Gdpr breach at work?

[Ereerenownow]

I've written on here a couple of times about issues at work but now a new problem has arisen, I think.
I an a private person and don't for example celebrate my birthday at work (though I obviously have a great time with friends and family).
Our office is big and busy and many people from different departments hot desk there. One young girl who uses our space has vague links to nhs via her community counselling work. She isn't employed by the nhs but has the logo on her lanyard as well as her charity's logo.
We are relatively friendly and have often chatted briefly in the kitchen while making a cuppa etc. One time she asked my age and birthday and i very politely said that i don't discuss those things at work. It was no big deal and we moved on to talk about other things.
Well this week she approached me with a wink and said, I know how old you are and you look great for your age and I'll give you a card on your birthday now.
I haven't told anyone else in the team my birthday and I don't believe myself and this lady have any friends in common...I am not on any social media.
I suspect she has access to at least some nhs files and databases and I'm worried that she has used her logins to access my records.
She's lovely but quite gossipy and I think she's capable of telling others in my team.
She also very vaguely alluded to a recent health issue I've had but didn't tell anyone about.
I admit given recent events at work, I'm slightly sensitive so I don't want to cause any problems if non exist.
Can I check to see if she's accessed my private nhs records? Am I just being paranoid?

There was a long discussion on a thread yesterday about the whole issue of access to medical records if anyone wants to see how things vary across the NHS

So does OP tbh

"I haven't told anyone else in the team my birthday and I don't believe myself and this lady have any friends in common...I am not on any social media."

From the OP, she is not on fb!

This other person has obviously done some digging to find out the OP's birthday which is weird and she may well have breached GDRP to do so.

Most likely is she mentioned it to someone who replied something along the lines of:
"Oh she's 36 on the 14th May. She's exactly a day older than my sister."
Ime that's how birthdays normally get out.

Oh no I completely misread the OP! Definitely a breach if has been obtained internally

And then did you follow that up? "Go on, you'll have to give me a clue. I can't work out how you'd know"

So does OP. Imagine being so cryptic as to refuse to answer how old you are at work. May as well sign up for the severance programme.

@homemadepopcorn "If OP has uploaded their DOB to their public Facebook then GDPR does not apply in this instance." Exactly, which is why I wrote "It doesn't matter where the woman got the information from if OP hasn't placed it in the public domain."
"From OPs OG post it would seem this information is accessible through viewing their FB profile." I don't know where you get this from since OP wrote in her opening post: "I am not on any social media."

see my reply above 👍

Are people seriously suggesting that OP reports someone for giving her a card and being nice!! FGS what is it coming too! And yes how saying I don’t discuss my age or birthdays at work is pretty odd in my experience. I have never heard anyone reply like that… so weird. Obviously I would respect their wishes but that doesn’t make it less oddd

I would say a birthday is just a fact and isn’t really something you are likely to be judged on, I would think a colleague strange if they were purposefully keeping theirs secret tbh.

The fact you can't imagine why anyone wouldn't want to be reminded of a significant date, and make endless small talk over it being a "happy" day, is strange tbh.

Have a bit of compassion for people that have lived a life different from yours.

No, they're not FGS. They're suggesting that OP could report her colleague for committing a breach of the GDPR if she feels strongly about it. And it doesn't sound like you'd "obviously" be respectful of her wishes at all if you were her colleague.

@Ereerenownow
Please can you request an audit of who has accessed your NHS data. It is a huge breach of GDPR if she is accessing this information without good reason. If she has done it to you, then she may well be doing it to other people. This is taken very seriously and is a sackable offense. And rightly so.

Something tells me there will be a big revelation in the story before this thread fills up. Just in time for part 2 to continue the saga.

It’s not weird. It’s your data and in an information age where DOBs and family member names etc are lifted from Facebook pictures and used to clone people’s identities you are absolutely within your rights not to share personal data with people you don’t wish to. I have no idea why posters here are criticising this.

I’d absolutely go to HR and express concern as to how she has accessed that information and leave it to them to investigate whether it’s a data breach or whether she has a mutual acquaintance. Even if it’s the latter, she is out of order from an HR perspective.

But OP wrote in her opening post: "One time she asked my age and birthday and I very politely said that I don't discuss those things at work" so how could any of OP's other colleagues know her DoB?

Why are you looking for trouble?

I would contact the Inflammation Governance department of your local NHS organisation to check if they have accessed your notes. Plus your GP practice. I would also raise a concern with your manager and HR.

You both pretty weird 😂

Yes it is strange, you are spending significant parts of your life with these people so whilst I get not sharing details of medical info, relationships, or personal info even year of birth, the day your birthday falls on is hardly sensitive deeply ffs and people just might want to say happy birthday. Seriously weird.

That said, now it’s got 5is far I would however want to know how she got this info. My guess is HR

Lots of people have ways and means of finding things out about others but would not even think of abusing it. She was out of order. Privacy should be respected.

OP isn't "looking for trouble" - she even wrote "I admit given recent events at work, I'm slightly sensitive so I don't want to cause any problems if none exist." However, she also wrote: "She also very vaguely alluded to a recent health issue I've had but didn't tell anyone about."
It's absolutely outrageous that someone should be trying to find out a colleague's private information. It's highly likely that OP isn't the only person this woman is invading the privacy of, and given that OP describes her as "gossipy", I wouldn't be thrilled about her behaviour either as I value my privacy (so few people seem to these days). Would you really be happy with someone finding out personal information about you, regardless of how she did so, which you expected to remain private?

I agree.
Unless you've used her service/ speciality, it's unlikely she could find out that way.
Bet she's asks someone and doesn't want to drop them in it.

Don’t worry @Ereerenownow
i don’t think I’ve ever given my date of birth to anyone in my office.
Why would I?

She could have just got that info on Ancestry.com. No need to assume gdpr has been broken.