AIBU to think writing confidential HR notes on a train is inappropriate?

[Elphabababa]

I am on a train in the UK.

Someone on the seat in front of me is writing up meeting notes from work. All clearly visible through the gaps between seats. I am slightly long sighted mind you.

I have seen that:

• She works in HR for company X
• The meeting was for an employee named Y (I can see his name and job title), following him raising a grievance about a GDPR breach of his data within work.
• Subsequent notes of the meeting about this grievance.

She's still typing her notes now.

AIBU for thinking that people should be very mindful of what work they complete in public places? And that this is inappropriate, and if Y found out that these notes were being written in full public view, they would have a further grievance on their hands?

Or am I a nosey parker?

(Or both?)

She knows best apparently cos Beryl did her training in a nice chat, rather than the recorded training modules with tests to validate understanding conducted annually like every organisation in the UK 🙄

Without even trying - because I'm not weird - I recently found that I could very easily see the argument a girl sitting in front of me was having over text with her boyfriend.

Haha sounds about right. Anyone who has had rigorous GDPR training and how to deal with confidential documents know that the responsibility is on them to keep that information out of the public eye. But according to her “training” it’s the passengers on the train who have the responsibility of addressing it lol

Yeah it’s easy to see with the layout of the seating on trains. Makes me paranoid lol

'Not to gossip' and 'descretion' is minimising what a data breach is. These are the norms in any organisation with any data, but you said it was specific data you shouldn't be privy to. That's a systems failure and needs to be reported and addressed. If you manager is doing that then fine, but it's not what you said.

Twenty years ago, I worked at KPMG, Colin Sharman was the managing partner... he would go ballistic with anyone discussing client business in the lift because you did not know who else was in the lift with you. This is the reason, also, back then if you were working on client business, you travelled first class with a privacy screen. It's basic commonsense, so yes, report it.

This. Someone who's had HR training and still thinks it's ok to do this isn't going to see the light because of anything some random says on a train. They'll just dismiss her as a busybody (ironically, like many posts on here)and carry on. Which is why you should report this to the company with as much detail as you can, as it's the only way to stop this stupid and unprofessional behaviour.

Sorry she certainly was not entitled to assume nobody would peer through a train seat.

when you are responsible for someone’s data that doesn’t mean you get a pass for assuming that the general public are to take responsibility for averting their eyes

we live in a world where criminals are trying to harvest data all the time. The responsibility lies firmly with the data controller to protect it from everyone.

If she needed to work on the train she should have used a privacy screen or typed her notes up on a word document anonymising the personal data until she could transfer it to the file in a private place

no excuse and she deserves to be reported

Not the case in this train situation but it can be highly criminal to disclose market sensitive insider information to those not entitled to know it. Either with loose tongues in public places or having someone see a computer screen.

It can mean those outside are able to manipulate markets and share prices by trading on the inside information and severely influence prices. If OP had instead seen something like a merger being discussed and then traded shares using this info the little train typist could have ended up in prison!

Imagine if HR woman was reading this thread. She would be having a worrying evening.

I think the suggestion of reporting it in a generic way is the way to go. To tell the company that their employees need a reminder of the importance of protecting data. Give non identifiable details but impress upon them it was a data breach plus could cause major embarrassment to the company if you were minded to take it further than à general warning.

Report or say something, if you can be bothered. So many MNers minimise and condone unprofessional behaviour. Raise your standards. At my firm this would be a disciplinary.

I haven’t read all the comments but as someone who had a fairly long career in HR, it isn’t breaking any law, and honestly that person was probably just trying - like a lot of people in the corporate world - to use an opportunity where there’s a bit of dead time and they’re not being interrupted to get on top of their work. HR people do work on trains as well as other people do. Just because it’s HR and we deal with work confidential to the company, doesn’t mean just because someone’s taking a peek at that work that we’ve breached any type of ethics. And people saying “Ring the company!” are the same type of people who comment on threads about not being able to put offers in on houses that are already sold by offering the solution of “Just knock on the door and demand a viewing.”

I think you need to seriously brush up on current legislation as this is a blatant data breach under GDPR legislation.

If you give similar advice in an HR role you're leaving your organisation vulnerable to significant penalties.

How utterly wrong. You'd think they'd have a screen protector on if working in public places! But it's just awful to do this in a public place fgs there must be other less confidential stuff to do elsewhere, right?!

I think may be a breach of GDPR, it's def a confidentiality breach. What you do depends on what you want out of it - should they be disciplined for example?

Edited to say I meant this as a reply to a previous comment.

Let’s be real here. Someone on the seat behind has managed to read, either on a laptop or written notes (I haven’t seen which it was) the name of the HR employee and the company they work for, along with the name of the employee under investigation. Was this person writing in font size 40? And if you’d read my comment you’d see I no longer work I HR - so feel free to leave a juicy little reply along the lines of “Just as well” etc etc etc. Whatever has taken place here, I can’t imagine a situation where I’d be reading someone’s laptop on a train, and proceeding to either a) write a post about it on Mumsnet and/or b) contact the company to say did you know someone in your HR team is writing notes on a train and I managed to read them by looking through the gap in the seat. What the hell.

I've worked in loads of companies where on the first days you have to go through training courses on not discussing work on public transport, not working in a coffee shop etc.

Although to be honest I see people doing it all the time. It's quite interesting to read some of the pointless rubbish people are writing as part of their "serious" job, I often wonder why they don't just put the laptop away and listen to a podcast or something!

You claimed some authority but clearly aren't as qualified as first indicated.

Whatever your interpretation is it doesn't change the responsibility under legislation. No amount of stroppy indignation changes the situation and "just" revealing personal information by failing in one's duty to keep that data secure isn't the minor indiscretion you're implying.

As for the "the training tells you you should address it with the individual first" I think that's far easier/more appropriate to do with colleagues than with a random stranger on a train!

Didn't once say that. 'Beryl' is that new 'Karen'? The superiority is off the scale.

Where does that quote come from - no one said that, did they? Literally did not. But if you equate just having a quiet word in someone's ear to crossing the Khyber then I don't know what to tell you.

I work in HR. I know that if I wanted to work in public, such as on a train, I wouldn’t write anything identifiable. I’d type it with X’s and fill these in later in the office. But I’ve been doing this job 25 years! Maybe someone less experienced might not consider that…

You actually can! I have seen many people working in a train and have never once looked at their screen. Working on a train and/or using that time to catch up with colleagues is often the only way of keeping on top of work for many people these days. She probably thought as no one was sitting next to her that it was ok. Unlucky for her someone with nothing better to occupy them was peering through the gap. Yes she should have had a privacy screen but you absolutely should not have been gawping at what she was doing. As for reporting her FFS get a life. Do you know the person she referred to? If not no harm done.

But you think it's okay that that stranger was working on their laptop with the details about someone who had a grievance about the way their personal data hadn't been protected in view of other passengers. Would you be happy with your personal info on show in these circumstances?

Absolutely report. I work in a legal role and this is a breach. Particularly if on a local train and names are mentioned

I've seen all sorts from people sitting right next to me and doing things like preparing financial statements of public companies for earnings releases. Then again you'd have to be really obviously staring to read anything. I just saw the heading. I used to work for a listed UK bluechip and we were explicitly told we were not permitted to work on anything other than public documents in public. There was a whole classification system so you couldn't make a mistake about the document type.