I have received someone's disciplinary letter by email by mistake............

[Nailgirl]

So I've just opened my personal email account.
It is clearly Nail Girl @ gmail or whatever.

The email says "Dear Nail, as discussed details of the disciplinary for next week etc -see attachments" from Joan (insert another name).

Panicking -I hope the attachments as of course my first name is Nail.

Except this is a whole different person, name, address, medical details, and documents, OMG.

The email is signed off to her "best wishes for your wellbeing".

Not my company etc. -OMG.

I've emailed them back and said "Nail Girl is not Nail BonJovi -as should have been obvious from the email address. I suggest you contact Nail Bon Jovi pretty sharply and tell them that her confidential disciplinary stuff was sent to the wrong email. Obviously I opened the attachement due to the informal tone of the email that addressed me by my first name.

I will be printing off these documents tonight and posting them first thing in the morning to her address.

I asssume that this would be the right thing to do.

DO NOT PRINT THEM!

In our GDPR training it was made clear what our responsibilities are. In this instance you should inform the sender AND your data protection officer.

Reply to them, delete and move on. Why does everything have to be such a drama.

@DioneTheDiabolist

I will be printing off these documents tonight and posting them first thing in the morning to her address. I asssume that this would be the right thing to do. Why do you assume that OP?

I am printing off the emails sent to me in error and posting "the emails" to the mail address I have. Else the person has no confirmation that the breach has happened.

This is NOT a minor error -this is a major GDPR breach -major. If it was me - I would want to know -absolutely.

I'll take advice from my HR -not a related company but a huge company -and see what they say. I think informing the sender and intended receipent is what one should do.

Deleting it -really? of course -but I would want to know if it was me. I might not trust my management to tell me.

@SkyeIsPink

Reply to them, delete and move on. Why does everything have to be such a drama.

^ Yep, this.

Usual proviso, I m not a lawyer, but my understanding of GDPR is that if OP prints off the documents she too commits a breach of GDPR because she doesn't have the data subject's consent.

Sounds like a scam email.

Why do you have to print the emails? Why can't you just forward the email to the intended recipient? Or is their email address not in the attachments?

@Lilifer

OP how do you know her address??

I downloaded the document attached - I had no reason at that point -given the email address from the sender is legit -government body, to doubt it.

It said "hi Nail -further to our previous discussion ..............." etc.

I should mention this is a government body -similiar field to what I do -but this was my personal email and I'm in no way connected.

@JonasKahnwald

Why do you have to print the emails? Why can't you just forward the email to the intended recipient? Or is their email address not in the attachments?

Their email address is not in there -but their home address is.

@Jamhandprints

Sounds like a scam email.

It really isn't.

Seconding previous post, have you checked the company through company house? If you believe it's genuine then notify ICO.
And if you don't know the sender don't open any attachments! I would be running antivirus and software updates pronto.

Agree with a pp it’s likely a scam

The documents are not intended for you. You have no business printing and redirecting them. The correct course of action is to advise the sender they were sent to wrong email address and then delete the email and documents. Same as If you receive post to your address not for you, you return to sender not open the post have a good read and post on.

I would notify the company that sent the information out that they'd made an error but I'd also ask them to notify the ICO under GDPR. I'd then delete the email as I wouldn't want to be responsible for storing someone's personal details.

I think you’ve done the right thing to be honest!

And possibly saved her job given what a major breach of her information that person has done!

Well done you for reporting it!

I would most definitely send it by post to the intended recipient

Oh really?

What if the company got the address wrong too? Would you like to be dragged into the dispute and accused of causing even more trauma to the recipient, because they accidentally put their colleagues address on by mistake?

What if you then found out the company was a really good one that had been let down by a temp agency - but the person being disciplined was a nasty piece of work with a history of looking for any excuse to take a previous employer to court?

Any what if (and this is a very real possibility) both the recipient and the company turn on you, and decide to prosecute you for handling data that was clearly not intended for you?

You'd be in a real pickle then, wouldn't you?

Do not get involved: If an email is not for you, delete it.
No further action is required - the whole thing could be an elaborate phishing hoax, designed to drag you into some nasty business.

@Groundhogdayzz

Just reply to the company to let them know and delete the email. Really don’t think you need to go any further on this, if it was me I’d rather NOT know someone else had read all about my disciplinary.

You might not. But if it was me I would want to know.

I'm going to contact the ICO tomorrow and say I don't know what to do -and get them to advise me.

All those saying about leverage because of GDPR, the ICO really don't care about minor things like this, where it is simply a single person making a mistake. Letter telling them to be more careful maybe. They care about companies like Facebook that don't look after data properly.

I’d print off and post them to her. They company won’t tell her they’ve messed up. She deserves to know.

I wouldn't send the documents. I would simply write to the person to let them know that this has happened. It's then up to them to decide what to do. They might ask you to forward the entire email.

But they should certainly know that this has happened. Because there's no way the company will tell them.

Don't print them or send them.. that isn't your responsibility at all... and i dont know what kind of issues this can cause but i can imagine it could cause legal issues..

Like other posters have said, just email back explaining they have emailed the wrong person..

This happened to me a few months ago

Huge drama over nothing. Delete the email and move on with your life.

@Nailgirl

i downloaded the document attached - I had no reason at that point -given the email address from the sender is legit -government body, to doubt it.

My DH just yesterday received a very authentic looking email from DVLA saying that his road tax is expiring soon and he needs to update his payment details he previously provided for DD. All legit looking. Government website and all. Turned out it was a scam.

@LardiLaLardiLi

Seconding previous post, have you checked the company through company house? If you believe it's genuine then notify ICO. And if you don't know the sender don't open any attachments! I would be running antivirus and software updates pronto.

This is a section of the government. Think department of transport or something -the sender is on my linkedin -and very high up. It is a proper government work email address.

This is a known scam. Report it to Action Fraud and if someone replies asking you to put your details in a ‘registry’ don’t do it