AIBU to think writing confidential HR notes on a train is inappropriate?

On the fence re. this, but I was on a train, going home from work, where someone was doing something similar but on a phone, so impossible to ignore. She even mentioned the name of the person. I didn't know the person but it was inappropriate to have what effectively was a dismissal conversation in front of strangers. So as I left the train, I commented to the individual that I knew who she was talking about and she should have carried out the call in an appropriate location. I hoped my comment worried her and perhaps would influence her actions in the future! Trains are not mobile offices!

Not once have I said it's fine for the person to be doing this on a train, have I? No, not once. But if you have done proper GDPR training then rather than post online and ask others about it, you would address the person directly to halt the potentiality for information to be seen by people who shouldn't see it. You would do it on a hospital ward, you would do it in a bank. Halt it at at the source. Up to you if you want to report it afterwards, but the obvious thing to do, if you are trained, is to make the person aware. That's GDPR 101.

Well you shouldn't. You should at least let those that have made you privy to the information know.

You’ll be surprised how many people peer over seats/ look through gaps on the train. I once caught someone sat behind me Ona train trying to read a WhatsApp conversation I was having with my bf

I’d definitely contact him. I sometimes work on the train and don’t have a privacy screen and make bloody sure no one’s contact details are visible. Ironically apart from my own as I need to type my email to log in!

And people look ALL THE TIME. Sometimes the formatting makes mine look more juicy than it is and I can practically hear the creaking of eyes from the bloke next to me and who knows maybe behind too. A train isn’t a private place!

If she works in HR on GDPR cases, then she shouldn’t need to be reminded of what confidential means.
In my book, I’d see that as (gross?) incompetence.

I often, in the course of my work, inadvertently came across private information that I should not be party to. I kept my mouth shut, and minded my own business

It’s kind of worse when it’s work related stuff. Op this person may be over worked rushing to get home to kids or caring for an elderly parent. I’m sure they ‘d rather sit there with a coffee and read a book or something. Either gently tell them you can see it or stop looking.

Same as the commuter train from Limerick or Cork to Dublin that gets in at 10am . You get off in Hueston and there's like 20 people you know professionally at the barrier going to meetings in Dublin. If one had been sitting behind you whilst you had confidential information open on your lap top it would soon be common knowledge.

Alright… let’s put it this way. If a random member of Joe Public phoned a company and asked sensitive questions about one of their employees and a member of staff just gave Joe Public the information they were asking for over the phone then who would be at fault? The nosey member of the public or the member of staff for giving out that information?

People are being so glib on here, what if it were your HR meeting notes being typed up in public? it’s a massive breach. Anyone with anyone else’s data is duty bound to protect it. Names were used and can identify the person. HR is all about confidentiality. If this woman has not had data training it’s the company at fault. The minimum is a privacy screen if she has to work in public. Report.

spell edit

Not quite relevant to GDPR but nosey Parker’s, DD when studying became aware of a bloke who would look over her shoulder at the station every morning at whatever she was reading. Getting quite fed up with it, as she was studying for a medical qualification, she located a photo of a severely diseased male penis! His reaction the next day resulted in him never standing near her again!

And I concur with the other posters who advised it should have been raised at the time. No she shouldn’t have been doing it but also was entitled to assume nobody would peer through the seats and read her screen. We always used to put a warning page in confidential papers regarding awareness of reading them in public.

Of course it's shifting responsibility.

I once saw a Teams meeting in a Hotel lobby discussing security at a building they owned in the town, with their head office. There were two on the lobby side so they had the computer on a table at a good volume whilst they had the discussion. People get completely disconnected from their surroundings.

I have done the training and thankfully a normal person delivered it to me and who made clear that if you are concerned you can talk to the person directly first. Which is much more effective in terms of protecting data than letting a whole train journey go by first. If you care about GDPR you tell the person at the time. It's not shifting responsibility, it's dealing with the situation in the moment. Like an adult.

Honestly, I think you're nosy parker and a trouble maker. You shouldn't be straining to look at someone's work documents. Why would you do such a thing? And then try and get someone in trouble for it? God, that's just awful..

Agree with this. When I was working in the NHS it was my responsibility to make sure patients didn’t see other patient’s information.
This involved keeping patient documents and records somewhere where they couldn’t be seen. Turning over documents so that they couldn’t be read if we did have to keep them near the desk. If a patient was to see any information then it would have been our fault rather than the person being nosey getting the blame. The onus is on the staff to protect sensitive information, not the members of the public.

Ouch. We don’t even have uncovered windows at my work as it’s part of the standard so people can’t glance in and see anything

If you'd really done the training you'd know it's the responsibility of the data user to ensure it's handled correctly and not shared with any unauthorised person.

Nosy people aren't an issue if that's adhered to and a pretty shitty way of shifting responsibility.

I saw someone editing Eastenders storylines on the train yesterday. I was happily reading over her shoulder but the person next to me moved and I had to budge along - gutted!

In the GDPR training we have at my employer, and one part of it is about when you are in a public place.

Say something OP, please.

Well you don’t know them. Honestly what is the big deal? What would you do with the information? This mania over “privacy” is bamboozling!

We all used to have our name, address and phone number in a book delivered free to everyone’s home (except X directory). It would not bother me in the slightest if we still had this.

I was kept entertained on a recent bus journey, by Mary telling John, on a call, why Linda wasn’t going on the conference in London. It all started with Linda’s thyroid & escalated to her myriad issues with the toxic team…

On the face of what you said you saw, that doesn't sound too significant. Or was there a bit missing from what you saw?`

ETA - sorry this seemed a bit abrupt - what I meant was, was there other personal data breached other than in the OP?

That’s a very weird response to me pointing out the obvious, which is dealing with it at the time. Nothing was shared, someone was nosey, how do you not understand that? Who was saying anything about optional or niceness? You just came up with that nonsense to support someone who was peering between seats rather than acting like an adult who is seriously concerned about GDPR.

Talk to the person at the time. It’s not that hard. That’s why what my training told me. You deal with the issue in the instance it happens. You don’t moan about it online afterwards. You know you can be complicit in the breach of confidentiality if you know about it and do nothing don’t you? Guess your training wasn’t as comprehensive as mine…