AIBU to think writing confidential HR notes on a train is inappropriate?

This is specifically prohibited where I work. It's not just nosy members of the public we have to be concerned about, but people who will go to the press, share information online or use anything they see to cause harm/distress. If they can see it, they can take a photograph of it.

OP if you don't want to identify the woman to her company, you could just send them a vague 'I saw one of your employees working on a train and could read confidential information recently' email, so hopefully they'll all get a reminder. Hopefully she isn't the only person who works for them to have used a train this week.

This. She may be tired and not thinking.

Did that make sense in your head?

@Flyingintotheunknown I think I would also be creeped out if some random person contacted me via linked and informed me they had seen a load of confidential information about me

That's just you. I would be thankful for someone providing me with information that I can use to nail my enemies.

The thing about handling confidential information is that you have to make sure that nobody else is given the opportunity to view it. The onus is on the HR person not the op. Yes it was nosey of the op but the fault lies with the HR person.

Not good practice no. But fairly sad that you’ve been snooping and want to go report them. Why bother? Says more about you than them.

The onlooker is not at fault as they should not be able to see anything. A reported breech is never going to result in the person reporting being penalised.

A snitch? Are you 12? People have lost all idea of privacy in public as the trend for loud phone calls on trains demonstrates. There could be bad actor looking between the seats who could do some serious damage rather than the OP who is basically posting a public warning. And yes - it’s not a breach of anything really personal but that’s just luck isn’t it? HR woman clearly wasn’t thinking about it.

I think searching up the man on LinkedIn is going a step too far as it’s not guaranteed to be the same person and would depend entirely on if they updated their LinkedIn account. I think I would also be creeped out if some random person contacted me via linked and informed me they had seen a load of confidential information about me

I imagine if the op’s reports this incident to the company then they will make the man in question aware anyway. I’m sure victims of a GDPR breach are supposed to be made aware of the breach.

What has the fact that you need glasses to see things close to you got to do with anything? Being "long sighted" doesn't mean you have superpower vision!

Tell us you don't understand GDPR without saying "I don't know about GDPR" 🙄

I can't agree with you. It is not up to Op to ensure confidentiality and to take a professional approach, it's the duty of the HR employee. Op hasn't breached anything, that's on the employee.

Thing is you can’t help seeing things if they are in front of you, it’s like listening in to a conversation when it’s taking place a few feet away from you. The responsibility lies with the person talking, or typing to ensure that they can’t be heard or seen.

I would contact the company OP

The fact that the employee concerned is complaining about a GDPR breach and the HR person dealing with it has all their identifiable information on a screen in a public area is just 😬

@Elphabababa

I hate HR.

OP, please please write to this company with full details regarding the name of the person and the nature of this man's complaint, so they take action against this HR person.

You could even take it a step further and search for the man on Linkedin, and let him know directly.

You could have tapped her on the shoulder and discretely tell her “I think you need to get a privacy screen”. And get on with your life.

The irony!

Both of you at fault. OP for looking and person in the seat in front not working inside the company firewall. But that's what happens nowadays, similar situation to working from home.

I would definitely send an email to him just to stir the pot. It isn’t difficult to find someone these days if you look.

I can beat you though, many years ago I had a good old listen to barristers preparing their case - which was on tv the next day. Although that was in 1st. 😂

I'd read over her shoulder because I am nosey.

A company putting someone's details out publicly for anyone to read is worse than a random member of the public being nosey.

how do you quantify significant, out of interest?

This is a significant breach under GDPR Article 32:

Data Breach: Unauthorised third-party viewing constitutes a confidentiality breach (Article 32). If the data is highly sensitive, it may require reporting to the Information Commissioner's Office (ICO).

Under ISO 27000 for information security management systems, which is the international standard, leaving screens visible in public areas violates Annex A 7.7 (Clear Desk and Clear Screen), which dictates that information processing facilities must be secured to prevent unauthorised access.

I would report her to the company and advise them it may be reportable to the ICO.

Go to the head of the company and tell them what you have read. It will support the guys case. See if you can’t find him on linked in and tell him.