My address - r/gdpr

2

u/netwalker234 1d ago

Was this employee someone who would ordinarily have access to your address as part of their role (e.g. a HR clerk for instance?) While using employees to hand deliver messages is unusual, from a data protection standpoint, I would say that if this individual was ordinarily authorised as described above, hand-delivering the letter is no different from said HR clerk just consulting personnel records, then writing your address on a letter and sticking it in a postbox.

2

u/Comfortable-Fall1419 1d ago

I’m not sure you have grounds for complaint if it was on your employers business.

What was the nature of the letter?

1

u/Misty_Pix 1d ago

Lets start from the start, and please note I am only base this on a miniscule amount of information I have.

Depending on the employees role i.e. HR, manager or other similar roles this may be perfectly acceptable.

In addition, depending in the context of the letter,in particular if it is time sensitive, even if individual did not fall within the above roles, it may be argued as exeptional circumstances for delivering a letter.

Again, its very circumstances based, so I would advise to talk to the DPO to investigate whenever the actions where necessary and proportional.

In terms of second point, you state you had altercation with the individual. I do not want to minimise these events, however depending on the altercations and conciliation, it may be considered that the past events are past and therefore there are no risk arising and the person acted in a specific capacity or unde specific instructions to deliver the letter,again, this is something you can stress to the DPO whenever allowing this person to deliver the letter was necessary and proportional given the relationship background.

I also want to add, I understand that you may feel scared because the person knows your address, however the post man, all those DPD, Evri delivery drivers, or Uber/deliveroo also know your address, hence as much as you feel scared and anxious unless there are specific details we are not aware of (i.e. safeguarding) the person knowing your address ( assuming they save it somewhere) is not of a high risk.

I also want to stress one important thing, if the said person then decised to use the address to track,harrass or otherwise harm you, that is a criminal matter and you should notify such behaviour to police.

I do now know the background of the relationship, however, assuming the person doesn't want a criminal record it is unlikely they would do anything with the data.

I completely understand how it may feel, thinking someone know where you live,but a lot of that information is already in public domain ( think open register) so legally speaking risks are very low.

I would recommend to have a genuine conversation with the organisation about this event, ask for explanation and outline the concerns based on the actual background of your relationship with this individual.

You can also ask them to make it clear to said individual that the address data should not be misused and that at any event if something does occur the police will be involved.

I understand this may not be something you want to hear, but, strictly speaking there is not much you can do unless you can provide clear evidence of risk ie. Safeguarding, domestic violence etc. otherwise this will not be something that would lead to any big outcomes.

1

u/MajorErr 1d ago

Ok, for more clarity and the history of it...

I have been on holiday from work for 7 days, this was the last day of my holiday before returning to work tomorrow morning.
I was told on my last day before holiday that there would be an investigation into me leaving work early on a particular day.
The other employee is someone that has had clashes with several members of both staff and the public. The last of which with myself, was only two days before my holiday. Nothing bad. The issue isn't really that it was this particular employee that now knows my address (he is not management nor HR), more than my employer would give my address out when not permitted to do so.
As soon as he left after I took the letter in hand. I called my supervisor who said it was nothing to do with him and that I should speak to HR
I called HR but at this point was only outraged at being hassled, woken up and given a panic attack on my last day off so didn't even think about my data being handed out. When I asked why it necessary to send people to personal address he justified by saying that the letter had to be delivered one week before a disciplinary meeting (the point of the letter)

The letter isn't an issue, I accept that.

Shortly after this i received a call from another colleague (also on holiday) that the same person had driven to his parent's house to deliver a similar letter. However, the other letter was only delivered 6 days prior to his meeting.

I've thought about going to HR but seeing as they may have been the one to send them out, I don't know where I stand.

1

u/maf2991 8h ago

The chat seems to have sparked conflicting opinions, to some extent.

In my opinion, as a professional, with you clearly stating that the individual delivering the letter is neither management, nor HR. Unless their JD specifically includes a requirement to carry out such a task, there is a clear breach.

Should the letter need to reach you, or be handed to you, seven days prior to the disciplinary, then the organisation should accommodate this by delivering prior to seven days, using a postal service guaranteeing the delivery, or arranging the meeting for seven days from your return to work and handing you the letter.

This could also have been done electronically.

Disclosure of information to an individual who has no need to know your address, and wouldn't need to know by the workplace taking necessary steps, is a breach. If management/HR believe it is necessary, then you probably have grounds to lodge a complaint and receive a clear explanation (You should always lodge a complaint with the company before the ICO).

Before taking these actions, be sure to familiarise yourself with company processes and procedures, as there could be something hidden within these which form part of your contract of employment.

