Losing Information (work)

[Sunspirit]

Just wondering if this is considered a data breach / can you go anywhere with it as never had to deal with this before?

Currently pregnant and just got a new boss. Old boss was happy with me just emailing them the dates/times of appointments.

New boss wants me to add all of my appointments to my electronic email calendar which they have requested access to, then to see proof of each appointment.
I showed them a letter recently which was the actual copy, just to show them the proof they wanted. They took this letter from me - I naively thought to read at their leisure to confirm or perhaps photocopy for my file.

When I brought it back up to retrieve it a couple of days later (blaming how forgetful I seem to have become lately) they couldn’t find it or seemed to be unsure about where it was. The letter will have my name, address, NHS number as well as information about the appointment. Boss either works from our small office, occasionally other locations or home so my letter could be anywhere. Work in large public sector so any location aside from their home is accessible by many people.
I have asked them to have another look for it but if this letter is lost, could anything come of this as I’m not too happy knowing my personal information could be anywhere?
Thanks

It is a data breach. I'm not sure what you mean by can you go anywhere with it? You don't seem to have suffered any harm or loss because of this so there wouldn't be any compensation, if that's what you meant.

No, I don’t want any compensation, I just meant could it be reported as such.
They’re not the type of person where you could just politely suggest they’re more careful.

Technically, yes, this means that personal information has been lost or misplaced: if you work for a large organisation, the should have a data breach protocol and a point of contact to whom this can be reported.

On a more local level, this is why you NEVER hand over originals of anything: a scanned Pdf sent to a secure location (ideally SharePoint or Dropbox) should be sufficient.

I would question why your boss asked for this (particularly given that anything pregnancy-related is protected and there should be a robust process around this)and would also query your organisation's employee DP policies more generally.

You should report it to your companies Data Protection Officer, if yo7 don't know who this is check your work email address list for DPO or check the Privacy policy on your company website. You can also report it to the ICO, although it's unlikely to incur any significant response due to it being only 1 person affected by the breach.

Absolutely report this . It's a disgrace

I'd confirm with HR the actual requirements for appointment reporting as this seems excessive

Yes it's a data breach. Report it. Play this manager at their own game.

In my organisation it would be considered a data breach.Like other posters I'd also query the procedure with HR.