Am I over reacting or is this actually OK?

[Freddoflation]

When searching for a document on our organisation shared drive I realised confidential documents about me are available for anyone to see. They are linked to stress at work, which has caused mental health issues. So think return to work form ect...

One thing to add, it's not share point or one drive. You know when you can see who modified or read them. It's a small or with access shared on one log in across computers. So not like it's on there but we'd know if it was read by somone who wasn't me or a relevant person. Which I think would still not be OK, but have a bit of accountability.

Im really annoyed about this. My workplace have been really shit with the issues which caused stress, which I flagged loads of times and weren't rectified. These are around people not following processes so I have to make sense of the mess. Or can't do my job.

This just feels really unacceptable. But I could be feeling this because I'm stressed af! Please give me a bit of perspective (gently!)

I’d be annoyed (to put it mildly) too. I’m not tech minded but are you saying your HR documents are available on your work server?

Yanbu that's ridiculous

That's a major data breach.

Are you in a position to be able to look for another job?

I don't think that is right, they shouldn't be accessible.

I might be tempted to password them if possible!

Definitely report it. But if you think it's going to be a hard slog to get it sorted, have a search to see if you can find stuff about the managers too. They might be more inclined to get it sorted if there was documentation about them too.

YANBU. That’s special category (sensitive) personal data and they need to be way more careful with it.

I would password protect them immediately!

I'd be very annoyed. It's a data protection breach at the very least.

Shocking - can you speak to HR/manager tomorrow?

To answer a few questions.

We don't have hr dep. It's an org with about 20 staff. So we don't have an intranet or anything like that it's a drive like Google drive type thing. Password protecting them first thing is a good shout.

My manager is the ceo and it was them who would have put it there I assume. I will be bringing it up. I just felt unsure of how big a deal this is. As I'm not doing massively well.

No, it's a huge breach of gdpr

Legally, it’s a data breach under U.K. GDPR and as soon as you make them aware they should be reporting it to the ICO within I think it’s something like 72 hours? It is a big deal in that it’s illegal and you can face fines (though wouldn’t necessarily get fined, it’s a possibility) but apart from any legal aspect it’s just common sense/common decency, they shouldn’t need laws to tell them that they shouldn’t have private stuff accessible to other employees.
(I bet they won’t self report it though, btw).

Absolutely not ok for it to be open, but regardless, there may be other logging on the system to track access. We have these as standard on all shared drives even if regular users don't realise.

None of that changes any of the concerns that you have.

I would be tempted to photograph them on your phone to prevent them disappearing and the company denying all knowledge.

Can you send them to yourself or download then delete them from the shared drive

I also realise the title doesn't really make sense sorry I was knackered and annoyed yesterday.

I've screen shotted it and will delete or password protect. I know there is this saying about not putting things down to malice when y are due to incompetence. But I feel like it's so basic not to do this I do feel hurt.

It's also good to get perspective from people so thanks!