Colleagues used my details to find the deeds on my house. Data breech

[ThisJadeLeader]

I recently quit my job, toxic work place I had worked there for 7 plus years. It didn’t go down very well with my manager or rest of team.
I worked in a small HR team so we had access to everyone’s details.
i stupidly left some private information in a private file on my desktop which has been accessed by IT and my old boss.
The document was a mock tenancy agreement for my house.
When I moved into my house a few years ago I just said we had bought it as it was a new build and I couldn’t be bothered explaining someone had bought it on our behalf and we would be renting from him (non of their business)
Since then my old manager told me she knows I don’t own my house as the HR team done a search and the deeds weren’t in our name!!!
Isnt this a GDPR breach that they have accessed my address purely to do a private search which is nothing to do with work? I get the deeds are public records (which you have to pay for so I just find it so weird) but they would need to get my address from my HR file to perform the search in the first place??

Absolutely a data breach. They’ve used her personal data, although accessed legitimately in the day to day scope of work, and then used that to do a search that is nothing to do with their work duties. Coming across personal data by accident doesn’t give staff the right to do whatever they want with it. I assume all staff have signed the data protection policy. It applies however they got the data.

The question you’ve got to ask yourself over and over as a data handler is ‘why am I accessing or using this data?’. If it’s not a legitimate business reason then you are likely to be in breach of legislation.

OP this is mental. Why the fuck are they searching for the deeds on your house?? I work in HR. If my manager did a search on the deeds on my house this would be a data breach. There’s absolutely no reason for the search. Arguing that they’ve got the data elsewhere - why though? Why do it as a team? Why are they searching out any personal information relating to former staff members , that is not directly required for their work?

I’ve noticed that a colleague lives in my old house. I’m not going to mention it though unless it comes up because that would be an inappropriate use of their personal data. It’s nothing to do with why I had their address open. I’m certainly not going to start googling whether they own it.

Report to the data protection officer there and make them aware you will be logging a complaint with the ICO. If they’ve done it as a team in work time on work equipment this is easily traceable and then the IT policy has most likely been breached too. They are looking at gross misconduct. Can’t believe an HR team has been so stupid.

Edit - saw your update that it’s a small company. I would still let the MD know as it’s his money that would pay any fine!

Office politics at its best. It's all very playground nonsense. Can you just block them and move on?

So, the same people who forced the OP to leave her job because she didn't want to illegally fix the results of a redundancy consultation are so concerned about respect for the law that they bought copies of the deeds to the house she lives in to find out whether she might be committing benefit fraud?

Are you quite alright?

I'd just forget about it. You left personal imformation on a work system which led to them believing you had been untruthful. They delved (very unprofessional) and proved that you had been untruthful.
Not your best moment or theirs either I'm afraid.

Absolutely this. ^
Utterly bonkers behaviour from them!
As others have said, you're definitely well out of it OP. Onwards and upwards.

Personally, I don't think I'd pursue it any further. They don't deserve any more of your brain space or time. I'd leave it to the universe to sort out. Ideally in the form of a full week of gushing diarrhea.

How bizarre. As per pp, I think I’d put something very clipped and formal in an email to say that you are disappointed that they felt the need(?) to do that, and that their actions are starting to feel like harassment. I’d explicitly ask them to stop and say that if they fail to do so you will take legal advice.

Well any OP could be lying about anything.

But there isn't really an "other side" to "I left because they wanted me to illegally fix the results of a redundancy consultation and then they bought a copy of the deeds to the house I live in to prove that I don't own it".

Bitchy, spiteful and weird. Were they the girl in the playground who sneered at other girls' shoes?

I'd send a message to their line manager detailing what their team members did, and advising they need to pick up on this behaviour before it gets out of hand.

Poor team behaviour reflects badly on manager and organisation.

This is exactly the thought I had after OP's update. And potentially is much more serious than a simple data breach.

I thought originally that OP should just let this go but if these are the lengths the company would go to to discredit someone, they must have the serious shits up them about the issue she resigned over. The case for constructive dismissal seems stronger to me, and if the weird message from the HR manager can be evidenced as an attempt to blackmail her into silence, it might even be a criminal matter.

It makes more sense of their actions to view it this way.

I'm not convinced its a breach but maybe the information commissioner could help you. They have a chat function.

I could look up someone's house sale If I knew their address see when it sold and for how much and done the deed check like they did its all public information. I guess how they got your address is the question.

They just sound like a bunch of nosey bitches I'd try to move on from them tbh

Even if you do nothing about it OP, at least you can be absolutely sure that you did the right thing by leaving.

What an odd thing for them to do

Complete misuse of your data.
Would they like this to be done to.them.
I'd report this to Senior management.

This is so incredibly weird.
They hold your address as you are an employee, even though that is personal data.
And all Land Registry deeds are publicly accessible.
But it's the misuse of the held address that is potentially GDPR breach, as they would need to utilise the address held to know which LR record to search for.

The real issue to understanding is there has been misuse is WHY. I'm racking my brains to think of why an employer/colleague would have a valid work related reason to use your data like that. It sounds like your colleague just wanted to taunt you which doesn't sound valid at all.

Do you work for a high security organisation like GCHQ or police where the employer is expected to scrutinise your background and finances? (I think it's because people with debt problems are more susceptible to bribery etc. )
Or as PP says possibly an investigation to discredit your honesty in case you claim constructive dismissal.

Yeah as others have said this is a GDPR breach in that they have accessed your employee record to get your address outside of a legitimate reason. Personal data should be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes”. So I’d say accessing an employee’s personnel file to look up their address to then do a land registry search to prove they don’t own their house is a pretty clear breach of gdpr as that is not a legitimate data processing reason.

That’s absolutely appalling behaviour and they sound like nasty people. Sorry I have no advice on your legal situation but you have my sympathy. I’ve heard some real horror stories about HR departments from friends and family in recent years. I thought their job was to support employees but there seems to be a particular breed of HR people that think their job is to control and bully everyone.

Yes it's a massive GDPR breach. You need to seek legal advice and report it to security who work there.

Are you in the UK? If so then the details of your house can be obtained from the land registry for £3. If anyone knows your address then they don’t need to have accessed your work records.
Move on and try to put this unfortunate period behind you. There are better places to work than this toxic environment.

You should have said that lots of things are public information, but normal people don't go hunting them down just to be nosey!

I agree with this. I'd definitely report it to higher up in the company.. presumably they did look up in company time and it should be seen as a very bad use of co time and resources. Did your ex-manager need to contact you or was that also on her own initiative and wasting/stealing more company time🤔. Thank goodness you've left.

I knew one situation where the HR's husband was an old Facebook friend of an employee (they'd known each other years before the employee joined the company- 10 or 15yrs, I think) and the HR used the husband's account to trawl through their online life-- and even mentioned / confronted the employee about something they'd written.

There are some mind bogglingly bored/ creepy / unpleasant ones.

You say everyone already knew where you live, and one of the staff looked up the property on the land registry and discovered it was owned by someone else.How is that possibly a data breach?

Anyone can look at people's house deeds. You just have to apply through the land registry. Don't even have to know the person's name, just their address. We've been trying to sort out some land ownership near us, and that's what we did. Also, we were looking at septic tank sewage and where it went. My neighbour looked at ours, and we didn't feel she shouldn't have. It was stuff all the houses in our small settlement needed to know.

We all know it is publicly available. How would her colleagues know her address though without retaining and accessing her personal data for this non-legit use?