AIBU to think writing confidential HR notes on a train is inappropriate?

[Elphabababa]

I am on a train in the UK.

Someone on the seat in front of me is writing up meeting notes from work. All clearly visible through the gaps between seats. I am slightly long sighted mind you.

I have seen that:

• She works in HR for company X
• The meeting was for an employee named Y (I can see his name and job title), following him raising a grievance about a GDPR breach of his data within work.
• Subsequent notes of the meeting about this grievance.

She's still typing her notes now.

AIBU for thinking that people should be very mindful of what work they complete in public places? And that this is inappropriate, and if Y found out that these notes were being written in full public view, they would have a further grievance on their hands?

Or am I a nosey parker?

(Or both?)

I’m impressed by your eye sight but baffled why you’d think it normal to read a strangers laptop screen. Clearly not your business. I just cannot imagine doing that.

Yes, this is not on and probably gross misconduct. I would probably reach over and tell her. If she was arsey about it I’d report to the company.

Your highly nosey

I can see why she might be - I don’t get paid for work travel (aka travelling for work, not commuting) unless I work as I travel. So I find myself trying to find completely non-sensitive work. Which is probably impossible if you work in HR.

Many years ago I used to very occasionally catch the train to London to the company's HQ. I always remember a colleague saying 'never discuss anything work related on the 7.45 am train as you never know who is listening'.

She just said she could see it was about someone else alleging a GDPR leak. And obviously if she can see their name and company name then that's a breach all over again.

I wouldn't say anything though. I'd find it ironic. But it's hardly some earth shattering national secret that Gary from business development at Acme Widgets has an HR grievance.

I would call the company's whistleblowing hotline to complain. They may then have to report the data breach to the ICO.

I work in governance and compliance, always have a privacy screen on my laptop. Only last week I was saying to a colleague that I can tell the names, jobs and employers of so many people I sit near on trains who do nothing to protect their data. It's frightening how ignorant so many people are.

MNers can't wait to report people can they, it'd be a dream come true seeing something like this!

Call the company and tell him

yes definitely find him on sm and let him know!!

I’m taken aback by the number of people saying it isn’t important. I’ve had three typed appraisals this year as part of training for a new role, and I would be royally pissed off if any were done in any kind of public place, whether a train, tram or coffee shop. Talk of nosiness or worse, snitching, downplays the seriousness of this, imo.

Privacy matters, confidentiality matters, and the woman OP has observed is breaching both. It’s deeply unprofessional (privacy-ensuring kit is widely available) and she should be held accountable for it.

In the OP’s shoes, I’d probably tell the woman and leave it at that, but even a whiff of pushback, and I’d be going to the company.

Agree… kind of. But there’s a time and a place for confidential information and it isn’t on public transport.

The number of posters who have accused me of taking joy in the thought of reporting her...

When I haven't once said that's even a consideration. That's other posters.

I'm off the train.

I remember the company name. I'll sleep on it. I'm considering sending a generic email not specifying any details but suggesting they consider reminding employees of expectations around working in public.

Go to the head of the company and tell them what you have read. It will support the guys case. See if you can’t find him on linked in and tell him.

This is a significant breach under GDPR Article 32:

Data Breach: Unauthorised third-party viewing constitutes a confidentiality breach (Article 32). If the data is highly sensitive, it may require reporting to the Information Commissioner's Office (ICO).

Under ISO 27000 for information security management systems, which is the international standard, leaving screens visible in public areas violates Annex A 7.7 (Clear Desk and Clear Screen), which dictates that information processing facilities must be secured to prevent unauthorised access.

I would report her to the company and advise them it may be reportable to the ICO.

how do you quantify significant, out of interest?

I'd read over her shoulder because I am nosey.

A company putting someone's details out publicly for anyone to read is worse than a random member of the public being nosey.

I would definitely send an email to him just to stir the pot. It isn’t difficult to find someone these days if you look.

I can beat you though, many years ago I had a good old listen to barristers preparing their case - which was on tv the next day. Although that was in 1st. 😂

Both of you at fault. OP for looking and person in the seat in front not working inside the company firewall. But that's what happens nowadays, similar situation to working from home.

The irony!

You could have tapped her on the shoulder and discretely tell her “I think you need to get a privacy screen”. And get on with your life.

@Elphabababa

I hate HR.

OP, please please write to this company with full details regarding the name of the person and the nature of this man's complaint, so they take action against this HR person.

You could even take it a step further and search for the man on Linkedin, and let him know directly.

The fact that the employee concerned is complaining about a GDPR breach and the HR person dealing with it has all their identifiable information on a screen in a public area is just 😬

Thing is you can’t help seeing things if they are in front of you, it’s like listening in to a conversation when it’s taking place a few feet away from you. The responsibility lies with the person talking, or typing to ensure that they can’t be heard or seen.

I would contact the company OP