it’s all the cloak-and-dagger stuff about OP not revealing her birthday is a bit high octane drama. The fact she refers to an adult colleague as a “young girl” makes me think OP is sensitive about her age.

But there are ways to find out a person’s DoB without breaching GDPR - though why anyone would want to go all that faff is beyond me.

But the date and year is what the colleague asked for.

Not if it's one of several gateways. Several sites I use also ask for it.

Aren't people generally advised against using DOB as part of any security info?

my birthdate is part of security information on many of the websites I use.