Should I raise a grievance over confidential information shared at work?

[ToesAreUs]

I'm about to go on maternity leave in a few days' time. My workplace, and my manager in particular, are pretty toxic, so I am pleased to be having a break from it all soon.

Last week I discovered that my manager has shared sensitive information about me on a shared IT drive, including perceived performance issues and private medical information.

The private medical information is two fit notes relating to time off for pregnancy related illness. At the time of the documents being saved, I had told my manager I was in early stages of pregnancy, but had asked for it to be kept strictly confidential from the rest of the team until I was ready to announce.

I have reported the saving of the fit notes as a serious GDPR data breach to our Data Protection Officer and I'm still waiting to hear more.

Not only has my manager written comments on perceived shortcomings about my performance (most of which are either extremely petty, unfair or not true), she has also shared my private and confidential medical information including my address and date of birth. This is on a shared drive that our entire team have access to, which is a lot of people.

I have also discovered her notes on the performance of a colleague, but I have not alerted him yet that I have discovered this information.

Does anybody have any further advice on what steps I can take? I am concerned that she will just get a slap on the wrist and it will be brushed under the carpet by HR.

Do you think it is worth raising a grievance or making an official complaint to HR so close to me going on maternity leave? The manager in question is a maternity cover, so hopefully she will be long gone by the time I return. However, I am furious that this has happened and I don't want her to get away with just a slapped wrist. She seems to be hellbent at the moment on destroying my confidence and reputation, and I'm not sure why, so I have no qualms about destroying any professional relationship we might have.

In case it is relevant, I will be job hunting on my return from maternity leave anyway, so will be trying to leave my workplace (although who knows how that will take given the current job market). I have been there over two years.

Any advice would be greatly appreciated.

I'd raise it as a GDPR breach first, hopefully she'll get a shoeing without you having to go down the grievance route.

If the GDPR breach is not addressed to your satisfaction, then grievance.

Good that you have raised the GDPR complaint, the option of a grievance is still there if the response isn't acceptable. Unlikely you will find out what of anything happens to the manager, but you should ask for and receive an apology and at the very least they should state how they are going to prevent it happening again.

Re the performance comments, I would this raise with her formally (if you haven't already), and set out what your want i.e. ask for them to be removed, amended or clarified (to reflect whatever your feel is a fair and reasonable assessment of your performance). If that doesn't resolve it then raise a grievance. I absolutely would not leave it as otherwise they will stay on your record long after she has gone and future managers will see them. (I know you intend to leave but you don't know how long that will take).

Also check your grievance procedures, in most companies I've worked in whilst you can complain/copy in HR it's expected you will address to the complaint to an appropriate senior manager in the hierarchical structure. Where I am now HR don't do the investigations or sit on grievance or disciplinary panels, the process is overseen and supported by HR with advice etc but decisions are not made by us. In fact our role is to ensure managers don't sweep stuff under the carpet and cause even more headaches!

Thank you for your replies @IDontHateRainbows and @LemonGelato.

@LemonGelato thank you especially for your very detailed reply. It's really helpful.

I have already put together a rebuttal email detailing why I disagree with much of her evaluation of my performance. Would this count as raising it with her formally? I am indeed concerned that other managers will see her comments after she leaves and it will be a permanent stain against my name. How do I ensure that other managers will see this email from me and be able to see my defence. Should I copy them in? She could just file my email away with no other eyes on it.

Unfortunately where I work seems to be hierarchical and the more senior you are, the more you are protected and believed.

If I send this rebuttal email it may just come across as sour grapes, although much of what she has written about me comes down to subjective opinion and accusations of poor performance with very little concrete evidence. How can I help ensure that my rebuttal is believed against her word?

I suggest asking for a meeting to discuss the performance issues raised. Then you can be seen to be listening to manager’s point of view and putting yours over. And then you can follow up with a ‘we disucsssed, here is a summary of my points’ email so it looks calm, measured etc.

Get screenshots before you do anything. It's important to make sure you've got evidence. I've learned this the hard way.

Thank you for your responses.
I followed up with the Data Protection Officer today and his response was:

"I can confirm that I have met with [manager] and discussed this matter. She is working with IT to store personal data in a more secure and appropriate place from this point.
At this point, the matter is now closed"

It looks like she's got away with a slapped wrist, whilst goodness knows who has seen my personal medical records and her perceived concerns about my performance. It feels like she's just got away with it.

I know it's not the Data Protection Officer's job to discipline her behaviour, but should I now be contacting HR to at least request an apology? Is it worth raising a grievance after this response?

I am still absolutely livid, so perhaps you wise Mumsnetters can offer some more words of wisdom, or perhaps gently tell me I'm overreacting.

Tell them that if they do not resolve this serious breach of confidential personal information to your satisfaction, you will pursue the matter through the correct authorities and refer the matter to the ICO.

That’s awful. Your personal data should not be stored anywhere in a shared drive. It’s a clear data breach. Your DPO is not taking this seriously enough.
i would report to the ICO.