Colleagues used my details to find the deeds on my house. Data breech

[ThisJadeLeader]

I recently quit my job, toxic work place I had worked there for 7 plus years. It didn’t go down very well with my manager or rest of team.
I worked in a small HR team so we had access to everyone’s details.
i stupidly left some private information in a private file on my desktop which has been accessed by IT and my old boss.
The document was a mock tenancy agreement for my house.
When I moved into my house a few years ago I just said we had bought it as it was a new build and I couldn’t be bothered explaining someone had bought it on our behalf and we would be renting from him (non of their business)
Since then my old manager told me she knows I don’t own my house as the HR team done a search and the deeds weren’t in our name!!!
Isnt this a GDPR breach that they have accessed my address purely to do a private search which is nothing to do with work? I get the deeds are public records (which you have to pay for so I just find it so weird) but they would need to get my address from my HR file to perform the search in the first place??

Anything you left on the work systems is a difficult one, there is no real right to privacy (eg if a DSAR came in it could be subject to review and potential disclosure / redacted disclosure). This still isn’t an appropriate use of any such data though and I would definitely be challenging it. Is there any other way they could have accessed your address if challenged? For instance electoral register? I mean, I doubt that’s how they got it but they could claim it was the case. Have you put in a Data Subject Access Request? You need one covering these people, anyone they communicated with, and covering all workplace devices (eg phones) including apps therein (eg WhatsApp if it’s a work device is fair game for a DSAR).

Then if it shows them doing this search on work systems, plus any comms regarding it, you can challenge this. Is there a potential tribunal case linked to your being bullied out?

I’m no longer up to date on the latest around this but used to deal with it a lot!

Everyone knows where I live so it wouldn’t be hard to know my address, I just find it odd that a group of adult women would go to this length. I feel it’s a. Witch hunt.
I use to be apart of it which is why I know the conversations that would have taken place.
Im HR trained and even I’m unsure on the legalities behind it. I’m just more shocked than anything. I suppose moral of the story is don’t tell lies 😂

In my most recent job, anything we put on our workplace systems (PC, laptop etc) could be accessed by others and was not considered private as such, we signed an agreement stating as much.
Therefore, any personal files left on the system would have been checked before deletion. I do think if you didn't want this information to be accessed by anyone you should have made sure you'd deleted it.

However, that doesn't excuse them doing a search, but I'm not sure how this would be classed legally. That's because deeds are public records and they could have (for whatever weird reason) decided to do a search on you without even seeing any file you left on a computer.

If you've now left, does it matter that much? They were a toxic workplace and you've left them behind, does it matter if they know whether you are renting or own your own home? They're probably only doing it to still "get at you" even though you've gone, don't let them and just move forward.

If they could have easily have known your address and the deeds are on a public register, I wouldn’t think making a case out of it would be worth the trouble.

Personally I think the best response would be to tell the old manager that although she may think she knows what she is talking about, she is not as fully informed as she likes to believe. Either way, it’s still none of her business and it’s weird she’s taken it upon herself to look into it.

Then blocks and move on. Who cares what a bunch of toxic idiots think.

Thanks guys.

I’m defo better out of there! Onwards and upwards.
I suppose I just wanted to vent and get other peoples opinions on how weird it is to go to that length 😂

They are mad to look it up, mad to care, mad to confront you over it. You are well out of it.
How did it come to be that you had to declare whether you own or rent, casual conversation or some kind of financial background checks? Anyway what can they do, sack you?

Why does it even matter to them? Very weird they would go to the effort and does suggest bullying as what did they hope to achieve.

Not HR or a legal person, but I would have thought any breach in this situation would centre on the discussion of your private information rather than the fact that the company as an entity knows or has found out your situation. I'd be curious to know who did the land registry search and if they did it using company resources (i.e. who paid the fee), whether they did it in an official capacity (or if they pretended to), and whether those with information about you gained only through their work role (e.g. the IT person and potentially whoever did the search) then discussed it with others as gossip rather than for any professionally justifiable reason.

Once you have that information, an HR lawyer could probably advise if any law has been broken. It seems like a lot of bother to go to just to wipe the smile off the face of people you'll never see again anyway, though I can see the attraction if they were complete arseholes.

