Grassing up a colleague

[Janey90]

I’ve got to deal with this on Monday morning. One member of my team (let’s call her Nicola) made a big mistake last week, which resulted in some confidential information getting sent somewhere it shouldn’t. I don’t want to go into any more detail than that, but the information was not medical or financial. But it has caused my department some embarrassment.

However we would all be none the wiser about this (for the time being) if another team member (let’s call her Ruth) hadn’t reported this to a very senior member of staff. Ruth could have helped Nicola with some damage limitation measures, but chose not to.

As much as I’m frustrated that Nicola made this error, I don’t like a snitch and feel Ruth has been very petty.

If it is a matter of GDPR breach, then Ruth did the right thing to escalate it. The risk to the company is too high not to.

On a human level, Ruth should have supported Nicola to report it herself.

When it comes to damage limitation (for GDPR breach), it should be handled by the company information security officer, and there should be an established process to follow.

Why have you to deal with it?

Surely it's irrelevant where the information came from. Assuming it is correct you deal with it in the same way and you don't divulge how you got the information.
As regards to Nicola, if she had kept her mouth shut and tried to help with damage limitation would that have made her complicit in the mistake and therefore resulted in some measures of disciplinary action.

You think Ruth should have covered up a breach of confidential company information? 😮 Ignorance of the breach is bliss?

Nicole fucked up. Covering up a breach would be a giant fuckup.

You have an honest employee who does the right thing by not being complicit in a cover up and is intelligent enough not to risk her job too and you are annoyed with her.

Very unusual take OP.

Agree, Ruth would have made herself complicit.

@Janey90 , are you Nicola? Because you wanting another employee to cover up a breach of confidential info so it looked like the breach never happened is really shady behaviour.

The company could be in the shit without knowing and the fallout could be worse.

Are you the boss of the team? Wishing that it hadn't come out yet so that you didn't have to deal with it?

If so I'm horrified. Ruth did the right thing ethically and legally, and would have been complicit in a coverup if she knew but didn't tell.

I hope this is some sort of weird reverse and you're not genuinely a manager suggesting the problem here is that there wasn't a cover up?

So you actually think a cover up is the right way to go about it?

'Snitch'?

Is this a playground game?

What do you think should have happened OP? What is company policy?
Should Ruth have escalated to you first, is that the issue? Or did she take it straight to the relevant data protection officer? As everyone is individually responsible for data breaches it's hard to criticise Ruth's action, unless she didn't need to take it quite as high as she did, and in the process (vindictively, if that's what you're saying?) denied Nicole the opportunity to take responsibility and report it herself? That's the grey area to me.

It's so easy to just cover things up all the time, I probably would (and have in the past) but I actually applaud someone calling it out, some people get away with being really incompetent because no one wants to tell.

Agreed, if it’s a GDPR breach it absolutely should be reported, sounds like Ruth did the right thing alerting someone to what’s happened, if this is what it is companies can be fined for sharing data.

I am neither Nicola nor Ruth.

I’m struggling with the fact that Ruth escalated the matter to the most senior level, way above where it needed to be, when we have a department who deal with GDPR breaches. Nicola was incompetent (although she is usually very good) but Ruth has been very petty, and this is currently sticking in my throat more than Nicola’s error?

OP I'm with you. I absolutely hate colleagues who keep reporting to management. But judging by this thread, clearly Mumsnetters snitch all the time

It’s so important for any breach to be escalated and dealt with. The company needs to learn lessons and adapt any processes. A mis-sharing of confidential data is serious. If a complaint is made or worse, the company will need to respond.
I wouldn’t see it as telling tales either - in work, occasionally mistakes are made, and sometimes a colleague may more quickly grasp the seriousness of a mistake.

Edited:
I see you’ve mentioned a team deal with gdpr breaches - but when something happens which poses any risk to the organisation (as a breach would), I’d also expect it to be notified up the management chain.

I’ve known someone be a victim of some accidental data sharing a few years ago, and it was so serious that they definitely could have made a complaint, could possibly have claimed compensation and also shared via media. Senior managers would need to be aware of what’s gone on.

Key questions - has Ruth had information management training?

If she has, did she follow the appropriate course of action when she identified that there was an issue?

If she didn’t, then there’s a follow up conversation required. Not because she’s a ‘snitch’ but because it is important that staff take appropriate steps when there has been a potential breach. Those steps are usually aimed at rectifying asap. Very senior management notification generally isn’t step one because they typically cant actually do anything useful about it themselves.

This is weird. I work closely (not directly) with a team that has a Nicola, Ruth AND Jane (close enough to the OP's name of Janey). I can't wait to go in work tomorrow and find out what been going on!

Edited to add (not directly)

This is what I wondered. You need to have a chat with Ruth, thank her for taking action but remind her of the correct procedure. If there's a dept there specifically to deal with these situations, then she is wasting senior people's time in taking it straight to them. I'd point that out, but reflect too on how well trained people are on company policy. If she is familiar with the policy then you could ask her why she chose that route as it doesn't reflect well on the whole team, herself included. Just use it as an opportunity to cement team learning on the correct procedures for these types of events. Hopefully there won't be another!

😁

Deal with both issues separately.
Address the mistake with Nicola and put measures in place to prevent it happening again.
Do you manage Ruth? If so remind her of the correct reporting procedures. Do you have any reason to suspect it's vindictive?

surely the senior manager just redirected it back down the chain of command to where it needs to be? Senior manager recognises Ruth is overstepping

Also maybe Ruth is just really pissed of with minor incompetence and has had enough. Or maybe Ruth is a tattle tale and likes to stir up shit.