AIBU to think writing confidential HR notes on a train is inappropriate?

I haven’t read all the comments but as someone who had a fairly long career in HR, it isn’t breaking any law, and honestly that person was probably just trying - like a lot of people in the corporate world - to use an opportunity where there’s a bit of dead time and they’re not being interrupted to get on top of their work. HR people do work on trains as well as other people do. Just because it’s HR and we deal with work confidential to the company, doesn’t mean just because someone’s taking a peek at that work that we’ve breached any type of ethics. And people saying “Ring the company!” are the same type of people who comment on threads about not being able to put offers in on houses that are already sold by offering the solution of “Just knock on the door and demand a viewing.”

Report or say something, if you can be bothered. So many MNers minimise and condone unprofessional behaviour. Raise your standards. At my firm this would be a disciplinary.

Imagine if HR woman was reading this thread. She would be having a worrying evening.

I think the suggestion of reporting it in a generic way is the way to go. To tell the company that their employees need a reminder of the importance of protecting data. Give non identifiable details but impress upon them it was a data breach plus could cause major embarrassment to the company if you were minded to take it further than à general warning.

Not the case in this train situation but it can be highly criminal to disclose market sensitive insider information to those not entitled to know it. Either with loose tongues in public places or having someone see a computer screen.

It can mean those outside are able to manipulate markets and share prices by trading on the inside information and severely influence prices. If OP had instead seen something like a merger being discussed and then traded shares using this info the little train typist could have ended up in prison!

Sorry she certainly was not entitled to assume nobody would peer through a train seat.

when you are responsible for someone’s data that doesn’t mean you get a pass for assuming that the general public are to take responsibility for averting their eyes

we live in a world where criminals are trying to harvest data all the time. The responsibility lies firmly with the data controller to protect it from everyone.

If she needed to work on the train she should have used a privacy screen or typed her notes up on a word document anonymising the personal data until she could transfer it to the file in a private place

no excuse and she deserves to be reported

This. Someone who's had HR training and still thinks it's ok to do this isn't going to see the light because of anything some random says on a train. They'll just dismiss her as a busybody (ironically, like many posts on here)and carry on. Which is why you should report this to the company with as much detail as you can, as it's the only way to stop this stupid and unprofessional behaviour.

Twenty years ago, I worked at KPMG, Colin Sharman was the managing partner... he would go ballistic with anyone discussing client business in the lift because you did not know who else was in the lift with you. This is the reason, also, back then if you were working on client business, you travelled first class with a privacy screen. It's basic commonsense, so yes, report it.

'Not to gossip' and 'descretion' is minimising what a data breach is. These are the norms in any organisation with any data, but you said it was specific data you shouldn't be privy to. That's a systems failure and needs to be reported and addressed. If you manager is doing that then fine, but it's not what you said.

Yeah it’s easy to see with the layout of the seating on trains. Makes me paranoid lol

Haha sounds about right. Anyone who has had rigorous GDPR training and how to deal with confidential documents know that the responsibility is on them to keep that information out of the public eye. But according to her “training” it’s the passengers on the train who have the responsibility of addressing it lol

Without even trying - because I'm not weird - I recently found that I could very easily see the argument a girl sitting in front of me was having over text with her boyfriend.

She knows best apparently cos Beryl did her training in a nice chat, rather than the recorded training modules with tests to validate understanding conducted annually like every organisation in the UK 🙄

Rarely have I read so much self-righteous crap!

There's no point intervening in the actions of people who are fundamentally stupid, careless, and selfish. It's a waste of time. Someone thick enough to be waving confidential info around on the train isn't going to have a data protection revelation from a stranger tapping them on the shoulder.

Even working in events - so not especially sensitive personal data, just names and email addresses - I was SO careful if I was working on the train. This is ridiculous

Wow your arrogance knows no bounds.

Anyone who undertook and actually understood the training knows I'm correct. You're making yourself look ever so silly now

It is NOT the op’s responsibility as a member of public riding on a train to tap her on the shoulder and tell her they could see the information, anymore than it would be the responsibility of an elderly couple on the train off on a day out or a child passenger! Don’t be so ridiculous!

My manager was aware of this and trusted me not to gossip. I was in a role where discretion was expected.

This is beyond parody - what a shit company. I would report them to their ombudsman or similar (depending on the sector)

I didn't say it was the OP's responsibility. I was pointing out the fact that if she had just tapped her on the shoulder and said that information could be seen, then that would help negate the potential for it to be seen by others and/or misused. There is no child in this, you're just being silly now. Report after the event if you wish. But why is it so hard for you to understand that a heads up to someone would be better than just sitting there and doing nothing until after?

I know full well how serious data breaches are - I had to deal with a hospital data issue where the trust was fined to the tune of £250,000. All I have said is to address it at the time if you're someone who is remotely sensible. How can you argue with that logic? Then any legal fallout follows. Report after if you need to. But to just sit there and spy on someone and only post on here, rather than let the woman know at the time is honestly ridiculous. I'm not arguing against responsibilities, but you are rather proving that common sense isn't all that common.

A GDPR breach is a GDPR breach. It is not the op’s or any other member of the public riding on that train to have training on GDPR and how to address it just in case someone happens to have confidential information on full view. Are you seriously telling me that the op, along with other members of the public on that train should have the responsibility of addressing the issue with the person who is breaching the data? Seriously? What if it happened to be a child passenger who saw it instead of the op? Would the onus be then on the child to address this with HR woman? I think not!

I was on a train recently and a teacher was doing a virtual staff meeting discussing strategies for pupils. With camera off, but we could all hear her side of the conversation. She was really loud and it was all about really personal specific pupil problems.

If she has confidential information she is not entitled to assume nobody would look if she access it in public.

You're so wrong it's not worth trying reason with you, but I hope for your organisations sake you aren't able to access data out of a secure environment. Data breaches are a huge issue taken extremely seriously as they can lead to enormous fines.

But keep arguing against many repeating the actual responsibilities under the legislation.