would you report this potential GDPR breach?

[hogletsandkittens]

colleague dispute between colleague 1 and colleague 2.

I am not involved.

C1 raised and issue about C2 with HR. C2 is worried and went on a search through C1's inbox hoping to find emails about it (they have access to each others email as they cover each other during AL). C2 digs deep, finds emails marked as private and confidential between HR and C1 and opened them. She told me all this whilst bitching about the content.

Would you report this to HR or stay out? C1 has no idea. I don't want to be dragged into it but worry I will end up in trouble if it comes to light and that I kept quiet.

I have had a good relationship with both but appalled by C1's action. I try to stay out if these sort if things. Thoughts?

Absolutely report it! How would you want to deal with it if she'd done it to you?

Hmm, thats a bit tricky and depends on what your email policies etc are. Technically if it is a work email address and they have access to each others emails then colleague 2 hasn't done anything wrong unless it is covered in the policy.

We have access to each others emails at work during annual leave etc and I would never use my work email address for anything personal like that. It is made clear these are work email addresses that belong to the company.

Well, the email was from HR to C1 clearly marked as private and confidential. C2 searched for it and by their own admission stated it was fairly well hidden. It's not an email someone stumbled across by accident. It was a search, then if was opened despite being marked as P&C and then they read it.

I has recent issues at work and I am honest, I worry I will be in trouble if it comes out I knew but they I don't want anyone to know it was me. Things are very difficult at work and I'm just trying to keep my head down and get on.

Agree if was stupid to use the company email address by C1 but it doesn't justify what C2 did.

They have access to each others emails for a specific purpose. This was not that purpose and was a terrible thing to do.
Absolutely report it.

Yes report it

Report to HR what C2 has told you.

just bitching about C1 and when I asked her how they know all of that, they said they looked through the email folders and found the HR correspondence and all the info was in there.

Yes you’ll have to report it so that HR can advise C1 to use her personal email from now on. Don’t get involved personally by going to C1 etc., just go through correct channels and say no more to anyone.

I would maybe contact HR and point out to them that you have discovered a potential breach of private and confidential information, which could happen if HR emails a particular staff member via an inbox shared with one or more other people. If they ask why you are reporting it, just say that you think it may already have happened and you are concerned about it, but don't have specifics.

Report it. C1 and c2 should not be sharing emails, they can have their own where relevant info can be sent to both . Not sure why you're appalled at c1 actions though,

Hi moms I had an interview for NHS band 4 position and I was not successful now I have another one coming up in a week. They asked me about pathways for New comers? I could not find the answer for this. I am worried they will ask this again. A prioritization scenario where a consultant calls in sick, a room not available for a clinic, 1 to t with line manager and a tracking meeting

@WIJE1990 You need to start your own thread.

D

Ugh won’t let me edit.

do you have a whistle blowing or anonymous reporting facility like Safe call? Reading and discussing private emails is a breach of privacy rights and freedom, they may have access to each other’s emails but they don’t have the right to disclose private information

Discussing it with you is a breach as well as c2 opening private and confidential emails

Their emails should be private and personal,for the very reason they could be having confidential discussions with HR or others.. If there are things they need to share, there should be a group mailbox or distro, rather than access to each other's mailboxes.

C2 may be worried but does she not understand how totally out of order she has been, going looking for this content? That alone would be grounds for a disciplinary at places I've been, regardless of whatever is already in discussion about C1 and C2.

I think you should raise it. It could have a bearing on the initial on-going discussions, but it could possibly come back on you if it later comes out that you knew and said nothing. OTOH, it could just count as hearsay. I would approach it from the technical, privacy side - "C2 said she'd been looking through C1's mail - I was surprised they don't have a group mail for things that need to be shared, rather than risking access to confidential, personal mails. I think we should set that up, and also offer some extra training on privacy and confidentiality."

I don't know. In my role in IT, I've sometimes had to access personal accounts, but I've always known that I must do no more than check and test whatever access/account issue is being investigated, and absolutely I could not search through emails. A lot of it is tracked and audited if anyone had suspicions about improper use, though it wouldn't show if C1 knew C2's passwords or made the most C2 leaving a logged on screen unattended.