Accidental Sharing of Performance Issues

[Westielove]

Several months ago I was informed by a manager in my department that I was working too slowly and that I needed to speed up. I had not been aware of this so I made a conscious effort to work more quickly and my performance figures have reflected this. Yesterday, the same manager accidentally forwarded on a chain of emails from our head of department intended for the other managers that contain a week by week summary of those who have been underperforming or have generated other causes for concern, to the ENTIRE department. My name was mentioned multiple times as my performance figures are being monitored, and now all of my colleagues know this. An hour later they sent another email to everyone stating that there was nothing detrimental against any member of staff in the email trail, that it was sent in error and that any concerns should be addressed with them and only them as they were the one who sent it. It was essentially a CYA email and contained no apology. Is this something that I should inform HR of or would they not be interested as it was done in error? Is individual employees performance data considered confidential information?

I am utterly mortified and feel I could now be the subject of gossip around the office. When I first started reading the email and realised what it was and the information it contained I felt sick. I suffer from anxiety and this has completely knocked my confidence.

Oh op that's awful.
Yes its personal data. I'm not sure hr are the right people to report to.

It’s not good but I think I’d be more concerned with my own performance than with an email. I’ve never worked in a job where everyone didn’t know who was lazy.

That is absolutely terrible, I cant claim to be completely up to date with data protection but, as that is personal information, I would flag it to the data controller within your company.

Cherry, really?!

Op has had performance issues raised with her and has taken steps to successfully improve. Despite that she still deserves to have the issue shared with everyone?
She was concerned, as you suggested. She made improvements. What more do you want her to do?

I can see why that would be embarassing for you OP, but I do agree with the PP who said that your colleagues may already be aware (but not have said anything).

The company should have a data controller/officer that you can contact about the breach. It does sound accidental and they have at least sent round a response straight away - have you spoken to anyone about it yourself? Did it mention other colleagues apart from you?

That's a GDPR breach op. It's really up to you what you want to do with that but if they're not significantly apologetic you could take it as far as the Information Commission. It might not make work very comfortable though.

I’ve never worked in a job where everyone didn’t know who was lazy.

There’s a difference between not working to expected standards and being lazy. It doesn’t sound as if the OP was lazy. I’ve never worked in a job where everyone didn’t know who was a spiteful prick.

I don't think it's a data breech. It's crap on their part though.

I can see why that would be embarassing for you OP, but I do agree with the PP who said that your colleagues may already be aware (but not have said anything).

^Completely agree

Of course you should go to HR! That's terrible!

I’ve never worked in a job where everyone didn’t know who was a spiteful prick.

This @CherryPavlova

It's a data breach and they've taken appropriate steps. People make mistakes. What other action would people want/expect?

I would have expected them to at least recall the email immediately and they have just made things worse by their reaction to the error. Mistakes happen - it's how the mistakes are dealt with that is the important thing - I would make an official complaint to the manager of whoever was responsible for it going out.

Taken appropriate steps?! They haven’t even apologised to her!

An apology for the massive breach of confidential info?

I suspect most of us have at some point worked with someone whom we think should be on an improvement plan. But unless that person chooses to tell you, no ne but them, their manager(s) and HR should actually know.

It is a data breach, whatever their follow-up mail might say about not being detrimental. Would I say anything? I would, but my close colleagues would probably already know, and I have a reputation for raising things. I am not you.
So I think you need to consider what you want to achieve from it and what is likely - I went through a disciplinary last year, and while what I wanted was an apology, I knew I was unlikely to get that, because that would mean they'd have to admit they'd screwed up, which I knew wouldn't happen, so I settled for being found not guilty and it all wiped from my HR record.

Do you think you would get an apology? At least, I would want some reassurance such a thing wouldn't happen again. But it could also be that it ends up as a black mark against you (albeit not officially)- it depends how reasonable your management are and how open to process improvement. I agree it will probably make work uncomfortable for a while, but that alone doesn't mean you shouldn't raise it. I just don't know if you would get the outcome you would really want, and if that's the case, is it worth the hassle?

It is a data breach or at best a "near miss" - I think it is an actual breach though and it should be reported to the Data Protection Officer. You can make the report to them yourself. The DPO then needs to report it to the ICO.

A data breach has to firstly contain enough personal info to identify the individual - obviously it does. Secondly, needs to have the potential to cause harm/detriment - well everyone knowing the OP's past performance issues in detail could certainly have a detrimental effect on her career prospects, couldn't it.

It doesn't matter whether the OP's colleagues were probably aware. It just shouldn't have happened.

This sort of data breach is one of the most common.

You should report it, because a law has been broken and they need consequences to make them be less casual about it. They will probably get a slap on the wrist at worst but it might make them a bit more careful in future.

If someone at my work did this, failed to report it to the DPO and tried to make it go away by sending an email like the follow up one, it would be treated as a disciplinary matter purely because they failed to report it properly.

God, MN is the worst source of employment advice on earth. Are you all trying to get the OP sacked?

The OP is perceived to be under-performing at work. How can she make her situation worse? I know! Why doesn't she report her employer to the ICO? That will definitely help

There is nothing to prevent an employer sharing data about employees' performance (unless doing so also breached anti-discrimination law etc). Many sales-based companies share everyone's performance data on a daily/weekly basis to incentivise them. Hospitals share surgeons' complication rates to identify outliers. The OP's performance was already being shared with managers. All that has happened is that the distribution list was wider than usual. Very upsetting for the OP, but not a matter for the ICO.

This isn't the sharing of sales figures though, it detailed the employees on a performance plan or who were underperforming. Not celebrating the high earners, just highlighting the staff underperforming to the rest of the workforce.

This isn't the sharing of sales figures though, it detailed the employees on a performance plan or who were underperforming. Not celebrating the high earners, just highlighting the staff underperforming to the rest of the workforce

I agree that some of the other staff who have "generated other cause for concern" (in the OP's description) might have legitimate grounds for complaint about data breach - depending on what those concerns are. But the OP says that, in her case, it was her performance figures.

More importantly though, if you want to keep a job in which there is apparently objective evidence of your under-performance, it is very unwise to report your employer to the ICO. I think most MNetters must work in the public sector, where it is difficult to get sacked (I don't mean that as a criticism of the public sector - employment rights are a good thing). But I am guessing the OP doesn't. The last thing she should be doing if she wants to keep the job is pissing her employer off.

Not meeting performance targets does not make someone lazy

I would speak to HR and do a shit sandwich.

You realise you weren't performing to standards expected by the company.
You have worked hard and made x y and z improvements as you want to be effective.
You are not happy with the fact this data has been shared to all employees.

Don’t report it - it will make matters worse. But keep a note of if because if they dismiss you it would be good ammo for an employment lawyer.

I dont blame you for feeling mortified. Try and put it behind you and if anyone says anything just casually say that you had been asked to speed up and you have done so.

At least you're not the person who made the mistake of emailing everyone the confidential email. Wouldn't want to be in his/her shoes.