Protecting my personal info/data at work

[wheretogetit]

HR Experts in the House – Advice Needed

I recently asked HR to ensure that my personal information — name, address, and other sensitive details — is not visible to a new manager. I am a victim of a serious crime and take my privacy very seriously, making every effort to shield my data wherever possible.

Initially, HR said it wasn’t possible. I explained my situation again, emphasizing safety concerns, and they have since relocated us for safety reasons. I haven’t disclosed that the relocation is temporary, but I want to know: is it feasible to fully restrict access to your personal data from certain managers in the workplace?

I’d really appreciate any insights or guidance from HR professionals or anyone who has navigated similar situations.

also, is it possible to use a PO Box address at work? I want to update my address to a PO Box address. Or does it have to be the exact address one actually resides?

If they can't restrict it then they should not be asking for the information. Personal information can only be used for the purpose it was collected for and that you consented to. The onus is on the data controller to ensure that it is not being used for another purpose. Eg HR need it to run initial identity checks and send your pay slip /P60/P45 to. It cannot be used to satisfy the curiosity of your boss or their boss if you have not consented to it.

Report it to the Information Commissioner's Office as it is a clear breech of GDPR (UK) laws.

And what other info held on employee records is being shared?

Hi OP, there’s no reason why you can’t use a PO Box as your regular address. I’ve known of several colleagues in London over the years who have done this for various reasons. One was from NZ who lived in the UK for approx 5 years. She moved house fairly regularly (rental) so the one thing she wanted was a stable address to be contacted at. Apparently, this is not unusual for people to do when living in rental properties.

In these days with GDPR and your particular circumstances there should be no reason why HR can’t accommodate your request.

I do wonder if part of the reason you’re hitting issues is that you're asking for things to be hidden from a single individual. That’s generally not possible to on these systems without revoking that persons access to all data of that type for all staff. Which is quite probably why you’re being told no.

Whereas if you approach it from the angle of ‘my address needs to be kept secret, for personal safety reasons after being a victim of crime’ then it’s a slightly different question that you’re posing. You can then say that you will be using a PO Box for all correspondence going forward. If there’s a specific reason that your home address is needed, then you’re happy to provide it as long as is not generally available on the HR system.

And should you need to provide fit notes, you can provide a copy with the address redacted.

There’s a requirement on GDPR to keep data up to date, so it’s ‘right’ for them to chase corrections if things appear wrong. But a PO Box won’t be wrong, just different.

Thanks all

iam beginning it to stress about it because I don’t know why they are making a big deal out of it all.

I have a royalmail redirection on the address to my PO Box so that I don’t miss or loss important letters estc I wanted it for 3 months to make sure and give me time to change address on bills etc but can keep it for longer

@Suednymph good idea but knowing my micromanager’s manager would probably start digging and maybe even go knocking on the door of that address or start asking that I proof it - I am not exaggerating on how toxic the place is.

my mistake was mentioning that I was moving in the 1st place 🙄🤦🏾‍♀️
and guess what, I bet managers manger or even both will have a BIG issue with a P O Box address .

Work it with HR rather than line management. HR are paid to deal with the difficult people stuff and stay the right side of the law.

@ScaryM0nster yes probably but I guess they would still say no because they probably say they can a alter the system etc.

perhaps I email HR and say for I will input my PO Box address for privacy reason as I can see that they can’t shield my details from manager etc Afterall, my legal name and address (old address) was all on show and already seen by the manager when I had a one to one catch up meeting last week.

They can’t alter the system, but they can choose how they use it. Eg. Put in a PO address or the office address. They're the ones who set tye standards. Line managers just implement it.

I’m thinking of dealing with the change-of-address issue at work like this. I’ll send a short message to my manager to say I’ll be contacting HR directly about updating my address. I’ve already explained why I’m not comfortable having my address shown on my work profile, even if it isn’t visible to the public.

I also plan to email HR and explain that since they’ve said there’s no way to shield my legal name and address, I’ll either have to leave my address exactly as it is or change it to my PO Box, which I used for about four years. My emergency contact details are completely up to date.

Does this seem like a reasonable way to approach it?

I've managed lots of people over the years. The only time i have had any info about where they live is when they have given it to me because i have picked them up or dropped them off on the way to/from work.

I have never given people outside of HR my address and they have no business having it. Remind HR it is about data protection, and an extra layer of privacy for you due to your personal circumstances.

What does your union rep say?

I agree with everyone who says it's not a data breach / GDPR issue, it's not unusual to have access to this information as a manager.

The fact that it is not unusual does not mean it is right.

If a business shares an employee's home address, date of birth and other personal details with a manager, that is a breach of GDPR unless they can show that there is a legitimate, justified business need. In general, managers do not need to know home addresses. Access could be justified if, for example, the employee is working from home, the manager needs to send them work-related documents and no other means of communication are available. However, the large number of businesses who casually make this information available to all managers without any proven need just because it is easier than putting proper security protocols in place are in breach of GDPR.

