DD employer keeping notes at home

[ilovemydogandmrobama2]

DD1 (18) has just started a new job - summer job for multi national, hoping to get work experience, hopefully reference.

She arrived late for her shift last week. She had a puncture in her bike tyre, so took bus, but she arrived late. She texted at the time. No one had to wait to go home because she was late.

Had a meeting with her manager who said he kept a, 'journal,' of employees with names and dates but kept at home.

I think this is in breach of GDPR and illegal?

Impossible to tell from the info here.
He is entitled to keep information concerning his employees as long as it is stored and used legally.
Keeping the info at his house is not an issue per se, I WFH and have lots of confidential information here on clients and various other people connected to my work

a journal of what?
employees names?
there’s no GDPR breach around that

What do you think is illegal?

I think this is in breach of GDPR and illegal?

Why?

What makes you think that?

Because the manager does not work from home, and if there are any issues it should be logged on the internal HR system, rather than a notebook kept at home.

It isnt illegal. Yes maybe it should be logged on some system. But its not illegal.

Don't be ridiculous. Now if he posted the contents on mumsnet for everyone to see then it would be a breach.

Uh, I asked a question. How is this being ridiculous?

But thanks for advice

It is not wrong that they are doing it, as long as there is also a record at work

Good point. Thank you.

GDPR breach with a persons’ personal notebook. Heard it all now.

Thank you for your sarcasm. Hope you feel superior in your knowledge of GDPR.

It can be a breach if such a notebook is then left in an location that's not secure eg not locked in a desk or in a secure bag and can be accessed by someone who wouldn't normally have that info. It's a very common cause of data breaches for notebooks to be left on buses/trains/clients houses etc.

Privacy professorial here. A few things spring to mind.

Firstly, in keeping the notebook, the manager is clearly processing personal data. That being the case the data controller (the employer) requires a lawful basis under article 6 UKGDPR to process the data. It’s not obvious to me why the use of a personal notebook would be something that is required in this context. Assuming it is a company with normal systems I would assume this kind of processing to be done on a centralised HR system and not via a private notebook. If it’s a very small employer, that might be different.

Secondly, the data controller is required by article 32UK GDPR to process personal data securely using appropriate technical and organisational measures. I question whether the use of a notebook at home will achieve this. Again, this may depend on the size and nature of the employer.

So, yes, it does seem this might be potentially problematic from a privacy perspective. However, it is impossible to say without more details of the organisation

Assuming the employer is large enough to have a data protection officer then this could be something to raise with them. However your DD should judge whether that is a prudent thing to do in light of her relationship with her manager and the organisation more generally