Manager told team about my health issue

[LaLobita]

Not sure what to think about this.

I have PMDD and last week it triggered a mental health crisis. I had to take a few days off and seek medical attention. Normally I work through it but it was not something possible this month. It was my first time in a year in the role where I have had to take time off due to it.

So anyway I’ve returned to work and it emerges that my boss has told my whole team (9 people) that I had a nervous breakdown. I can’t help feeling that this is invading my privacy? Not sure if I’m overreacting here but I already feel quite vulnerable due to last week and now I feel embarrassed that all my team know from a third party about my mental health issues.

I agree with others - pursue him and don't let this go

"out of action until she sorts herself out" absolute cunt

Is verbal information part of GDPR?
If colleague A tells me in spoken words that they have gonnorhea, I don't manage them, do I breach GDPR by telling (in spoken words) collague B about colleague A's infection?

I didn't think purely spoken information came under GDPR.

@lljkk I don't know GDPR inside out but it's definitely a breach of confidentiality.

This is a clear breach of that whether verbal or written.

Colleague-to-colleague is different because it would be elective information. In this case, the person had to report their sickness and reason in order to take the leave they needed, and it should have been confidential. If a colleague tells you voluntarily, you just need to apply judgment to the situation, and if in doubt ask. Here, it was very obviously confidential and disclosing it was a breach.

I understand the confidentiality position.

I was wondering about GDPR. I was under impression it applies to digital info only. Not simple paper records, and not verbal information.

Your example is gossip, so definitely not covered.

OP didn't say how she communicated with her manager.
If OP told her manager by phone call or maybe even also direct email, then although manager may have breached confidentiality, it's not clear to me that manager breached GDPR. I don't think that info in an email main body text message counts as 'data' or OP as 'data subject'.

Glad to be corrected. Otherwise, I think if I were OP, I would feel more confident knowing exactly on what grounds I was making a solid complaint.

It applies to paper/written.

But if you read someone's medical records out to the wrong person - that is a breach of the written record.

Health data is special category data - you can't just pass it on verbally to anyone you fancy.

In an email it definitely counts as data.

Absolutely personal information or special category data such as medical diagnoses in the body of an email if it goes to someone it shouldn't do that's a data breach. It's exactly the same if you say it verbally. These are some of the most common data breaches that are reported and can also be some of the most serious. Its not about the format by which it's conveyed it's the nature of the information itself.

It's really concerning how little people know about data breaches. If there's a communication of personal data or special category data by whatever means to someone it shouldn't go to that's a data breach. The format is irrelevant.

Yanbu. And it's definitely a data breach. And almost certainly a breach of a lot of other policies too

My manager told the team about my pregnancy when I was only 8 weeks (I was very sick so was off work). I wish I had reported her. Because she subsequently did similar things to other people

Yanbu. X

This is beyond awful. Disclosing it to the team is bad enough but the language he has used is just horrendous in this day and age. As others have said, make a copy of this and contact your HR team as soon as you can. Raise it formally - even if you don’t want to stay (completely understandable) as far as you can see that this arsehole is taken to task

Something I've always wondered is this scenario:

Suppose I work for company A.

Jo Blow (my contact at Company B) emails me asking for some info.

At the bottom of Jo's email, part of her signature seemingly, is a statement about her disability, saying she may be slow to reply to emails because of it.

At this point I forward Jo's email to my colleague Sally because Sally has the info Jo wanted. I ask Sally to let Jo know the answer ASAP.

Have I just violated GDPR, because who said I had Jo's permission to share Jo's health condition with Sally? In fact, who said I had Jo's permission to even let Sally know what Jo's email address is. What if Jo mentioned her phone number in her message so I could contact Jo sooner with the info, am I violating GDPR not to ask Jo's permission about that.

This

@lljkk None of that is breaching GDPR. That's all just straightforward information sharing. You can share information!

It's just about relevance, sensitivity and so forth. Like, I work in finance so I know everyone's pay because I need to work with that information for the accounts. I will share salary information with heads of department because that is relevant for them and their budgeting. But if someone in my team who does not work with payroll data accessed and used this information for some reason (which is password protected etc), that's a GDPR breach, as it would be if I shared this information with anyone for whom it's not relevant.

Is it straightforward info sharing, though?

Suppose I know that Jo is keen on getting the info from my company because Jo is going on maternity leave soon. Which I know because Jo told me in some way, suppose it's exactly same method OP used. Instead of introducing Jo to Sally, I email Sally and say "Please can you get in touch with Jo ASAP because Jo is going on maternity leave soon. She has a C-section scheduled to have the baby next week. Isn't that exciting!"

Have I therefore violated GDPR because I gave "health data is special category" info about Jo to Sally ? Is simply telling Sally that Jo is pregnant, also "health data that is special category" ?

fwiw, I heard "Amy" at work has terminal cancer, very sad. I was told this by "Beth" in a TEAMS call, 1-to-1. Was that a GDPR breach? I then texted a mutual colleague about the sad news. Was the text a GDPR breach? Why not, when you could hardly think of a more especially sensitive datum than a terminal illness?

Clarify on why the Jo & Sally or Amy & Beth situations are not same as OP's situation, please.

No. Obviously. Because Jo has chosen to publish her own information in that way and there is no GDPR relationship between the two of you.

Definite GDPR breach if information was given confidentially. Yes the team need to know you are off sick but that is all.

grievance should be raised with HR, especially if it is recorded. If in doubt phone ACAS.

Terrible breach of confidentiality and duty of care. And he's recorded himself doing it, absolute idiot.
Also did you use the term "nervous breakdown" when you contacted him? Because if you didn't then he has "diagnosed" you!!
Definitely complain about this to HR and your boss's boss.

Show HR the recording, that's a disgraceful abuse of trust and his position
Good luck! IMO he should be getting a warning at the very least

Get a recording of it - even videoing from the screen from your phone - in case it disappears.

Do not just let this go this is a huge breach of trust and confidence, a massive breach of GDPR and the sales commission is fraud, all of which your manager should be sacked for!!

do not let hr brush it over. Place it in writing and go through a formal grievance procedure x

I don't know what you think a "GDPR relationship" is. GDPR does apply in this situation.

@lljkk You don't need Jo's explicit permission to forward the email. Depending on the situation, you can either rely on contract (you need to do this in order to fulfil a contract with Jo's company) or legitimate business interests. The health data is classed as special category data, so you need to meet one of 9 additional conditions, but you are ok to forward that because Jo has chosen to make it public by putting it in her email signature.

I’m going through something similar and it’s the fucking HR manager. Couldn’t make this up if you tried. I’m writing it all down and printing my evidence.