Gdpr breach at work?

If you were born before 1995 and have a relatively unusual name it would be easy to work out using the Free Bmd website.

I don't know where she works in your business but you'd be surprised how many people outside of HR probably do see your DOB in the course of their day to day role. IT in their course of system set up, administrators who book travel. For my Co Sec role I have all the senior managers and directors personal info because we have to be able to supply this to our regulators. The weirder thing is that she is telling you like this.

So many people having no regard or respect for the law regarding personal data. Just because you wouldn't have a problem sharing certain information doesn't mean that the OP shouldn't have a problem with it either. Seems like this colleague is of the same mind - that she has a right to know someone else's data and has therefore helped herself to it. There's a reason why it's against the law and it isn't for random strangers, or colleagues, to decide it doesn't apply to them. It doesn't sound as though OP is that close to her colleagues anyway - not all jobs require everyone to sit in the office and have plenty of chat time.

This may be a minor example but the principle is very clearly defined. She hasn't just found out the date; by the sound of it she's looked at other things which are very much none of her business. "Oh don't tell anyone, she could be sacked" - er, good? She can go get a job somewhere that doesn't give her the opportunity to poke into other people's business. Or join MI5 and do it for a living.

I'd make a discreet enquiry with the employer's data protection officer. No fuss unless and until it turns out she has been poking where she didn't have a right to. Then the DPO should take it further as it is their role to do. Nobody other than Ms Nosey should ever need to know OP was even involved.

It's not unusual. The other woman is really out of order.

I think you need a quiet word with someone about this. This person isn't professional.

Many application forms ask for the date of birth and in the main form, not the accompanying diversity forms so managers would see them if they are sifting the forms and some people have them on their CV too. (Even if they don't, you can often work it out from the CV).

Oh I'd have to ask her again!

"It's been playing on my mind as to how you found out my DOB, so I thought i'd give you a chance to explain before I contact HR, or submit an audit request of my NHS data"...

The goadiness of "oh I have my ways!" would irritate me as much as the snooping. Possibly even more

I totally agree. What you shared is up to you. You've done nothing wrong. It's your colleague who's at fault. I'd ask her how she got that information and then decide what course of action to take. I wouldn't shy away from making a complaint.

For those people saying you should have shared your age/birthday, that's madness. People have all sorts of reasons for not wanting to share this information. I'm someone who doesn't share this. For me, it's linked to the pain of infertility. I have no children and am getting older. I don't want questions/comments about my age and whether I'm planning to have children or not. I find that too painful, so prefer to avoid discussing birthdays and age.

@Ereerenownow I think you need to tread carefully. Having read your other posts regarding issues at work, I can sort of understand your wish for privacy. People should respect that. However, without some sort of hard evidence, you are on a bit of a sticky wicket to make such a serious allegation of your colleague accessing your personal records. Without evidence it's just a wild accusation.

Sadly, the world is made up of some folk who would find your wish to personal privacy as some sort of challenge. Others will encourage that, just because, and especially if you are not that popular or part of the 'in crowd'. It's just how some people are. It's a reflection upon them, not you. Please don't make any formal complaint without proof that GDPR has been breached.

Even if you personally don't have much of a presence on social media, it's amazing how much can be found out from, colleagues, former colleagues, friends and friends of friends, if somebody has found it a sleuthing-challenge to do so. I don't understand why anyone would want to, but there's nowt so funny as folk.

@NewJobNewMeNewLife You're not weird and nor is OP. I've never volunteered my birthday at work either. If someone ever asked me I'd probably tell them, but that's my choice, just as it's your's, OP's and a few other PPs who've stated they choose not to. I find it weird that some people would be so disrespectful of other people's preference for privacy.

I choose not to share my birthday. I had a difficult time growing up and I have a difficult relationship now with my family. My birthday brings up difficult feelings for me so much so that I choose not to talk about it. If you tell someone your birthday, then some people at my work would choose to make a fuss- a cake, a card, a small present- but I don’t want any of that as I want to forget it’s my birthday.
It’s nothing about being upset about my age or anything.
Other people with different religious beliefs (I think maybe Jehovahs witnesses or Plymouth brethren) also might not choose to share their birthday
I tend to reply with, oh I don’t celebrate my birthday so I prefer for people to not know when it is.
I am now thinking that people at work might think I’m a complete weirdo.

How could she find out OP's DoB from Ancestry.com?

reiterate to her that you don’t want this shared at work, no card and ask her how she found out

and you are not weird. I don’t share anything personal at work either.

She could have just got that info on Ancestry.com. No need to assume gdpr has been broken.

Don’t worry @Ereerenownow
i don’t think I’ve ever given my date of birth to anyone in my office.
Why would I?

I agree.
Unless you've used her service/ speciality, it's unlikely she could find out that way.
Bet she's asks someone and doesn't want to drop them in it.

OP isn't "looking for trouble" - she even wrote "I admit given recent events at work, I'm slightly sensitive so I don't want to cause any problems if none exist." However, she also wrote: "She also very vaguely alluded to a recent health issue I've had but didn't tell anyone about."
It's absolutely outrageous that someone should be trying to find out a colleague's private information. It's highly likely that OP isn't the only person this woman is invading the privacy of, and given that OP describes her as "gossipy", I wouldn't be thrilled about her behaviour either as I value my privacy (so few people seem to these days). Would you really be happy with someone finding out personal information about you, regardless of how she did so, which you expected to remain private?

Lots of people have ways and means of finding things out about others but would not even think of abusing it. She was out of order. Privacy should be respected.

Yes it is strange, you are spending significant parts of your life with these people so whilst I get not sharing details of medical info, relationships, or personal info even year of birth, the day your birthday falls on is hardly sensitive deeply ffs and people just might want to say happy birthday. Seriously weird.

That said, now it’s got 5is far I would however want to know how she got this info. My guess is HR

You both pretty weird 😂

I would contact the Inflammation Governance department of your local NHS organisation to check if they have accessed your notes. Plus your GP practice. I would also raise a concern with your manager and HR.

Why are you looking for trouble?

But OP wrote in her opening post: "One time she asked my age and birthday and I very politely said that I don't discuss those things at work" so how could any of OP's other colleagues know her DoB?

It’s not weird. It’s your data and in an information age where DOBs and family member names etc are lifted from Facebook pictures and used to clone people’s identities you are absolutely within your rights not to share personal data with people you don’t wish to. I have no idea why posters here are criticising this.

I’d absolutely go to HR and express concern as to how she has accessed that information and leave it to them to investigate whether it’s a data breach or whether she has a mutual acquaintance. Even if it’s the latter, she is out of order from an HR perspective.

Something tells me there will be a big revelation in the story before this thread fills up. Just in time for part 2 to continue the saga.

@Ereerenownow
Please can you request an audit of who has accessed your NHS data. It is a huge breach of GDPR if she is accessing this information without good reason. If she has done it to you, then she may well be doing it to other people. This is taken very seriously and is a sackable offense. And rightly so.