To put a formal complaint in against colleagues?

[pizzakat]

While on the sick ( GP note signed off with anxiety & depression to allow me time to get reacquainted with Sertraline) some of my colleagues took it upon themselves to look through emails in our office PC outbox to have a look at my sick note.

They also made multiple phone calls to me which were ignored on the day I initially left work, despite having told them I wouldn’t be back and that I had a GP appoiment, as well as following procedure with my manager, who was aware when I would be back and adjusted working patterns to reflect that.

I feel like my privacy has been massively invaded, and now all members of staff know why I’ve been off, does my employer not have a responsibility to treat my medical documents as sensitive information?

Right now i’m finding it hard to tell if i’m overreacting due to my MH, in my shoes would you raise a formal complaint or let it go?

Damn right I would raise a formal complaint. This is a breach of your data protection rights, especially with medical information being classed as sensitive or special category data.

I would complain about them looking at the sick note. Only the manager needed to see that. I don't know if calls were an issue as if the other thing hadn't happened you probably would have paid no attention to that.
I hope you are feeling a bit better.

I am no expert but this sort of thing may be covered by the Information Commissioner. Where I work we have a strict information governance policy, and every member of staff is required to complete an online test each year. As far as sickness information goes, this is strictly on a need to know basis, perhaps the manager and an admin person who does HR. All fit notes etc are saved in a secure folder which a very limited number of people have access to.

You are definitely not overreacting.

If they have accessed confidential documents just because they are being nosy then I would put in a complaint. This is appalling behaviour. How has your manager let this happen - they have broken data protection. What have your colleagues said to you? So sorry this has happened

Multiple colleagues shouldn't be given access by your organisation to a mailbox containing sensitive data; given that they were, as individuals, they shouldn't have looked through this without a legitimate business need. Sounds like multiple data protection breaches by both the organisation and the individuals involved; and also a breach of what would be considered reasonable in HR terms for the management of an absence. You have numerous grounds to complain.

Oh gosh. How do you know all this op? The information absolutely should be confidential. We're they snooping somewhere they shouldn't have been to see it or has it been left in a way that's too easy for them to access?

Who told you what they had done , that person is very important as a witness.

Yes it should be confidential information and you should complain. Multiple phone calls to your home to me verges on harassment as well.

I raised a complaint about similar reasons. The only people who should have known should have been management. I went in one day and everyone knew. It was horrible and was a component of me going back on sick.
Now there has been a change in how things are handled after everything was investigated. I wasn't the only person who this had happened to.
Now we just phone and say not in. Only the big boss knows why as we email, and this email is only accessible to him. Fit notes are sent directly to HR.

What do you mean by they looked through the office PC outbox? Why would your sick note by attached to an outgoing email?

You are NOT overreacting

Write a formal conscise complaint . Did not go into any emotional personal or emotional detail just state the blunt facts

Hope it kicks in soon

*be

Wtaf! I'd be livid! Definitely not overreacting.

Also what were the phone calls about? Because I'm wondering if that constitutes harassment too.

Your enployers could get in a lot of shit for this (and should).

Did you email the sick note in? In which case all staff should be given a non public email address eg a HR one or the manager direct.
If you handed it in and manager scanned and emailed then it should have been password protected.
You should complain to your employer about their poor handling of your confidential information which resulted in the whole team gawping at your sick note.
Tbh they were wrong to look it but they should not have been able to. If proper procedure was in place and data protection rules followed it couldn't have happened.
I would be more angry with the employer for letting it happen.
Also ask how the staff will be dealt with as they should face disciplinary action for what they did, as should the management.

I don't understand why your sicknote was attached to an email that was open for everyone to view, how did that happen, you need to discuss that with your manager. They should also be able to find out who accessed the email, regarding the phone calls, why were they phoning you, they shouldn't have access to your phone number unless authorised by you anyway. I would seriously consider raising several complaints.

I would not only put in a formal complaint but also go to the information commissioner.

@panda81 OP emailed the sick note so it was in her sent items one assumes.

Definitely complain OP - unless authorised they should not have been in your emails in the first place let alone accessing obviously private information.

@MyKingdomForBrie if OP used a shared mailbox to email the sick note then I imagine she will have very little to go on in terms of complaining about data protection. But OP needs to confirm as it's not entirely clear who has sent an email with her sick note from the shared mailbox

yanbu that is a massive piss take

Gdpr!

I would definitely complain! Someone at my work did similar and lost their job because of it! Why on earth was it any of their business. CFs.

Let me give you the IT management perspective on this:

You may have a better case if you complain about your department's data protection practices - that's assuming that the shared mailbox used is the only one at your disposal.

A shared mailbox is, by definition, used by several people - and there may always be legitimate reasons why people would check other stuff than strictly the inbox. This even includes deleted items.

Three of the teams I manage have shared mailboxes (though everybody has a personal email account as well). They're under strict instructions only to use them for non-personal, whole team responsibility correspondence and must even sign mail sent via the account with "A team" rather than "name".

As a manager, I'd expect sick notes to be sent from my employee's personal mailbox - along with other stuff that's not meant for everybody, e.g. complaints, requests for 1:1s, concerns with business practices etc. As a matter of fact, I'd consider use of a shared mailbox for such matters a case of possible misconduct (depending on content) and might check with HR.

But that's because all my employees have personal mail accounts in addition to shared ones.

Think of it like so: shared mailbox = holding your conversation between the desks at your open plan office. Personal mailbox = meeting room/boss' office/etc.

Obviously, this depends on there being a clear IT policy in place and employees having access to alternative means of communicating with the boss.

If your workplace doesn't ensure that's the case, from an IT management perspective, you may have reasonable grounds to claim that your workplace is in breach of data protection laws. OTOH, if you do have other means of communication, I might question your judgment in using a shared mailbox.

From a pure IT perspective, your problem may be that your colleagues may have legitimate reasons to dog through email and may hence have found your note regardless of whether or not they were deliberately digging for it. Which, again from an IT perspective, makes your case against your employer instead of your colleagues a much better one, providing you exercises sound judgment in using the mailbox in question.

HTH.

Also: sorry this happened to you - it does sound like a crap situation.

Yes definitely complain. It's a breach of data protection, they can't look at your personal details/medical records etc just because they feel like it.

How do you know they’ve done this?

Like others I don’t quite understand what’s happened here. It may be your complaint should be against your employer if this shared mailbox is the only option to send/receive personal items. But if it was my job to monitor a shared mailbox and I saw something that shouldn’t be there that wouldn’t really be my fault. That said the if someone saw something personal accidentally they should keep stum!