Your old manager, and the rest involved in this, are clearly quite bonkers (and bullying). As for your resignation "not going down very well", they seem to have forgotten it's a workplace not a relationship. Well done on leaving.
Have you responded to your ex manager?

we moved 4 years ago and I just said in passing we had bought a new house, never mentioned it again. So no no background checks etc.
just very nosey bitchy ex colleagues

People move on but they all seem to have taken it personally. It was such a toxic environment I needed out. Yes I said to her why would you go to the effort and her response was its public information. Just very bizzare

They 100% done it through gossiping not anything work related.
im just glad to be out of it tbh

There may not be a data breach but you may have a claim for constructive dismissal, as your boss doing this is a sign of bullying and harassment. I suggest you speak to ACAS in the morning.

I'm not an expert, however I have touched on GDPR and HR compliance in a previous role and I would say that you're correct, your data has been misused in this instance.

Data is generally collected on a "legitimate interest" basis and from an HR perspective, the legitimate interest is the running of the business, safety, performance, communication, payment, etc. There is no "legitimate interest" for the business, especially once you've left, to perform a deeds search relating to property. This would constitute a breach because they have used your data improperly (in this instance, shared with a third party without a good business reason) without permission.

Do you recall signing any documentation setting out how your data would be processed (this is standard good practice and would be worth referring to if you have the document)?

As someone said, get on to ACAS in the morning but also the Information Commissioner office. Assuming you are not depending on a reference from them! Bullies should be stood up to, no matter how pointless their bullying.

If I were you I might not actually do it but I might respond (definitely not in writing) to say that I was going to write to the data controller within the company to report a data breach. Just to worry them a bit.
However, thinking further along the line I might feel that I’d just let it go especially if you have a lifetime of working/changing jobs/needing references from previous employers ahead of you because as time goes on the bullying etc will fade into the past, maybe not for you, and so it might be best to celebrate the win of leaving that environment and move on to other things

Good point, I meant to include ICO info in my previous post!

OP, you can make a complaint to the information commissions office:

https://ico.org.uk/make-a-complaint/data-protection-complaints/

However, be aware that you will first need to submit a complaint to the company itself, also that the ICO cannot award compensation to an individual - you would need to personally take legal action for that.

In your shoes I'd consider submitting an official HR grievance complaint to the company, which they would have a duty to investigate in line with their policy. I'd make sure to outline not only the data breach but also the toxic/bullying work environment.

Given they know where you live it would be a waste of time trying to claim a data breach etc. Actually unbelievable they’d go to these lengths and actually tell you they had. None of their business. You are so fortunate to be out of their, i’d tell the old boss she’s out of order, and block her

It sounds like a poor use of the company's resources to dig around after you. Do these guys have higher up line managers in HR? If so I'd be inclined to forward the message onto them, potentially making a GDPR enquiry around appropriate use of your personal data. I suspect they'd be alarmed how the team were using their time and also of a potential GDPR breach.

FYI I work in another department handling data so have done a lot of training around GDPR. They'd need your consent and a legitimate reason to retain and store it your personal data.

It is a breach of GDPR private information stored should only be used for it's intended, specified purpose. I don't think they could argue they stored your address to search the deeds on your house. Accessing your address for a reason that has nothing to do with your employment is a definite breach of GDPR. These rules were updated a few years ago now.
I would kindly let them know this is a breach and you plan to take it further.... Even if you don't. Let them panic :)

While they have found this by accident and have been bitchy at work, why is someone you used to
work with bringing this to you after you have left?
Where and how you live is nobody else’s business unless you are a criminal.
I know you might have legal case here but I would leave them it.
Do they drive by in secret to check out your curtains?!
And they all work in HR. The irony….

Yes it is a GDPR breach.

I wonder if they're worried you're going to pursue a case for constructive dismissal and want to make sure you're discredited first. Although all they've actually done is demonstrated even further why they are utterly toxic.

Fortunately you can now block them all and leave them to rant and rave about how terrible it is that you misled them slightly about something which has got absolutely nothing to do with them, and absolutely nothing to do with work. This will allow them to ignore their nagging suspicion that actually maybe they're dreadful.

I think I'd have to say something like 'I've had legal advice and it's better if we don't speak directly for now' before blocking your manager, just to fully put the shits up them.