AIBU to think writing confidential HR notes on a train is inappropriate?

Exactly

• do an online course (maybe on GDPR )
• read a journal or do some research
• review public policy documents or any other publicly available information (a thorough read of the ICO's website might be a good place to start )

Being overworked and underpaid is no excuse for doing confidential work in a public place.
I'm pretty sure if the person named on that document found out that a stranger had been able to read it he'd have a very, very good case for a(nother!) GDPR breach.

Agree. I often wonder why a lot of people get their laptops out on trains and do their “work” while commuting to work 🤔 Just wait until you get to the office to do it….or do light work that doesn’t involve having someone’s personal details on show.

But you shouldn't be working on anything that contains personal data or is confidential no matter how much you "have to".

Agree . If I work in a public place /train it will be on things that don't involve any personal or confidential information. So things like reading journal articles or reviewing publicly available information

People are incredibly naive I think.

Companies might ask too much, etc, but she was in a public place. There are nosy people around, and there are some who will have bad intentions, or at the least, will be prepared to make use of the information they see or hear. You do not know who the people around you are and whether they are good or bad. They knew this in WW2 and had posters up to warn people not to talk about things on trains and in public. And on a train, especially commuter trains, there's a higher chance of there being people who know you or the client or the business. Things like this should not be worked on in public, however pressed for time you are.

So then if you have had proper GDPR training you would know the op has absolutely no obligation to tap the HR woman on the shoulder and address this with her. I think what you have been told in your “training” is that a situation may arise in the work place where you witness a potential data / confidentiality breach. Let’s say one colleague saw another colleague potentially breaching GDPR and they had a word with that colleague who was breaching the GDPR. That’s fine to address it with that colleague. However, it is also the other colleague’s responsibility to report it to the necessary person.
You cannot apply the same logic about a member of the general public addressing the situation to the HR woman - the op was a member of the general public who happened to be on the same train journey. She is not a colleague of the HR woman and had no obligation to tap her on the shoulder address it with her.
Yes it would have been a good thing for the op to make the HR woman aware, but op has no obligation to do that whatsoever. So for you to keep putting the responsibility back on the op and saying she should have addressed it with the HR woman is just ridiculous. The op is not responsible for an employee of a company she does not work for.
The responsibility lies with the HR woman to keep the information private.

I'm honestly shocked by the amount of people who think this is ok and wonder if they'd be happy if the personal info was theirs or their family's? If you have to work in a public place, at least choose something to do that isn't so sensitive or with identifiable personal information.

I’d report! It won’t be just this one but probably every day

One of the reason people do it is because increasingly companies are asking too much of employees. People are working more than 8 hours each day, any moment they can grab they try to deal with some work related stuff. Three wrongs dont make a right: Wrong 1: Why is op snooping through seats and reading someone's writing. Inappropriate. Wrong 2: Person on train (least of my worrries in some respect. Wrong 3: Company not employing enough people or supporting them enough to do work in work hours only.
Now I know some here are lucky enough not to be overworked. They close laptop at work at 4 or 5 and never think of work again till next working day at the appropriate time in the office or at home in privacy. Many of us do not have this previlege. And before someone says quit or find a better job, its not always that easy.

Clearly she is unaware and needs a privacy screen for her laptop, but why are you looking and running to MN? Pretty sure every time I work on a train, it's because I have to not want to. She would probably much rather have the laptop in the bag and be staring out of the window listening to a podcast or music. Yet here you are inviting strangers to judge, and considering contacting her employer with such glee 🙄

go on report her
she should not be doing work like this in a public place

Theres nothing wrong with being nosey. Its the sister to perception and being observant.

Perceptive and observant people notice when something isnt quite right in a situation before others. If there was a terrorist on the train, I bet you'd be one of the first to spot the warning signs.

YANBU to think this is unprofessional. I quite agree and laugh at the irony of the complaint being about GDPR 😂

The people on here telling you to report her are complete Karen's who take complete joy in knowing they might get someone fired. No consideration for the fact this is a human being, who might have a handful of kids at home and be reliant on this job to keep her head above water. Its not a good economy - she could be out of work for months if she was sacked.

In some ways, I like the idea of writing a generic email to the company to put out a memorandum on being mindful on trains without names. It depends on how large the company is though- it may be just as outing to write this. Tbh i wouldn't be bothered with the hassle though.

Maybe she didn’t realise that there was a weird nosy parker behind her that would not only read what are clearly confidential documents but would go so far as to post it on a public forum to get other people’s opinions! Seriously, you need to be looking at your own behaviour, you are truly strange.

Yes its bad. I read notes about an interesting court case courtesy of a legal type doing the same next to me on a train. Poor judgement.

When my friend was an associate in a law firm many years ago, she was hauled in to explain herself after it was discovered that she had been overheard dictating notes after a meeting about some high net worth clients on the train. Moment of madness that she said her name at the end of the dictation, so it was easy to trace....

She's a partner now and probably the most vigilant when it comes to GDPR and confidentiality; lesson learned.

It doesn't matter if the OP is 'nosy', the woman shouldn't be doing confidential work in a public place with no privacy screen! Sounds like the employee in question has very legitimate complaint against this company regarding their data handling. And yes they've technically now breached his data again. I'd be very surprised if this doesn't go against their internal policies as well and it's ridiculous that someone working in HR doesn't know this. But then I'm frequently shocked at phone calls I hear people having on public transport.

Have also sat next to a man reading hard/printed CVs on the train. Totally inappropriate

I sat next to a client once on the train. She didn’t know me, we hadn’t met in person, but i obviously know her name and email address

i read her emails over her shoulder

You’re getting rather desperate now. And yes you did say that. You’re now backtracking because you know you’re in the wrong!

I heard a carer slagging off one of her clients to another carer over the phone.
We were both sitting on a bench.
The thing is the client was a terminally ill friend of mine. I didn't report it as I didn't know the care company and didn't want to make my friend's husband's life even more difficult, but I did tell her I could hear her and knew who she was talking about.
I was appalled and very upset.

All you thinking it's fine that strangers can read confidential information about someone on a train....what if it was your son or daughter? Would you feel the same then?
Someone else might have easily taken a photo and put in online. You don't carry out confidential matters in a public space.

Blimey, this is far more difficult to explain to some than it should be.

It's not about anyone "having strong feelings", being "mean" or any personal vendetta, it's about adhering to a piece of security legislation all people in a role that involves personal data must uphold by law.

Edited due to ludicrous autocorrection.

Proof that even with a long career one can still have more to learn

This is definitely a beach of GDPR and would be a breach of any sensible organisation's code of conduct too.