Manager sharing isolating/Covid status with full team... GDPR?

[ByeDon]

In our daily Zoom team meeting, the head honcho goes through a list of who’s WFH, who’s WFH but isolating due to having a test, who’s WFH but isolating due to track and trace, and who’s not working because they have Covid.

It occurred to me that this might be a breach of GDPR. Is it?

I don’t think so, isnt it so people in the team know who’s available on any given day for practical work related reasons, I imagine a lot of places are doing this right now, what harm do you think can come from it?

I don't see why people would need to know the details. Why can't he/she just say 'XYZ are available for whatever'. Some people may be off work for any number of reasons, you don't need to say why, and if you are all working from home why go in to more detail?

In school we are having to be really careful not to reveal the identities of anyone who has tested positive. (Obviously they all know, but we have to respect confidentiality.) I would expect to be told about colleagues though.

Our HT only tells us the names of staff or pupils who have tested positive or who are SI if that person has told them they can. Otherwise it's just that class x bubble has closed due to a positive case.

No we do this just so we all know where we are up to.

This is a problem I have with all of this. It seems that Covid doesn’t seem to be covered by the need to keep medical problems private.

I’m an admin of a school parents group. When a child got Covid. The school told anyone who needed to know. But they told the name of the child and the adults on the group where demanding to know who it was and what siblings they had.
It’s like medical information is not covered by privacy anymore.

Before anyone says I understand the need to keep people informed so I don’t have the answer. But my medical status is private and I would be livid if it was just told to everyone

@Paranoidmarvin

This is a problem I have with all of this. It seems that Covid doesn’t seem to be covered by the need to keep medical problems private.

I’m an admin of a school parents group. When a child got Covid. The school told anyone who needed to know. But they told the name of the child and the adults on the group where demanding to know who it was and what siblings they had.
It’s like medical information is not covered by privacy anymore.

Before anyone says I understand the need to keep people informed so I don’t have the answer. But my medical status is private and I would be livid if it was just told to everyone

This is exactly what I mean.

It is confidential medical information that does not need to be shared with colleagues.

It’s not just a medical status, though. It’s an infectious disease that affects other people. In the case of work it’s about who is actually unwell or “just” isolating and can be contacted.

I have had this but with existing conditions that means I am working from home. A new manager wanted to know the ins and outs of everything, even though I had disclosed them all when starting work at the company. Manager then asked to share them with whoever asked so they have a paper trail. I refused permission for them to be shared, new manager now thinks I am a pain in the arse and awkward but backed down when I stated very clearly they were disclosed on my health forms when I was offered the job, they have been on record for that amount of time and if people desperately want to know they can ask the person who holds the records to disclose them (knowing full well that person will tell them to bugger off unless it was for a very very good reason and she would want my consent first).

The manager also asked for my diagnosis letter and any other further evidence to be scanned in and kept in her emails. I refused this as well, as I showed proof when I started working.

Since Covid it seems nothing is private.

It absolutely is a breach. That’s medical information which is categorised as highly sensitive and should not be shared in this way.

Hi OP,

It's probably not quite a GDPR breach but it's poor data protection practice, especially if it's making you feel uncomfortable.

Your employer should be doing what they need to get the work done, but in the least intrusive way possible. So if they can say person A is in the office; person B is work from home; person C is unwell without giving the reason then that would be better. I am data protection officer at my work and that's what I've advised we all do.

Covid or not, your medical information is classified as "special category" under GDPR and should only be shared if absolutely necessary. Covid is a little complicated in GDPR terms because it can also be your children's medical data (eg isolating because DC has symptoms) that's being widely shared which obviously isn't ideal. There are also some work instances where it would be reasonable to share Covid data, like if you work in a care home, but that doesn't sound like the case here.

It doesn't sound like this is being done maliciously so perhaps mention it to your manager informally next time you're chatting?

Hope that helps!

I think it's notification isn't it, I mean everyone should know really.
What if one child played with another but usually never together on the way out of school?

@NullcovoidNovember

I think it's notification isn't it, I mean everyone should know really. What if one child played with another but usually never together on the way out of school?

Absolutely not.

I had a positive covid test and informed my manager last week. He then sent out an email to all staff in my team to inform them I had covid and what my symptoms were. I have been wfh since March so no other staff at risk. I have reported it and await a response from higher management. Is this GDPR breach and or gross misconduct?

I absolutely agree GDPR has been forgotten - there was trouble with the app abs track and trace because privacy impacts weren’t assessed. In a case like @Herewegoagain152 there’s zero justification - all the team need to know is that you’re off (I doubt it would be gross misconduct though). Whereas if you’re in a workplace it becomes more complicated - to an extent you may be able to justify giving out a name if someone has tested positive so that people can self identify as contacts (but having said that, my workplace wouldn’t give names out). But OP it does sound like they’re going in to far more detail than is necessary. Whatever the legislation, data should be handled on a ‘need to know’ basis.

Do you not speak to your colleagues and bring up this information in general conversation anyway?

The person with Covid is never named in our workplace. We are just told that someone is positive if necessary but no names whatsoever.

My work must be weird. When a lot of us got it in May, we formed a whatsapp group and everyone posted their status and symptoms as we were all isolated at home. We chatted on an off for a couple of weeks, helped each other through things. It got busy on there again last week when others tested positive. We are all Nurses though, and no medical topic seems to be off limits when we talk.

GDPR and regulations aside different workplaces have different cultures, in small team/business it would be normal for the other team members to know if someone was isolating, had covid was waiting for results etc ime simply because as well as being employees they are friends and know each others home lives.

I notice on here though that most posters seem to work in massive organisations where there is a rule on everything and everyone sticks to them and heaven forbid that anyone would actually like their workmates or have any kind of contact outside work.

My real life experience has been the opposite, even if there was no official announcement of a covid status everyome would know