20

I work as a developer in a midsized startup that has around 200 people and ~50k customers.

Our privacy policy says we don't share customer data with any third party, except that we certainly do - we send each customer's extremely sensitive data to a contractor in China for processing, which gives us a huge price advantage, halving the price of our product.

On the one hand, I can't stand extremely sensitive information being sent to a regime I don't personally like. On the other hand, I grew a lot professionally thanks to this company as a developer and they pay nicely as well.

What should I do, if anything, about this? Note: I've once said it out loud (stupidly) that our privacy policy says we don't share data with any third party, and if it's discovered, we may face a class lawsuit. Around 10 people heard me saying that.

Improve this question
9
  • 10
    Aside from the ethical issues are there legal ones as well? Might be a good idea to talk to a lawyer.
    – jcm
    Nov 10, 2019 at 6:59
  • 12
    Please tag this with a location, as obviously governing laws vary.
    – Justin
    Nov 10, 2019 at 7:54
  • 4
    What does sending data to a Chinese contractor have to do with you not liking their government?
    – dan-klasson
    Nov 10, 2019 at 9:45
  • 13
    @dan-klasson, For one thing, if this information belongs to Uighur muslims, Falun Gong followers, or Honk Kong protesters, or Chinese tax evaders, or Chinese dissidents, that company may be unwittingly signing their arrest/death warrants and the arrest of their family and friends by sending it to a contractor in China.
    – Stephan Branczyk
    Nov 10, 2019 at 10:00
  • 5
    @StephanBranczyk You could apply the same unhinged conspiracy theory to sending data to a U.S contractor and it would be equally nonsensical.
    – dan-klasson
    Nov 10, 2019 at 10:03

4 Answers 4

Reset to default
14

Interpreting privacy policies is not trivial, so keep an open mind that you might be wrong. At the same time, don't assume malice immediately - they might be willing to address the situation.

First stop should be your immediate manager. Share your concern with this person and see what they say. If you are not satisfied with their answers even after raising it repeatedly, you can escalate to their manager (and mention you have talked to your immediate manager about this, and if you can also let your immediate manager know you are escalating).

If even this doesn't resolve your concern, consider addressing it to a different department (like legal). Finally you can raise it to the CEO.

If all above fails, then you can consider notifying the authorities. If you did all the above, and the company still didn't resolve it, chances are you will be disadvantaged if the company suspects you notified the authorities. Personally, if I were to go to the authorities I will only do so if I'm ok with having to leave the company. It's a decision only you can make. If you decide to stay low instead, then be sure to protect yourself by e.g. documenting instructions to send the data etc. in emails.

Improve this answer
3
  • 1
    " If you decide to stay low instead..." so continue doing wrong but have the evidence to blame someone else...
    – Solar Mike
    Nov 10, 2019 at 8:34
  • adding more to @SolarMike one, if the decision to use to send data to china come from your end, then you need to chose between eithics or work else if you know who made this decision then just remember his name and stay low
    – sahasrara62
    Nov 10, 2019 at 9:02
  • 1
    @SolarMike The company could also sue OP, let's not forget that. And before they begin winning the case (assuming they would in the end), OP is broke, their life possibly destroyed, depending on how much power and unscrupulousness the company has. Whistleblowing comes at a price which society is always happy for others to pay.
    – Captain Emacs
    Nov 10, 2019 at 12:03
7

If it was a data transfer from EU to China, there are rules (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en) that need to be followed.

I assume that similar rules apply for US to China data transfers, but some legal expertise is required to understand if those data transfers are protected by “Privacy shields”.

Generally those laws are not easily enforced without somebody becoming the whistleblower!

If you are NOT 100% sure that what the US company is doing is illegal, just simply mention your concerns to your superiors.

IF you think that this data transfer is 100% illegal (by facts shared by the US company itself and/or your attorney), AND(+) the US Company tries to avoid to resolve the issue (does not answer you questions in emails in order NOT leave a paper trail of evidence!), AND (+) simultaneously you think that a scandal could have a damaging impact to your career, become an anonymous whistleblower to the authorities. IF all those 3 factors do not exist simultaneously, just simply mention your concerns to your superiors.

Improve this answer
2

I can't stand extremely sensitive information being sent to a regime I don't personally like.

What should I do, if anything, about this?

You say that you can't stand it, but so far you have.

If the regime bothers you enough, you should find a new job and leave this one.

Before you decide to look elsewhere, you might wish to make sure that the contractor in China is considered a "Third Party" in the context of your company's public statements about not sending data to a third party. I once worked for a company that had a subsidiary in India. That wasn't considered a "Third Party".

You might be well served to discuss the issue with your boss and see what you can learn.

Improve this answer
-3

This isn't your issue to resolve. If they're handling sensitive data there are mandated procedures legislated to do it by. And it would be audited regularly.

If you don't trust the auditors, your company and the authorities then you should look at moving on.

If you have ambitions of crashing your career and other risks including perhaps doing it all for nothing which is the usual result, then make an outcry. Otherwise just do your job or leave.

Improve this answer
12
  • 1
    It not clear from the post what location OP has and so what auditing mechanisms are in place, it any.
    – LokiRagnarok
    Nov 11, 2019 at 15:35
  • How can you make so many assumptions? I don't find your answer constructive.
    – ChrisFNZ
    Nov 11, 2019 at 19:17
  • @ChrisFNZ what assumptions, there isn't a single country without legislation on these matters. Unless perhaps it's a rogue state, in which case this wouldn't even be an issue
    – Kilisi ♦
    Nov 11, 2019 at 23:38
  • @Kilisi Not every country has legislation on these matters actually. You're assuming that legislation has mandated procedures, and that it would all be audited regularly.
    – ChrisFNZ
    Nov 11, 2019 at 23:41
  • @ChrisFNZ name one, NZ definitely has it... and audits regularly. They audit my stuff very thoroughly and I'm also required to have legal docs outlining procedures and third party audits as well.
    – Kilisi ♦
    Nov 11, 2019 at 23:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .