How much trouble are these people in?

[basilbr]

Workplace scenario below

Person A sends Person B a document with sensitive employee information relating to colleagues.

Person B tells Person A they shouldn’t view documents like that. Person B deletes the document without ever opening it.

Person B looks to see where the document came from on an internal system but does not open it. Person B did not report Person A.

Company is now treating the matter as a data breach.

Is it only Person A who is in trouble?

Did Person A just send the document in human error? Or to gossip?

Potentially person B could be in trouble as well. It depends on what the data was as to how serious but person B should have reported the breach immediately. The company only has Bs word for it the document wasn't opened but was deleted. I would say if person B had reported the breach they would be more believable in this regard, as they didn't it looks suspicious. It would help massively if person B had it in writing to person A that they shouldn't view it but if it was verbal only there's no evidence that what person B is saying is what actually happened.

Also, it is a data breach whether the information was read or not as it was sent electronically. If I had to guess from what you've said, both person A and B will probably be looking at disciplinary action.

Person A will be in more trouble but it will depend on B's role, if managerial it would be fully expected you'd report it. What was the nature of the info and why was it sent? A mistake is very different to look how much John earns, he's shit and doesn't deserve that salary. Both should expect some kind of disciplinary action

ETA this sounds like a scenario on the annual data security and compliance training

Both in trouble, person B should have reported the breach.

Not necessarily, all employees have a duty to report data breaches and person B clearly knew it was not something they should have access to. The fact person B went looking for the source of the information, which could probably be traced by IT, it doesn't look good 🤷‍♀️

I think B might have a fight on their hands, especially as they looked for the source of the information. Would you believe someone was invested enough to leave a trail of them looking further, but hadn't opened the file, which may have contained the information anyway?

Company have proof that B did not open or view the file.

B might have looked because they expected the document would be in a folder not accessible by themselves nor A.

But assuming B found the document in a folder , B should have informed whoever owned the folder that documents were visible.

Except of course B would have to explain why they were looking and that would mean B explaining that A had sent it.

A and B might be best mates, DH and DW, hoping for promotion and so on.

How did the company find out?

B should have reported it

B had a duty to report the breach, which they did not act upon.

So both responsible but presumably the sanctions will be appropriate to each person's actions.

A similar situation i know of Person B ended up on a disciplinary and ended up with a final written warning because they knew they should have reported the breach.

What training have you had in data protection?

Have you checked the policy? How could they have proof it wasn't opened? Genuinely curious.

B should have reported it. As a PP says, this would be included in compliance training. It's not enough to ignore the information.

B should have reported it. If B (you I assume) is an otherwise exemplary employee they may get away with it.

I wouldn't want to be in A's shoes, assuming it was sent as gossip and not in error.

B should have reported, but a 'lesser' offence than A's sending of the doc.

Why did person B go looking for it, not open it and not report it?

Not enough information.

Is A normally allowed to view such confidential information?
Is B normally allowed to see it?
Why did A access it and send it to B - by accident or deliberately?
Did B know why A had sent it to them?
Why didn't B open it?
If B deleted it unread and didn't report it, how come there is now an investigation?

What is the data breach? A accessing the information, A sending it to B, B not reporting it, or that B then tried to find out where it came from?

In our organisation, a local authority, A is the one who ‘committed’ the data breach, B did the right thing by deleting it and informing the person who sent it, and A should have been the one to report the breach. B wouldn’t be in trouble.

Is it in writing that the second person made their feelings plain?

How much time elapsed before it was all found out?