Gdpr breach at work?

[Ereerenownow]

I've written on here a couple of times about issues at work but now a new problem has arisen, I think.
I an a private person and don't for example celebrate my birthday at work (though I obviously have a great time with friends and family).
Our office is big and busy and many people from different departments hot desk there. One young girl who uses our space has vague links to nhs via her community counselling work. She isn't employed by the nhs but has the logo on her lanyard as well as her charity's logo.
We are relatively friendly and have often chatted briefly in the kitchen while making a cuppa etc. One time she asked my age and birthday and i very politely said that i don't discuss those things at work. It was no big deal and we moved on to talk about other things.
Well this week she approached me with a wink and said, I know how old you are and you look great for your age and I'll give you a card on your birthday now.
I haven't told anyone else in the team my birthday and I don't believe myself and this lady have any friends in common...I am not on any social media.
I suspect she has access to at least some nhs files and databases and I'm worried that she has used her logins to access my records.
She's lovely but quite gossipy and I think she's capable of telling others in my team.
She also very vaguely alluded to a recent health issue I've had but didn't tell anyone about.
I admit given recent events at work, I'm slightly sensitive so I don't want to cause any problems if non exist.
Can I check to see if she's accessed my private nhs records? Am I just being paranoid?

reiterate to her that you don’t want this shared at work, no card and ask her how she found out

and you are not weird. I don’t share anything personal at work either.

How could she find out OP's DoB from Ancestry.com?

I choose not to share my birthday. I had a difficult time growing up and I have a difficult relationship now with my family. My birthday brings up difficult feelings for me so much so that I choose not to talk about it. If you tell someone your birthday, then some people at my work would choose to make a fuss- a cake, a card, a small present- but I don’t want any of that as I want to forget it’s my birthday.
It’s nothing about being upset about my age or anything.
Other people with different religious beliefs (I think maybe Jehovahs witnesses or Plymouth brethren) also might not choose to share their birthday
I tend to reply with, oh I don’t celebrate my birthday so I prefer for people to not know when it is.
I am now thinking that people at work might think I’m a complete weirdo.

@NewJobNewMeNewLife You're not weird and nor is OP. I've never volunteered my birthday at work either. If someone ever asked me I'd probably tell them, but that's my choice, just as it's your's, OP's and a few other PPs who've stated they choose not to. I find it weird that some people would be so disrespectful of other people's preference for privacy.

@Ereerenownow I think you need to tread carefully. Having read your other posts regarding issues at work, I can sort of understand your wish for privacy. People should respect that. However, without some sort of hard evidence, you are on a bit of a sticky wicket to make such a serious allegation of your colleague accessing your personal records. Without evidence it's just a wild accusation.

Sadly, the world is made up of some folk who would find your wish to personal privacy as some sort of challenge. Others will encourage that, just because, and especially if you are not that popular or part of the 'in crowd'. It's just how some people are. It's a reflection upon them, not you. Please don't make any formal complaint without proof that GDPR has been breached.

Even if you personally don't have much of a presence on social media, it's amazing how much can be found out from, colleagues, former colleagues, friends and friends of friends, if somebody has found it a sleuthing-challenge to do so. I don't understand why anyone would want to, but there's nowt so funny as folk.

I totally agree. What you shared is up to you. You've done nothing wrong. It's your colleague who's at fault. I'd ask her how she got that information and then decide what course of action to take. I wouldn't shy away from making a complaint.

For those people saying you should have shared your age/birthday, that's madness. People have all sorts of reasons for not wanting to share this information. I'm someone who doesn't share this. For me, it's linked to the pain of infertility. I have no children and am getting older. I don't want questions/comments about my age and whether I'm planning to have children or not. I find that too painful, so prefer to avoid discussing birthdays and age.

Oh I'd have to ask her again!

"It's been playing on my mind as to how you found out my DOB, so I thought i'd give you a chance to explain before I contact HR, or submit an audit request of my NHS data"...

The goadiness of "oh I have my ways!" would irritate me as much as the snooping. Possibly even more

Many application forms ask for the date of birth and in the main form, not the accompanying diversity forms so managers would see them if they are sifting the forms and some people have them on their CV too. (Even if they don't, you can often work it out from the CV).

It's not unusual. The other woman is really out of order.

I think you need a quiet word with someone about this. This person isn't professional.

So many people having no regard or respect for the law regarding personal data. Just because you wouldn't have a problem sharing certain information doesn't mean that the OP shouldn't have a problem with it either. Seems like this colleague is of the same mind - that she has a right to know someone else's data and has therefore helped herself to it. There's a reason why it's against the law and it isn't for random strangers, or colleagues, to decide it doesn't apply to them. It doesn't sound as though OP is that close to her colleagues anyway - not all jobs require everyone to sit in the office and have plenty of chat time.

