To ask my employer for compensation for accidentally leaking my pay details?

[salviapurplerain]

Posting here for traffic. I'm part of a group of people being made redundant at the end of this month. As part of the process, every individual in this group has been emailed a financial illustration of what the package will look like. It's a 1 like excel spreadsheet with detailed personal information including gross annual pay and a full breakdown of the exit package.

We have just found out that on one person's spreadsheet, along with that person's financial information, HR accidentally shared all the information for 6 other people! I am one of those people whose information was shared and I'm so upset! This is a breach of confidentiality and data protection surely!

Will I be unreasonable to claim compensation for this?

Under the GDPR you are entitled to compensation for any loss including emotional distress (see ico page).

This is unlike most English civil law on compensation but was presumably brought in because the damage organizations do by being careless with data is frequently intangible.

For those who are saying that there is no loss so no compensation, I am afraid that is incorrect in the case of data protection (I am currently dealing with such claims). There is now case law regarding compensation for harm - which includes distress. However you will need a solicitor and you won’t get a lot.

For compensation you would need to prove material loss. For example, if it ruined your chances of a pay rise or promotion. Other people knowing is just a mistake. It happens. It’s not a reason to sue, but you might wish to raise a grievance with HR if you suspect it was intentional or if it has affected your working conditions.

Breach of confidentiality? Are you serious? Have you suffered a loss? Then you aren’t entitled to ‘compensation’.

Sounds like you work in a place like I just left (also redundancy) who also have a group of people leaving at the end of this month.

The HR there are brainless and did a similar thing to me.

I asked them if they were going to report the data breach. They didn't reply so I did. I reported it and we had an internal investigation. There is a clusterfuck of errors in my redundancy and I will be raising that issue if I decide to follow advice from acas and do a letter about unfair dismissal.

How different are the salaries?

ie is everyone on roughly the same?

Even if not, it won't be much of a surprise to find that a team leader (for example) is on a few k more than the team members.

Still shitty though.

GDPR breach. The company had 72 hours to report themselves for this.

Even if they're fined for the data breach it won't help you financially. Some industries are small, people talk, the last thing you want is to get a name for yourself and you might need a reference in the future.

Why do people think they are entitled to compensation at the drop of a hat these days? Moving into this sort of litigious, grabby society benefits nobody.

Don't rely on the internet. The new data protection laws allow claims even if there is no financial loss. I am not saying you would win anything but as someone said above this is the case now. You could technically bring a small claim for compensation. There are cases emerging under GDPR - see digital.freshfields.com/post/102fth1/can-i-claim-damages-for-hurt-feelings-under-gdpr-an-austrian-court-says-yes

More useful however is seeing what compensation others got - eg if all the men got double the redundancy payments of women even though earning the same that could help you all as a group negotiate more.

As a couple previous posters have said above, you can claim compensation for emotional distress. Any sum received would be minimal and you would need a solicitor (though most firms who do this type of work do no win no fee).

You should report them to the Data Protection Commissioner- who may issue a fine . You may also get an apology although as others have said its difficult to argue for compensation when you did not have a financial loss.

Report as a data breach

It's a data breach but no monetary compensation for you. At worst, a fine from the ICO. Probably not even that. Bigger fish to fry.

It's upsetting but you've not lost anything.

greedy and grabby - if the employer is making redundancies, HR are probably stretched, possibly at risk of redundancy themselves.

the gdpr angle - is it just your salaries? May have more to go on if they have additionally shared NI numbers or dates of birth.

It was a accidental privacy breach within the company.
I doubt you'll get compensation.
You could contact a solicitor if you have lots of money to spare/waste.

I don't think I'd care if people saw my salary. Especially being made redundant as harshly, you won't be earning it soon. Different if NI details etc were on it.

@rottiemum88

FGS, is this honestly the way some people think? 🤦🏼‍♀️

I work in data protection and (unfortunately) see breaches much worse than this occurring most days of the week. Yes, it’s a data breach. You could choose to report your employer to the ICO. Nothing is likely to happen if you do. You definitely won’t be compensated. HTH

Attitudes like this from people who work in data protection are probably why companies can now be obliged to compensate for non-financial losses. The lack of concern for another person's privacy when that person has no control and the company does is appalling.

Grabby....and yabu.

OP, I hope you check with the ICO rather than just go by people on here telling you that you are definitely not entitled to compensation.
I see a lot of advice given by mumsnetters in my area of work which is just plain wrong so please do check with the ICO.

I dont think we would report this to the ICO. we would log it on our breach register, and try to improve the process so it didnt happen again. and apologise to those involved

and shit ourselves about an equal pay claim for 3 months

No

Why is it emotionally distressing? Are you on loads more than your colleagues and there's going to be a fallout for you?

I don't think it is reportable to the ICO either. Not all breaches have to be reported (despite the misconception by the public that this is the case). There is a threshold that needs to be met for the reporting requirement to kick in. The ICO is unlikely to do anything in any event given the number of individuals involved and the nature of what has been disclosed.

You should make a formal complaint to your employer though so they can investigate the breach and look at ways to improve processes so this does not happen again.

@Nydj

OP, I hope you check with the ICO rather than just go by people on here telling you that you are definitely not entitled to compensation. I see a lot of advice given by mumsnetters in my area of work which is just plain wrong so please do check with the ICO.

I will definitely look into this properly. Obviously at this point having just found out I haven't had enough time to. I did see on the ICO website that you have up to 6 years to make a claim so there is plenty of time to research and make an informed decision