To ask how this would be handled in your workplace?

[WhoWants2Know]

Ok, I know it's not the first time I've asked a question like this on Mumsnet. I think my radar for what is normal or acceptable in the workplace is completely skewed at this point in my life. But here is a recent situation:

Employee A started working with the organisation recently. Employee B has been around a while and has a habit of teasing coworkers. For whatever reason, B was curious about A's age. A wasn't forthcoming. B looked for an opportunity, went to A's things and looked at their driver's license. (This was observed by another coworker. B said they were retrieving something at A's request.) Then B revealed to A what they knew and how they had found out, at the same time revealing A's age to a coworker.

A was upset but didn't know how to respond. Coworker responses were very mixed between exasperation and outrage, saying it was a breach of privacy and confidentiality.

Which would it be in your workplace? A prank gone wrong or misconduct?

@Merryoldgoat this is taken from the GDPR Website: “Once an individual has access to certain personal data such as your name, date of birth, ID documents or Social Insurance Number, and passwords, they can use them to log in to different websites in order to access even more information that they can use to their advantage.”, so yes, there is a possibility that Employee A could take legal action against the Employer, so they will treat this as a serious potential breach (as the Company I work for did, and updated their compliance training to use this as an example of something that you would have to keep as private). This occurred to me because I did my mandatory annual compliance training last week…
The website is here: https://www.gdpreu.org/the-regulation/key-concepts/personal-data/#:~:text=Once%20an%20individual%20has%20access,can%20use%20to%20their%20advantage.

@Anyotherdude

Yes - I understand that it is the type of data that would be covered by GDPR but this isn't a breach made by the company processing or controlling the data which is what GDPR covers.

Someone's purse or handbag is not data held by a business or organisation - the organisation could be sued for other things surrounding the incident (possibly - I'm not a lawyer) but this is not a GDPR breach.

It's outrageous and should be punished but this action would not be covered by GDPR.

@Merryoldgoat Maybe my Company are being extra paranoid then (always possible, I suppose) because it happened on Company premises in the similar example they cited.