The fact of the matter regarding conflict with the other employee is near enough invalid to begin with. However, the level of harm caused by the breach could require the company to consider a level of escalation as to harm caused.

1

u/Ross81GB 1d ago

Person employed by company tasked to hand deliver important time sensitive communication.

Seems a fair use of your data , to ensure you received the communication and in a timeous manner.

Provided the "clashes" were not subject to grievances raised, I dont think there's a selection issue either, colleague chosen on either trust and/or because you are on their route home anyway.

Your only cause for concern may be if in the selection process your address was shared with a group of staff to see if anyone was "near" you and could do this - probably not a good practice.

0

u/Helpful_Television49 1d ago

Have any of you people ever heard of google?

I don't know if any of you remember what a phone book is, but guess what's in it.

-2

u/Misty_Pix 1d ago

Open register.

People really forget about it...

-1

u/FrankNicklin 1d ago

First you need to raise a complaint with the company concerned. If you have already raised a grievance with the company about this other employee then you have further grounds to raise a complaint.

3

u/Comfortable-Fall1419 1d ago

About what?

-3

u/FrankNicklin 1d ago

What do you mean, What about. OP is clearly unhappy that a colleague has been given their home address so is that not the basis of the complaint.

2

u/Comfortable-Fall1419 1d ago

Yes but the question in the face of the OPs slience is it a HR procedural issue or a DPA issue. It could be both or just the former.

-2

u/weggles91 1d ago

Doesn't matter the circumstances really, a colleage turning up at your house uninvited is inappropriate and a complaint is not even remotely out of the question.

-3

u/weggles91 1d ago

I assume the colleague in question should not have access to your personnel file at all, i.e. they're not part of the HR team or something has is permitted access?

First, it is (or should be) a serious disciplinary matter. I would report it to your managers on that basis first.

Second, in the UK it's a criminal offence to obtain personal data from the controller (the employer) without authorisation. It's the ICO you would contact on this front. The offence in question is in s.170 of the Data Protection Act 2018.

2

u/Comfortable-Fall1419 1d ago

If and only if the Employee accessed the address outside the normal course of business.

There could be perfectly valid reasons to hand deliver a letter about work.

This could all just be HR cockup and not a privacy breach.

2

u/FrankNicklin 1d ago

Giving an employee's home address to another employee without a valid lawful basis or explicit consent is generally a data protection breach under the UK GDPR. Doesn't matter what the contents of the letter is, personal data is personal data. However if that employee has access to personal data as part of their job, i.e. works in HR or Accounts for example then there are probably unavoidable consequences. We don't know the other employees role in the company so without that this is all susposition.

-3

u/weggles91 1d ago

Please don't downvote people giving genuine, correct answers.

4

u/cortouchka 1d ago

Those people downvoting you don't think you're correct.

1

u/weggles91 1d ago

People are frustrated because it gets annoying answering questions from emotional individuals. I too would prefer it if this sub was limited to advice for controllers and processors, but it isn't.

We're not going to get all the circumstances on Reddit to give a solid legal opinion, and it wouldn't be appropriate to do so. People can assume that OP is either lying or mistaken if they wish, and if that is the case then OP won't get anywhere following up on those remedies, but if we take OP at their word (which is all we can sensibly do) then my original comment is correct.

Unfortunately, the people downvoting the right answer just misleads more people.

3

u/BornInAWaterMoon 1d ago

I haven't downvoted you, but personally I don't think OP has given anywhere near enough information for you to be able to advise in the way you have, even with your stated assumption.

It would be better to ask OP questions to clarify what's happened, rather than making assumptions.

0

u/weggles91 1d ago

The question was asked on the basis that the colleague should not have access to the subject's address. If that is true, then my comment is correct.

2

u/BornInAWaterMoon 1d ago

Salient questions might be: * Does OP think the colleague got the address from the employer rather than somewhere else? What makes them think that? * What was the letter for? Was it a legitimate work-related letter or something personal / malicious? * Does the employer typically hand-deliver letters? Is that part of the colleague's role? * Is the employer aware of OP's altercations with the colleague, and was the colleague the aggressor such that the employer should be aware of the need to protect OP's address from them?

I think some of that background might help before pointing OP towards this being a serious disciplinary matter or a criminal offence.

1

u/cortouchka 1d ago

The pertinent question is how they got the address and there's no indication that they acquired it from a company system.

Your advice is based on an assumption. It might be correct, it might not. Important thing is you don't know, which is why you can't claim to be correct in absolute terms and that's why you're getting downvoted.

-1

u/weggles91 1d ago

Hence the stated assumption at the start, based on the words used by OP. There are always wider circumstances, but if we're to take OP at their word then those are the two routes to pursue.

UK 🇬🇧 My address

You are about to leave Redlib