To ask my employer for compensation for accidentally leaking my pay details?

[salviapurplerain]

Posting here for traffic. I'm part of a group of people being made redundant at the end of this month. As part of the process, every individual in this group has been emailed a financial illustration of what the package will look like. It's a 1 like excel spreadsheet with detailed personal information including gross annual pay and a full breakdown of the exit package.

We have just found out that on one person's spreadsheet, along with that person's financial information, HR accidentally shared all the information for 6 other people! I am one of those people whose information was shared and I'm so upset! This is a breach of confidentiality and data protection surely!

Will I be unreasonable to claim compensation for this?

Goodness me! 😱

Have you seen one of those solicitors adverts on TV?

"Have you suffered a trip, fall or leaking of pay details at work? Where there's blame (or a spreadsheet) there's a claim!"

Nowhere have you stated why you're upset. What is it about a colleague finding out how much you earn and your redundancy package that was upsetting?

You can report them and they will be investigated and fined.

You aren't entitled to any compensation.

You can report them and they will be investigated and fined.
No they won't

Most posters are incorrect. There does not have to be financial loss for there to be a claim for a data breach only ‘emotional distress’. You don’t need medical evidence to prove this but I am not sure what the criteria would be. Distress is subjective, what would distress one person would not distress another. That said, I don’t think the breach you describe would be.worth much.

Maybe have a think about how distressed you really are about the breach.

Personally I would just complain but we live in a compensation culture. If you decide to give it a go, having a chat with your insurance company is a good place to start (you can still complain as well).

Still waiting to read what OP's distress was.

@Frankola

You can report them and they will be investigated and fined.

You aren't entitled to any compensation.

Hahahahahaha they are highly unlikely to be going to be fined for a minor breach like this.

Many people do not understand how compensation works. And if you're not trained in law it can seem complicated. There's damages in tort, where the loss is not necessarily financial, but are often referred to as compensation.

Explaining that compensation is usually based on redressing financial loss would have been much kinder than piling in on the OP, who is under the stress of redundancy, and who has only just found out about the breach (because it is, although very minor), and calling her grabby.

As you’re leaving the company, the leak doesn’t impact you day to day in the workplace.

And it’s not the end of the month it’s TODAY. This is your last day at the company. How have you been aggrieved by this?

Although the new data laws are different from many other laws and there is a specific right to claim for distress 9not just where there is also provable financial damage), Also as the phone hacking/privacy rights cases showed this is different from other areas of law. 6 figure sums for some people although I accept that is rare www.theguardian.com/culture/2017/oct/03/steve-coogan-wins-phone-hacking-damages-from-mirror-group

Why would you care if other people know your salary? Surely keeping salaries a secret only benefits unscrupulous employers, by enabling them to pay some less than others for the same work! (Often this means paying women less because they don't ask for more money). It's better to be open about it and then you are able to negotiate better!

[quote Xenia]Although the new data laws are different from many other laws and there is a specific right to claim for distress 9not just where there is also provable financial damage), Also as the phone hacking/privacy rights cases showed this is different from other areas of law. 6 figure sums for some people although I accept that is rare www.theguardian.com/culture/2017/oct/03/steve-coogan-wins-phone-hacking-damages-from-mirror-group[/quote]
The op hasn’t had her phone hacked by a newspaper. It’s not remotely comparable.

Blimey. The occupational health company contracted by my former employer accidentally sent my consultant's highly confidential letter directly to HR and my manager. The first I knew about it was when occ health called me. They'd already reported themselves to the ICO and were clearly readying themselves for me to make a claim. They even called me back a few days later to check. And it was definitely distressing. But I didn't. I was just so sorry for the employee that had cocked up and didn't want to get them into more trouble. Can't understand why you'd want to do that in these circumstances.

Can't understand why you'd want to do that in these circumstances.confused

To put pressure on the company to put better measures in place to stop things being accidentally sent. It’s not as though these accidents happen in a vacuum. They are down to work systems and practices.

The privacy cases of course involved celebrities so I agree their losses would be worse and perhaps their distress was although I am not sure on distress the court distinguishes in amounts based on how famous you are.

The ICO's website says

"How much compensation will the court award me if my claim is successful?

This will be up to the judge hearing the case, who will take into account all the circumstances. This will include how serious the infringement was and its impact on you, particularly when assessing the distress you suffered.

If the organisation refuses or is unable to pay, you should ask the court how you can enforce the judgment.

You should also bear in mind that the court can award costs to you or against you in certain circumstances. For example, if you fail to demonstrate you have suffered damage or distress, the court will not award you compensation and could order you to pay the other party’s costs. Again, we recommend you seek independent legal advice to allow you to consider the risks of bringing a claim."

I am not in favour of these claims but I just wanted it clear the law allows a claim for emotional distress now even if there is no financial damage (unfortunately ).

Leigh Day solicitors summarise this too:

"Compensation for data breaches
The amount of compensation you’ll receive if you’re the victim of a data breach depends on the exact circumstances relating to the breach, including:

Sensitivity of the data stolen;
How many people accessed your data;
Length of time between the breach occurring and being informed;
How long unauthorised access to the data was / is available ;
Anxiety and emotional distress encountered;
Any financial losses experienced.

You could receive compensation for the loss of control over the information even if you suffered no financial loss"..

Sensitivity - medium - not special category data or data related to health

How many people accessed - low - v few

Length of time - low - op was told quickly

Access length - low - not long

Anxiety - low - op hasn’t said anything behind she’s angry and hasn’t exacerbated existing condition

Financial loss - low - none

Op will not get any significant amount of award for this and it is irresponsible to suggest she might.

Best case a few hundred quid. And she might not even get that.

Your salary is company data, not personal data. If your NI number is shown, or you date of birth, there’s a personal data breach.
If not, they can pin it on the notice board if they so desire.

@svelte could still be identifiable though. If the OP is there only one in that role.

Pretty sure if we posted salary numbers on the board the office grapevine would soon have everybody matched up

Svelte, it is personal data if it identifies how much salary she recieves. Ie on the amount is on a spreadsheet and it clearly shows that the salary is hers

Frdd, I have said I don't believe in people bringing the4se cases and they are not magic money trees but I have two currently against clients for similar things by the way and it is very difficult to defend cost effectively so people settle - it is a really difficult area and I wish we had never allowed claims just for distress.

Why would you need financial compensation for this?