To think is a data breach - and out of order?

[YettaTessieMarmelstein]

I work for a large company everyone on mumsnet will have experience of. We get contacted by members of the public - usually to complain. They sometimes contact by text. I am working from home in a job that doesn’t usually involve the public. My line manager has told me, as well as my regular job, I have to reply to complaints by text using my own mobile. I have refused since there is no way for the person not to have my personal phone number. A colleague who did this received abusive texts late one Friday night.
I Also suspect my employer would be breaking GDPR rules by me having people’s phone numbers.
Can anyone shed any light?
I am not happy about this at all and I am wondering where I stand.

Didn’t mean to include voting - but Am I being unreasonable to refuse this?

You would be breaching GDPR by having people's personal information on your personal phone. Which makes you and the organisation liable for hefty fines for a breach.

Do you have it in writing from your line manager that you have been asked to do this? I would pass this onto your data protection officer or equivalent.

Yanbu.

Ask him to provide you with a company phone and training on handling complaints.

Completely agree with you. We are even advised to block our work mobile numbers when we phone customers to avoid abuse! It's not expensive for them to pay for a a basic non smart phone for you to use for text only.

Absolutely no way would I be doing this! I can't see how they'd be able to enforce it either - your mobile is your own personal property. If they want you to do it then they need to provide a work mobile

That is definitely not right.

If your line manager wants you to do this the company should provide a separate handset.

I'd refuse ours have said when we make calls to withhold our number and texts are sent by using an online bulk messaging app. Moreover, it could make it easier for somebody to trace you.

I'd possibly concede if told to do it if they purchased and paid for a new phone - and then switch it off when not on the clock - but even so, your GDPR person should be having fits about this.

I would have thought it would be much more professional to use something like this:
www.textanywhere.com/send-sms-from-pc/?ls=PPCMOBILE&sc=PC%2BText%2Bg%2BGoogle.UK&sd=text%20from%20computer%2Be&gclid=EAIaIQobChMIsM_k9r_P6gIV5IBQBh1SfQSVEAAYAyAAEgLedvD_BwE

You would be breaching GDPR by having people's personal information on your personal phone

No, there is no automatic such assertion.

I cannot see any grounds that could be used for you giving out your own personal phone number to customers against your objection, and also of course it would be quite difficult for a company to come up with systems which do meet data protection obligations to customer data and enable you to use your own phone. (itemised billing being particularly difficult to meet right to destroy etc.)

It's very unlikely that the "line manager" has met any of their obligations before processing - since it would be so much cheaper to just use an internet based SMS sending service that had none of the problems and costs less than would be spent in compliance of trying to figure out a system where an individuals phone could be used.

Thank you for your replies.

We've been making calls home but have to put 141 on the front so that can't call us back and definitely wouldn't save numbers in our phones - that's a terrible idea of your company as they can text you back - don't like that idea at all. Definitely breaches your personal data. That means they can contact you outside of work hours as well and what stops them doing it after this is all over and you go back to normal?!

What an odd suggestion from a major employer, I can't see anyone being happy about that.

If you have to have the phone numbers as part of your job how is that breaking GDPR, doesn't the customer give you the number so that you can call them back?

Can they provide you just a SIM card if they don't have handsets to give out? Then you can either replace yours or some phones allow for 2 sims

I would ask the line manager to see a copy of the Data Protection Impact Assessment associated with the new policy of using personal mobile phones for contact with clients.

For good measure you could also ask HR if a risk assessment has been performed for your safety and protection from harassment of the new policy.

(Former DPO, Compliance and Risk partner)

No way would I or any of my team text someone from our personal number!! If your org. Wants you to reply via unique sms they need to invest in the relevent software!!! Absolutely dont do this

We've been making calls home but have to put 141 on the front so that can't call us back and definitely wouldn't save numbers in our phones

Have you also been required to cancel any itemised billing and ensured that your phone provider does not keep a record that you have access to?

This is very much a big no no.

I suspect if your line manager's "brilliant idea" got to the ears of more senior managers or anyone in the risk, audit or compliance areas they would have an absolute fit.

In fact, by declining to do this, I would go as far as to say you're probably saving your line manager from a disciplinary when it inevitably came out of the woodwork.

In fact as a previous senior-ish manager at a large corporate this is the kind of thing line managers do that then reach the boardroom via the grapevine and everyone is just like "Oh for fuck's sake...how on earth did someone think that was a good idea" while shaking heads / putting forehead on the table / miming shooting oneself in the head / laughing out of the sheer shiteness of the situation.

@lifesalongsong

What an odd suggestion from a major employer, I can't see anyone being happy about that.

If you have to have the phone numbers as part of your job how is that breaking GDPR, doesn't the customer give you the number so that you can call them back?

It is hard to explain without being specific but I don’t have to have the numbers as part of my job. These are not customers asking questions or Requiring feedback. The best example I can think of is that If a customer texted a major coffee chain to complain about the coffee then a member of staff texted them saying they were looking for customers to be on their adverts.

@wheresmymojo I can only hope. They are making people redundant so I don’t want to be difficult - I’m a single parent who really needs the job - but I really don’t want to do it.

I would politely decline with your concerns and ask said line manager to check their 'great idea' with both the nominated data protection officer/compliance person and HR.

You can word it in a 'I understand the thinking behind this to achieve XYZ however I'm concerned about the implications of this from both a GDPR compliance perspective regarding both customer data and my own personal data (personal mobile number) being shared. Before we move forward with this it would be good to check in with our compliance team, that way we can make sure that anything we implement in this regard is correct and won't come back to bite us'

Which loosely translates to 'This is a fucking terrible idea, get yourself off to compliance so they can tell you what a dick you are so that I don't have to and you can thank me later for saving you from yourself you utter dipshit'

This slightly came up for me, someone left a complaint msg on my work phone (I get emailed the recording) & I had no way to respond withholding the number. My boss doesn't know coz... I'm not sharing my private no. with randoms.

I think another point is, if you have WhatsApp and don't have the settings completely private. Someone who saves your number to their phone could see your profile picture and your name if it's on there.

@Catboysmama that is a very interesting point