Gdpr breach at work?

[Ereerenownow]

I've written on here a couple of times about issues at work but now a new problem has arisen, I think.
I an a private person and don't for example celebrate my birthday at work (though I obviously have a great time with friends and family).
Our office is big and busy and many people from different departments hot desk there. One young girl who uses our space has vague links to nhs via her community counselling work. She isn't employed by the nhs but has the logo on her lanyard as well as her charity's logo.
We are relatively friendly and have often chatted briefly in the kitchen while making a cuppa etc. One time she asked my age and birthday and i very politely said that i don't discuss those things at work. It was no big deal and we moved on to talk about other things.
Well this week she approached me with a wink and said, I know how old you are and you look great for your age and I'll give you a card on your birthday now.
I haven't told anyone else in the team my birthday and I don't believe myself and this lady have any friends in common...I am not on any social media.
I suspect she has access to at least some nhs files and databases and I'm worried that she has used her logins to access my records.
She's lovely but quite gossipy and I think she's capable of telling others in my team.
She also very vaguely alluded to a recent health issue I've had but didn't tell anyone about.
I admit given recent events at work, I'm slightly sensitive so I don't want to cause any problems if non exist.
Can I check to see if she's accessed my private nhs records? Am I just being paranoid?

I do genuinely find it strange that you don't share your birthday. Is it really so weird to have a colleague wish you happy birthday in the same way they would say merry Christmas?

I personally think it's general chit chat, like 'what did you get up to over the week?'
'Oh it was my birthday so we went out for a meal, and it was lovely, whens your birthday, do you have any plans?'
'It's in August so we're thinking of using the bank holiday as little getaway birthday treat! Any way, best get back to it, see you later.'

No way would I consider this kind of conversation weird or think that anyone was asking something really personal.

Line manager should not have done this, definitely an HR breach. I am also not sure why people are being critical of someone wanting to keep their birthdate quiet at work. Surely its their choice?

its not your birthday or your life though? Its the Op's right to choose and not to be judged for it, especially by strangers online.

That said, if this other woman has done something dodgy to find out your birthday then I do believe it should be reported as that would be a breach of gdpr and that is clearly wrong.

Surely answering 'it's in x month but I prefer not to make a big thing out of it' would suffice?

Which is "not sharing your birthday".
The thing that OP is doing, and which the colleague is so unsatisfied with that they've gone and found it out themselves.

Ditto to all of the above. Very weird all round.

Then don't go online asking for the opinion of others 🤣🤣🤣

She didn't ask for an opinion about who should know about her birthday did she?

The Op asked about whether is a breach of GDPR she didn't ask for opions on her choice. RTFT!!

Might she have heard you on the phone confirming dob with someone? We had a central calendar at work as we got a birthday day of leave so everyone in the team knew what appropriate date someone bday was and would send a card from the team with a small gift. It didn’t confirm age though! That would breach of gdpr.

Weirdness about birthdays would have been unusual in every office I've worked in, who even goes round asking people that anyway?

I wouldn’t make a complaint unless you know for sure where she got the information from. Just because you have no mutual friends on Facebook, it doesn’t make it impossible to find someone so I wouldn’t rule that out just yet!

calling someone's choice weirdness just because its not your choice is pretty judgemental

I sort of understand not wanting to share your age, but I find it baffling to not even want to chat about simple things like birthdays with colleagues.

Totally understand wanting to keep the twists and turns of private life out of the workplace but some basic sharing of information is part of how teams create and coalesce

@Ereerenownow From your posts OP, it seems as though you like this woman well enough in the workplace, but you see her as a pleasant colleague rather than a friend. You clearly are friendly in the office, so maybe she sees you as more of a friend, hence her apparent intrusiveness (and promise to give you a birthday card! 😳 )?
She has definitely committed a data breach, regardless of how she found out your DoB. One of the eight GDPR requirements is that someone has to have a legitimate need for personal information about someone and she plainly does not. If someone gave her this information, they've also committed a data breach (although they may have done so unwittingly if she told them she had a legitimate need to know). Do you have much contact with your HR dept? Would you consider them to be professional? (i.e. how likely is it that one of their staff has been so stupid as to gossip about your age to this woman?).
I think you need to decide what you want to do about this and then act accordingly. For example, would you want to make a complaint to HR that she has found out your DoB thereby breaching the GDPR wrt your personal information?

"Ereerenownow · Today 11:12

Hi thanks for all of your messages and support. I'm not sure why some people are calling me weird for not sharing my birthday. I simply dont want people at work to know. Is that really so strange..genuine question?
I'm not tetchy about my age or anything but these people are not my friends...I honestly don't get the pressure from some to share this information."

I was responding to this post as I have read the full thread so maybe you should have too!

This is actually not necessarily true. What is true though is they can see who’s accessed records. I would make a report and the reason for it and they will be able to see if she’s accessed records.

for your own reference if she has she will be fired. It’s gross misconduct.

It doesn't matter where the woman got the information from if OP hasn't placed it in the public domain. Obtaining someone's date of birth, without their consent, would be considered a breach of GDPR unless she had a legitimate reason to collect and process OP's personal information, which doesn't seem to be the case from what OP's told us.

She didn’t ask for anyone’s opinion on that.

I bet all the people on the thread who are dismissing the OP are equally dismissive about stalkers?? "Oh they're only walking down the street outside your house, oh they're only adding you on all the social media, etc etc. "

It's down to the OP whether they share their personal information, not some creepy nosey colleague trying to somehow prove a point about how they can have power over the OP. Or randoms online judging about whether they are worried about the same things the OP is worried about.

She did!!

She said

Ereerenownow · Today 11:12

Hi thanks for all of your messages and support. I'm not sure why some people are calling me weird for not sharing my birthday. I simply dont want people at work to know. Is that really so strange..genuine question?
I'm not tetchy about my age or anything but these people are not my friends...I honestly don't get the pressure from some to share this information.

I am responding to that so the OP actually did ask!!!

It does seem strange not to want people to know tbh, it’s not like it’s particularly private or sensitive information. I can understand wanting to keep your personal life such as marriage status, relationship with family, financial situation, health etc private from colleagues but not wanting to share your birthday seems a bit ott. I would say a birthday is just a fact and isn’t really something you are likely to be judged on, I would think a colleague strange if they were purposefully keeping theirs secret tbh.

I work on public sector (not NHS) and I suspect it is the same elsewhere but our IT dept would be able to produce a list of who had accessed which records. Maybe speak to someone in Data Protection/ Information Compliance in the first instance and ask what you have to do to find out if someone has accessed your record without legitimate purposes. Perhaps make a Subject Access application and be specific that you wish to know who has accessed your electronic personal records in say the last 60 days and take it from there.

if she has accessed them without legitimate purposes it has potential to be dismissal - it would be where I work.

The OP herself used the word weird, I was responding to her but I know that maybe quoted posts dont always show up

I haven't commented on my own choice, my observation was about the many office environments I've worked in. You don't know whether I share my birthday.

If OP has uploaded their DOB to their public Facebook then GDPR does not apply in this instance. From OPs OG post it would seem this information is accessible through viewing their FB profile