Gdpr breach at work?

She does sound odd. What's her role in the NHS? I will say that not everyone who works for the NHS has readily available access to patient records, databases or log ins find that kind of information. Most have limited, if any, access to where's this kind of information is stored. Everything is logged and it would be quite unusual for someone willing to risk their entire career to find out a colleagues birthday. I imaging she's probably done a bit of googling or asking the right people.

Have you ever been listed on Companies House eg as a director/ company secretary for example, as that can have info such as month and year of birth and is publicly available.

Not excusing her as I find her behaviour weird, but maybe she's looked it up elsewhere?

I agree with you on the not sharing birthday with colleagues etc. I find it a bit cringey when colleagues make a big deal about birthdays.

Very very few office based NHS staff have ( limited) access to the spine, and only if absolutely a requirement to do their job. We have a couple of nominated people across our organisation who we can ask for specific info ie which GP practice a patient is registered with, DoB, check NHS numbers - as part of our job, but not medical records.

I'd contact the IG person with this issue. your colleague might have asked someone else to look it up for her.

I agree. I have a team and pur hr system does not have their date of births or home addresses.

Don't report her, don't contact HR, don't tell her. As others have said, ask for an audit of who has accessed your records and whether this person is on it.

Then you will know.

Amazed at the people banging on about it being weird not to tell people your birthday. OP clearly mentioned that to explain that the woman wouldn't have found out from other colleagues.

Yes she’s probably had a nose somewhere she shouldn’t.

Is it worth her losing her job for? It’s your DOB, not like another post I saw where she found poster was pregnant and told everyone.

Like a precious poster said, you could have just said your birthday is July etc. It’s not like you’re sharing details about your family set up or your children etc.

I would try and forget it and if she mentions it up say what was suggested before about she clearly got it from somewhere she shouldn’t and walk away and let her stew.

its a glorious day (where I am anyway) don’t waste any more time on this!

No HR system should allow line managers access to personal information such as birthdays or even home addresses, it's not "need to know" information and comes under GDPR. (ie HR should not be sharing it for anything other than the purpose it was collected).

OP, looking at your many previous posts about this place I would really suggest you find another place to work.
It sounds like a nightmare place to work and you clearly don't fit in there. It has been months and months of issues. It's just not worth it.

How does that stop people accessing your health records?
It's not weird to not want to give your DOB to a colleague.

What vague links do you mean? The NHS is a business as a whole, but made up of separate companies, so I’ve go surgery can’t access another’s surgery patients notes, or hospital notes etc, so unless was you’ve had dealings with that NHS department, it’s unlikely they’ll have your records on file.

Has she asked hr?

The simplest solution is to not be so weird about your birthday.

Agree with PPs - the whole situation is batshit!

Just request an audit of who has accessed your records, having the d.o.b plus alluding to a recent medical issue makes it sound like she has. You don't need to name her because if she has accessed her name will flag itself up.

This sounds like a situation for people who enjoy a bit of drama. Absolute nonsense.

If she has accessed your records without reasoning then that right there is breach of confidential data.

In my line of work, anything we access on the system can be seen behind the scenes. If someone accessed a friend's details on the system and that friend got wind of it, the company would be able to check and the employee would be rightfully disciplined and likely sent on their way with their P45.

I would hope the NHS has something like this in place, especially given the sensitive nature of the records they hold.

Aye, but there is absolutely nothing to suggest that she has, unless as a counsellor she has the highest level of access to the NHS data systems....which I doubt. She more likely has a common acquaintance with the OP and had the OP just asked, she would also know by now. It's all just very overly dramatic...and I'm a DPO!

They more than likely wouldn't, but if this person has used any company resource to dig for the information, that should be taken further.

This is so bizzare.

Surely, the most simple resolution is just to ask her. I doubt the ICO would opening a complaint.

Posters saying to report the issue - FFS why put someone’s career on the line if it resulted in a potential data breech. From the sound of it there was no malicious intent and she was probably just being friendly.

There was a (over a somewhat trivial issue) potential disciplinary issue where I work recently and my colleague took their own life.

I would be very cautious about reporting issues to management level to escalate when the issues can be resolved before it reaches that level.

Do you have HR at work? I'd mention it to them, that you are uncomfortable with a colleague going out of their way to find personal information about you, especially when you clearly stated your boundary. That in itself is inappropriate.

They should ask her how she found out too.

Your year of birth is Public Record, so you can find this out on Ancestry, also tells you which part of the year you were born in (in monthly quarters).
Once you have that, you can do other searches, on Ancestry that can find you if you appear in any family trees (or other places) that may well have your D.O.B on.
It’s not an overly-difficult thing to find out, once you have someone’s name.
…. and just because you think you have a low online profile, don’t presume there is nothing.

OP's own attitude to her age is also a bit silly though.

Ha ha. My work sent around a list with everyone's DOBs on.
Not a huge deal as we often need each other's DOBs to arrange access to things anyway.