Gdpr breach at work?

[Ereerenownow]

I've written on here a couple of times about issues at work but now a new problem has arisen, I think.
I an a private person and don't for example celebrate my birthday at work (though I obviously have a great time with friends and family).
Our office is big and busy and many people from different departments hot desk there. One young girl who uses our space has vague links to nhs via her community counselling work. She isn't employed by the nhs but has the logo on her lanyard as well as her charity's logo.
We are relatively friendly and have often chatted briefly in the kitchen while making a cuppa etc. One time she asked my age and birthday and i very politely said that i don't discuss those things at work. It was no big deal and we moved on to talk about other things.
Well this week she approached me with a wink and said, I know how old you are and you look great for your age and I'll give you a card on your birthday now.
I haven't told anyone else in the team my birthday and I don't believe myself and this lady have any friends in common...I am not on any social media.
I suspect she has access to at least some nhs files and databases and I'm worried that she has used her logins to access my records.
She's lovely but quite gossipy and I think she's capable of telling others in my team.
She also very vaguely alluded to a recent health issue I've had but didn't tell anyone about.
I admit given recent events at work, I'm slightly sensitive so I don't want to cause any problems if non exist.
Can I check to see if she's accessed my private nhs records? Am I just being paranoid?

I didn't say they rely on it. It is one of the pieces of information some sites ask for, as part of multi-factor ID. One of the sites is one of my banks! Only as part of the secure on-line sign in - on the app it is face/fingerprint. Which I have often thought sounds very secure, but I wonder how secure it would be if pushed. But maybe I have just seen too many of those films where the baddy gets in using a lifted fingerprint ....

You can find someone's DOB if they have any records with Companies House. To do that just involves a quick and legal Google search.

I highly doubt she's accessed the OP's NHS records. That's not easy to do, anyone who has to NHS databases has training that makes it very very clear you can only access records that you need to for work purposes, plus when you do try and look up someone you have "no relationship" with it prompts you and you have to say why you are trying to access it

It would be more likely she got it from social media than NHS data base. Have you checked your privacy settings? Do you have any mutual friends? Or does she know anyone in real life who could have told her. It's a weird fact to violate GDPR for, she could literally lose her job. And strange that she told you she knew it's like she was getting one over on you for not telling her.

I'm sure finding out peoples birthdays are quite easily accessible.
Op, I'm not going to lie, it's a bit odd that you want to hide your age AND your birthday, most people dont do both but guess you have legitimate reasons?
Anyways yes you can report her at the risk of jeopardizing your work relationship and making things awkward for yourself.
I guess if you are an introverted and private person,you wouldn't find this an issue anyway.
I mean IMO I would be flattered that someone is even interested in my birthday- it shows interest

I'm sure finding out peoples birthdays are quite easily accessible.

How?
If you want to reassure the OP it’s really easy and she is making g something out of nothing , you need to tell her how you can find that dirt of information easily.

I was quite happy to give away my dob in my 20s

Once I hit my mid 40s and was working with people younger than me, not so keen!

Age discrimination is a thing, people treat you differently, generally unconsciously but they do.

I have a real birthday and one for websites where they ask for it - I knock about 15 years off on those 😉

Yes, it's really strange.

But you're looking for information about her!!! Could be in the same boat!

How does ones brother in law know the time on ones birthday? I don't even know what time I was born, this thread is quite an eye opener

That manager sounds very creepy!

@B1indEye "How does ones brother in law know the time of one's birth? I don't even know what time I was born, this thread is quite an eye opener"

He's married to my sister. She worked, back then, four days per week in the butcher-shop with him.

Is your birthdate and birth-time, your mass and length/height at birth not on your mother's hospital discharge card?

I have mine, my daughter's and my son's at my house. (I have photos of all seven of my grandchildren's). Now that I am in my eighth calendar decade on the planet, I am about to offer to let my daughter or daughter-in-law take them as I further downsize my house and space.

It may not breach Gdpr but it also may be that hr data is stored in a place that can be accessed without appropriate controls.

I get hr data as part of my finance job (so the other 4 senior finance team who approve payroll can also see it saved dowb)

But it's used for that basis only.

So I would raise with hr. Either she found it via a system she shouldn't have access to. Or she accessed that system /asked someone else for data she doesn't need. maybe not all sackable offences but inappropriate really.

If in fact she googled and found out via asking op's external friends that is also inappropriate at work and needs a hr discussion on boundaries. It's slightly bullying to go off and find out something a person doesn't want to speak about (which is not work related) and tell them that you got that information anyway. It's definitely unprofessional.