My sickness files shared with team member

[glassof]

As title, i have recently had some time off due to an injury. my manager sent all HR emails between myself, manager, HR (including sick notes, emails about why I was off, return to work meetings, everything to do with me being off work) to another member of the team. This was done by accident as she was emailing the team member about their sickness.

She recalled the email but the team member had already opened it. Team member has contacted me to say that it happened.

I've seen manager twice since it happened, nothing has been mentioned. She doesn't know that I know. Although she may have an idea (we are a close knit group)

What should she be doing? Do I need yo be notified? Manager tends to be by the book so think she would have raised an incident.
I'd like to also add, whilst I am annoyed, I know it was an accident and I like my manager, I just want to make sure it's handled properly and doesn't happen again.

We were all recently sent someone's job application ( extrenal ) by an HR worker by mistake and were just told not to look at it !! My manager also regularly tells us what everyone else is off sick with. I'm amazed she has not been reported by now.

Regardless of what the process is and what has happened upto this point. What would you like to happen now?

Where I work this would have to be disclosed by the person who sent the email. It’s a huge data breach of incredibly sensitive data. It would also trigger a self declaration by the business, to the ICO and there are strict timescales to do that.

sounds like carelessness not maliciously done, but it’d be final written warning territory for the person who sent it.

Im sorry this happened to you

My mother was in mental health hospital. Two staff were discussing her medication and another service user overhead. We, as DM's relatives, were called into a meeting to explain the data breach and that it was inadvertent and that it had been reported.

It really should be taken seriously and acted on. It's possible that your manager thought the recall was effective though, unless your colleague has actually told her that she read the email?

I think I would like it acknowledged and reported. I don't want my manager to get a a final warning or anything but I want to know it won't happen again

Absolutely report it, that’s appalling your medical history has been broadcast to other members of staff.

This. A GDPR breech must be reported. You should have been notified immediately. Your manager owes you an apology.

This would be gross misconduct in the company I work for.
We had two secretaries dismissed for emailing incorrect people sensitive info.
Both cleared their desks and left immediately after their meetings.
Once you escalate this it will be out of your hands.

the trying to get away with it is possibly even worse than the initial breach.

The first was a mistake - yes it shouldn't have happened and could have been quite bad if there had been confidential info in there, but as you are not that upset and you get on well, if she'd reported it asap and apologised it probably wouldn't have gone any further - maybe an informal warning or refresher training.

But knowing she's fd up and trying to hide it is deliberate, which is particularly bad in a manager who is supposed to lead by example. How can she expect her team to be honest with her and take responsibility if she doesn't?

The one thing we are told again and again in work, particularly in relation to any sort of IT/DP fail etc. is the first thing you must do is tell someone.