Grassing up a colleague

[Janey90]

I’ve got to deal with this on Monday morning. One member of my team (let’s call her Nicola) made a big mistake last week, which resulted in some confidential information getting sent somewhere it shouldn’t. I don’t want to go into any more detail than that, but the information was not medical or financial. But it has caused my department some embarrassment.

However we would all be none the wiser about this (for the time being) if another team member (let’s call her Ruth) hadn’t reported this to a very senior member of staff. Ruth could have helped Nicola with some damage limitation measures, but chose not to.

As much as I’m frustrated that Nicola made this error, I don’t like a snitch and feel Ruth has been very petty.

I’m actually surprised that Nicola didn’t know or forgot her GDPR training. The whole point of proper GDPR training is you know exactly what to do when a mistake happens. As you say it was a big mistake.

The person responsible for the mistake should take the blame. Its that simple.

My issue with the language was that it was clear that you had an issue with Ruth’s actions before you had spoken to them.

How could anyone forget GDPR procedures?

I am assuming you are line manager to both of them. So people came running to you about Ruth, causing you to decide who was wrong before speaking to the people concerned? That’s quite ironic.

The work culture sounds toxic.

Ruth could have ‘helped’ her but she presumably didn’t have to. And it sounds like people don’t like her so I don’t blame her for that.

It is potentially going to be untenable for Ruth to stay there as people clearly dislike her actions so I hope she finds an amazing post elsewhere.

If Nicola reported the breach herself then why all the drama? If it was reported (I assume to the correct team) then the correct process would have been followed at some point anyway. Or am I missing something? It doesn’t make sense to me.

Why would it be untenable for Ruth to stay there? I can’t really see what she’s done wrong.

Because OP seems to think it’s fine for someone to ‘forget’ the procedure and not report it right, also for people to sneak around and bitch enough that she has decided who is at fault, BUT not for someone to report it higher.

Ruth hasn’t done anything wrong, however OP clearly decided that she is the villain of the piece. That is quite hard to work with, so it will be difficult for Ruth to work knowing that everyone is bitching about her and that reporting the breach was worse than ‘forgetting’ GDPR procedures.

Your problem then is both your team members, and anyone else in the team they asked, are not aware of correct GDPR processes or where to find them when you are not there, who deputises / where do they escalate to if they don't know in your absence?

Now sounds like a management failure and needs investigated why something so basic was unknown.

As usual, people are completely making things up here with no factual basis whatsoever.

uhu

She probably panicked after realising she had made a mistake, and, as an otherwise conscientious member of staff who ISNT always making mistakes (as OP has confirmed) felt guilty and stressed. All Ruth had to do was tell her "hi nicola just FYI you actually need to fill out the incident form (or whatever) and send it to xyz.

😂😆😂

impressive creative writing @latetothefisting

👏👏👏

She didn't just make a mistake, she also didn't know what the correct procedure was to manage a mistake.

She sounds useless.

Op's org does not seem open and honest about it.

We have a specific department which deals with this sort of thing?!!

Yes but does the department know about all the breaches? All companies should have a privacy and data team and they have to be kept in the loop when breaches happen.

This is the first one we’ve had since I’ve been in the department.

But you’re totally going off at a tangent - I just wanted to vent about the frustration of someone making a mistake and then someone else escalating it unnecessarily in the wrong place.

If you read my update, you will see that Nicola reported the breach, it turns out she contacted the right department but the wrong person within that department. So hardly a cover up.

So Nicola compounded the breach by reporting to the wrong person.

She sounds incompetent. Plus, if you, a very biased observer, call her mistakes rare, that means this isn't her first.

Maybe this isn't the right workplace for her. Or for you if you think trying to make sure your higher ups are kept unaware of breaches is professional behaviour. I see why Ruth reported higher up.

If your company culture at your level thinks of things like reporting data breaches as "snitching" and *grassing", and that breaches of private data are acceptable mistakes, then you're operating out of a personal and vindictive mindset rather than a business one and I hope I don't have dealings with such companies. Yikes.

But your issue is the escalation rather than the original fuck up (by someone who apparently couldn’t remember GDPR).

I think it’s a shame that you are concentrating on the wrong issue, particularly as you weren’t there but you made the decision based on people ‘grassing’ on Ruth to you

So if Nicola reported it to the wrong person did that person point out to Nicola who the correct person was that she should report to?

How sure are you that Ruth is shit stirring, or was she also trying to do the right thing and had forgotten details of the GDPR training.

A major feature of GDPR training is to take potential breaches seriously and respond swiftly, and with sufficient seniority. So it could have also been a well intentioned, wrong action.

Absolutely. Our GDPR policy tells us expressly to raise it with someone senior and NOT with the person who caused the breach!

The whole place sounds fucking awful. Op was on holiday but someone not involved communicated with her to complain about Ruth.

This person, whoever they are, needs some senior guidance on confidential information. As a manager op should have pointed that out to them. Then, without discussing the issue, or waiting until back in work, op decides what happened and blames the whistle-blower.

Op was on holiday so should have ignored any calls from work, especially if not over secure networks or personal email or phones etc.

The great thing here is that Ruth reported it. Nicola clearly didn't know how to, and it sounds as if the culture is a toxic one anyway.

The way op, her informant and the team are reacting is why people don't speak up.

I really hope Ruth reports to hr and senior management any backlash. And has grounds for constructive dismissal if op doesn't handle this properly.

Given your dislike of snitches, op, who snitched on Ruth? Or is that ok snitching. That person was also shit stirring to someone higher up.

It does read like you like Nicola a lot more than you like Ruth. 2 people made mistakes but you have allocated malicious motivation to over of them. Obviously, we don’t know these people but why was Nicola’s mistake innocent and Ruth was being a grass?

"Interestingly I was given the heads-up about all this, by someone who isn’t really involved, and it became clear that many people know about Ruth’s “help”.

So a grass to use your words?

"My initial thoughts about Ruth haven’t changed."

You'd rather be right than side with Ruth.
No wonder Ruth did what she did if the culture in your workplace is what you've portrayed here, very biased.

You will go far in life, Jenny.
But you will not be liked.