That is the law. I am surprised by the number of people on this thread who are confidently giving incorrect information about the law and who seem happy to allow their managers to have access to all their personal information.

Riiiiiiight. This is what the law is:

https://www.gov.uk/personal-data-my-employer-can-keep-about-me

Employers can keep the following data about their employees without their permission:

• name
• address

Does that say that anyone who wants, from management, can look at that data?

Yes, employers can keep the data. I didn't say otherwise. They clearly need it. But that doesn't mean they can share it with people's line managers. They can only share it when there is a clear legal basis for doing so. This is Data Protection 101. It is taught in every data protection course I have participated in, either as a trainer or a trainee.

A business that sells direct to consumers can keep the home address of all their customers so that they can fulfil orders. That does not allow them to disclose the address to random employees. The information must only be available to those employees who actually need it to process the customer's orders.

The same principle applies to employees' personal data. Your employer needs it for payroll and some other purposes where it has a legal basis for using your information. However, disclosing it to your line manager is a breach of GDPR unless your employer can show that one of the legal bases for processing applies.

@prh47bridge thank you for your message. I do agree with you, but unfortunately our agreement doesn’t change how the system works. HR told me they can’t stop my line manager from viewing my details without applying the same restriction to all managers, which would mean a major system change. 🤷🏾‍♀️ So my line manager has already seen my full legal name and my previous address.

I emailed my line manager today to say that I’ve contacted HR, as I’ve already made it clear I don’t want my address visible on the system. My intention now is to email BR and explain that since they cannot shield my information, I will be providing my P.O. Box address, which I’ve had for over five years.

Your employer should have a data protection officer. Complain to them. If that doesn't get you anywhere, complain to the ICO.

They should apply the same restriction to all managers. The fact they have not done so is a breach of GDPR. It may be a major system change, but compliance with the law is not optional.

It’s not necessarily a breach of GDPR.

It depends how managerial and employee information management is assigned within the company. Some put all that on HR. Others put more on line managers. If it’s a line manager remit then system settings giving them permissions to view and manage the data is appropriate. What isn’t appropriate is to give it to someone who doesn’t have a valid use for it.

It can be appropriate in one organisation for line managers to face access and in another for them not to. Unless you know the R&Rs in the OPs company you cant comment on whether it’s valid.

Ideally you need to speak to someone enable and senior in HR. Not via email.

Realistically they will want to insist on having your address but you don’t want management people to have access. So here is a suggested balance.

I would explain that as you have explained you were a victim of a serious crime and there are genuine and credible threats to your safety cited by the police you need to be protected by your employer in various regards. Go through each of them, name/details on website, emergency alarms. And then home address on system, don’t lead with that.

be clear You are not of course implying anything about the individuals who have access but every access point brings risk and you know that the Council, as a responsible employer, will want to help keep you safe from harm.

You can put in a PO Box address for correspondence into the system but separately you are willing for a small number of senior HR people to have your actual residential address in case of genuine emergency which would be kept out of the system.

You then want Hr to make clear to your management chain all of the above is a bespoke arrangement cleared with them for confidential reasons.

That would be my suggestion.

Agreed. As I've said in previous posts, they need a legal basis for giving the information to OP's line manager. The information OP has posted regarding the responses she's had from HR suggests they haven't got one and they are simply doing it because it is easier than setting up proper security, but it may be that they do have justification for what they are doing.

It sounds like line managers handle a lot of the staff administration & welfare activities.

In which case, Theyre the people who deal with the staff info. So should have access.

If HR dealt with all that then there wouldn’t necessarily be a reason for line managers to have access.

Quick update. I emailed HR to ask if I could use my PO Box address on the system, and they agreed to that. However, they also said they still need my full home address for HR records, which will only be visible to HR.

A senior HR member then asked to meet with me face to face to check that I was okay. The meeting actually went fine. I explained why I’m so protective of my personal information and they seemed to understand and were quite supportive.

The only sticking point was my name. On my profile, I’ve always used the shortened version of my name, similar to how a Susan Smith might put “Sue Smith”. This is what I’ve used in all my previous jobs and it has never caused any issues with HMRC or any employer. My passport and official documents of course have my full name, and my HMRC record shows all of my previous employers correctly with no problems at all.

Despite this, they insisted that the name on my profile must be my full legal name, even though it is only visible to my manager. I didn’t want to change it, but I was exhausted by that point and just gave in and updated it.

I’m just confused why this has suddenly become such a big issue when it has never been a problem anywhere else.

🙄🙄

Other places may have other policies on information management and records. Or just not be robust on checking.

You don’t need a PO Box. Just get an office address/business type an address that you can use for all post and work etc.

I've only ever known my colleague's home address if they were on my team and I needed to send them equipment or paperwork.

That data is not to be shared amongst anyone who doesn't need it.

The manager themselves doesn't need your actual home address? HR have an address for you and that's enough, surely?

The thing about the name is ridiculous?! If you're known professionally and personally as Sue and always have been why are they forcing you to identify as Susan?