AIBU to be hacked off that a colleague inadvertently shared my salary with whole team

[YorkshireTrailRunner]

A Return on Investment report regarding my role and impact, a request to every member of the Core Team by an external stakeholder colleague, has been shared throughout the whole team (22 people) as an example of good practise. However, in doing so, my salary has also been shared. Am I being unreasonable to be a bit hacked off, or am I being precious?

Similar happened to me & I spent the next few months justifying my salary to everyone. Even those not in the same role as me were very hostile about it. Ive since had a further pay rise and if my colleagues knew I think they’d be furious; but I think I’m worth it to the business in the role that I do. I think your salary is for you to negotiate, or not depending on where you are and what role etc. My colleagues think we should all be paid the same, even though we don’t do the same roles at all. On one work trip, f during a 4 hour car journey, a colleague told me she thought she could do my job just as well as me.. I pointed out I’m bilingual for starters. Anyway- it was horrible and YANBU xo

A male friend of mine worked in an office with three women and they were all on the same level but he had negotiated a much higher pay, practically twice their wage. All their wages got released accidentally and it became a huge problem. It looked like it was sex discrimination, although I don't think it was. In my opinion he was worth the extra money and worked a lot more hours than the others.
But actually, I think these things should be public so that everyone is paid equally and if someone is paid more, it can be justified. Also it shows others what they need to do to get paid more money. If the ops company thinks they're paying fairly and equally, why should anyone be worried about pay levels being leaked? If the op think it's going to cause dissatisfaction amongst the staff, it sounds like the op is worried they'll struggle to justify disparities.

Contact HR - GDPR regs may have been broken

Everyone saying GDPR breach, can you tell me which part of GDPR you think it has broken?

It's a gdpr breach, and should be reported to the ICO within 72 hours of discovery, this includes weekends not just working hours.

Salaries are a minefield and always cause trouble ...I’d be pretty miffed too OP...but not much you can do I guess

Personal information attached to a name that is identifiable. It could cause discrimination or financial loss.

Wouldn't bother me but I work in public sector where everyone knows each others grade and therefore their salary scale.

revelation has the potential to cause acrimony and resentment
Your salary is higher than your equivalents then? that's really the only way to breed resentment; other people are paid far less for the same/similar role.

@betwixtlives

Why do you care? I’ve never understood the weird secrecy about salaries

This. I don’t understand why people see it as a secret. In the public sector you can search for any member of staff on the company intranet and see what salary band they’re in. It’s far more transparent and fair if everyone knows what they can expect as they progress

@camdenish

If earnings are kept secret, how can people know they are paid fairly?

I’m all for transparency

I dont really get why the people who aren't bothered are posting to say that. The OP is clearly very bothered, how does it help to post that you don't care? I very much doubt she's going to read that and suddenly decide she's OK with it after all

Even if you don't care you can't be unaware that in large numbers of workplaces it's confidential information and it's quite normal for people not to disclose who much they earn

Sadly nothing you can do now OP except complain.

@BlankaBanka salary information linked to a named individual is personal data. See page 12 from the ICO guidance. ico.org.uk/media/for-organisations/documents/1554/determining-what-is-personal-data.pdf

It's a major GDPR breach

It's not a major breach. ICO would consider accidental or deliberate release of vast amounts of personal data as a major breach. Such a company releasing a database of customer data. The ICO doesn't seek to punish a company for issuing data, to internal managers, that is needed to make business decisions.

One employee having her salary disclosed is not major, especially as there were justifiable reasons behind it. I.e ROI.
The report author would be wise to consider how they could minimise sharing personal data as it may have been avoidable. That's the approach I would take, speak to the author to ask if there are ways to avoid this in future. If it was ROI should they have taken a fully loaded/blended cost, rather than just salary?

Other than the potential for resentment what other losses or impact has it caused you?

Just for clarity, I work in the public sector but, as I said, on a long term project where the team involved have different experiences, remits and, therefore, pay grades. My role is specialised, requiring higher qualifications and a very specific background compared to some colleagues. I have a great deal more responsibility than most and the ROI showed that my return to this project that supports public health is +530%.
My post was advertised on a wide scale so whilst colleagues could guesstimate my earnings, should they care to, they wouldn't know for certain - now they do. Nobody else's ROI has been published so whilst everyone knows my exact salary, I have no idea what they earn. This is not about fairness inso much as transparency and closing the pay gap - I completely agree that people should be paid their worth and abhor the gender gap - but the fairness in that I alone have been 'outed'. And in fact, my background was in education but I have such belief in the good this project can have on so many people, that I took a significant pay cut, a decision I don't regret for a second.

I would suggest to the most senior person and the author that in the interest of fairness they should publish everyone’s “ROI” like this. (A crass way to look at it anyhow).

*Unexpectediteminshaggingarea" - that wasn't the question though, its undoubtedly personal data - the question was, which part of GDPR has been breached by a report including that salary being shared amongst a team as an example of good practice?

So many people are so keen to proclaim a data breach has occurred when a huge amount more information would be needed to ascertain if that was the case - personal data can (and is) frequently shared for all sorts of reasons and seldom is consent needed to do so.

Meh. I'm a teacher on ups 2 working 2 days a week. Google it and you'll know my salary in 10 seconds. Most people at my work know each other's salary because it is transparent/regulated. I don't get secret salary weirdness.

However, they shouldn't have shared private info without permission.

Further to clarify, I have no intention of making this a GDPR data breach and certainly not suing anyone, I simply wanted some input as to whether or not I was over-reacting before emailing the project lead to suggest a change of policy where, should potentially sensitive data be shared, the individual(s) concerned be consulted prior to publishing

It's awful. I'd be very pissed off and would report it as a serious GDPR breach.

@murasaki

It's a gdpr breach, and should be reported to the ICO within 72 hours of discovery, this includes weekends not just working hours.

I highly doubt this is a reportable breach. It may well not even be a breach if the information needed to be shared. Certainly not a breach the ICO will be interested in.

I think all jobs in the public sector should be transparent about salaries.

@JustAnotherSod

*Unexpectediteminshaggingarea" - that wasn't the question though, its undoubtedly personal data - the question was, which part of GDPR has been breached by a report including that salary being shared amongst a team as an example of good practice?

So many people are so keen to proclaim a data breach has occurred when a huge amount more information would be needed to ascertain if that was the case - personal data can (and is) frequently shared for all sorts of reasons and seldom is consent needed to do so.

The OP's personal data was shared without her consent or without a lawful reason (legal obligation or vital interest). My understanding is that constitutes a breach.

Public sector?
Tax payers money
No confidentiality
And rightfully so

* The OP's personal data was shared without her consent or without a lawful reason (legal obligation or vital interest). My understanding is that constitutes a breach.*

The salary for her role was shared
She occupies that role

There is no breach

One’s salary is not “protected” information. Not in private sector and sure as heck not in public