This may be a minor example but the principle is very clearly defined. She hasn't just found out the date; by the sound of it she's looked at other things which are very much none of her business. "Oh don't tell anyone, she could be sacked" - er, good? She can go get a job somewhere that doesn't give her the opportunity to poke into other people's business. Or join MI5 and do it for a living.

I'd make a discreet enquiry with the employer's data protection officer. No fuss unless and until it turns out she has been poking where she didn't have a right to. Then the DPO should take it further as it is their role to do. Nobody other than Ms Nosey should ever need to know OP was even involved.

I don't know where she works in your business but you'd be surprised how many people outside of HR probably do see your DOB in the course of their day to day role. IT in their course of system set up, administrators who book travel. For my Co Sec role I have all the senior managers and directors personal info because we have to be able to supply this to our regulators. The weirder thing is that she is telling you like this.

If you were born before 1995 and have a relatively unusual name it would be easy to work out using the Free Bmd website.

ancestry.com sells date of birth?

You're perfectly entitled not to share personal information with work colleagues if that's your choice @Ereerenownow

You could do a Subject Access Request to your workplace to find what records they hold about you, what emails etc etc - basically, anything that is relating to you. You might find out how she found personal information you haven't given her.

But she's the weird and indeed, wrong 'un. If she's accessed your data without good reason, she's breached the law. And sending you a birthday card is not a good or sufficient reason!

But don't ask her about it in private. If you ask her again how she got information about your birth date & age, do it in front of your or her manager.

It must feel quite uncomfortable working with this colleague.

As a previous poster said, NHS systems are not well connected. It’s unlikely she was able to access your information unless 1) she works in your GP surgery, 2) she works in your local hospital, 3) you’ve accessed the charity/service she works for.

Odd for her to go out of her way to find out that info, and to let you know she’d found out despite your obvious reluctance to share.

I have worked for the NHS for decades and can't think of any situation where a non NHS employee would have access to NHS database. In our area, at least.

Also in our system you cannot search and find a person just by name - you'd need to know the date of birth already. Again this might not be the same everywhere.

Ask her how she knows!

Birth Year and month are in the BMD database
Your D.O.B might also appear if you are in someone’s public family tree
She might know someone from your class at school
She might have a relative who knows you / your family

There are plenty of ways someone can know your DOB, that does not involve hacking into a system

Is everyone's DOB listed on there? That's a red flag for identity theft surely

In that case she has most definitely accessed your personal records and has breached data protection. Report this and make sure it is properly investigated.

I highly doubt she’s been able to access your nhs files unless you are a user of the specific service she provides. There is not one big nhs database with health info that everyone in the nhs can access. Additionally, a lot of the programmes log a users access of the files.

I have an unusual surname and just did a search on FreeBMD of births using my name only and was rather surprised that it brought up four entries with our DoBs spread across 17 years. OP would have to have a very unusual surname for her nosey colleague to strike lucky on her name alone.

Yes I’d say it is weird to be asked directly and be that secretive that you would refuse to tell someone your birthday. Though it’s your choice and you have the right to refuse. But it’s deffo odd

Not definitely at all, she may have found out through some kind of mutual connection or legitimate access to the information at work.

No one here can possibly my say for sure what's happened unless by chance the workmate happens to see the thread and posts, I guessing you aren't her

I pretty much agree with this. But I also would add that having read your previous posts, I think you need to decide what it is that you want from your colleagues. Your last lengthy post was about being excluded from staff socials and holidays - you commented on how you were being ostracised. Before Christmas you were upset at being left out of a meal that two teams went to, but were left out because you told people at work that you hate Christmas! And before that you missed a colleagues birthday celebration because you were dealing with a work issue then complain nobody came to look for you to see why you weren't there. Now somebody cares enough to want to celebrate your birthday and you want to report them for breaching GDPR (whether they have or not).

It may not be the best work environment, but even just basing it on your own comments I get mixed messages about whether you want to be included or not be included. You can't get upset or complain about them being friendly with each other or going out together whilst also telling them you want to be left alone, and then complain that they are ostracising you when they do leave you alone!

I think that you need to give serious consideration as to whether you and the job are a good fit. If your messages are so mixed here, I do wonder if your colleagues are getting the same mixed massages. You obviously don't like the majority of them - and whether that is a reasonable or an unreasonable dislike, it seems that the entire situation is making you unhappy. Life is too short to be this unhappy. Whilst I have every sympathy with your view that work is work and I don't expect it to be about making bosom buddies or great friends, you do need to be able to get on with people and at least not have the amount of drama that this workplace involves for you. That isn't happening, and the impact on you is unhealthy. Best move on before it gets worse.

I think I was probably about 8 when I last asked someone who wasn't a friend, when their birthday was, for no legitimate reason. It's the equivalent of 'what's your favourite colour?' I don't care.

So that's odd. But just as odd is not to push for how she found out. It's an exercise in futility to umm and ahh about whether it's a breach of gdpr. We don't know. For all we know she may have overheard the op giving her DOB when calling her bank during her lunch hour.