My colleague posted a photograph of all the paperwork he'd been left to do to our work's group chat. He is now in major trouble with our supervisor because the paperwork had confidential information on it.

However, I am wondering how serious this is as you couldn't read anything from the photograph as the papers were stacked and at an angle. So no info was passed on. Also the group chat is for work and was seen only by the staff. Although it is social media, it is encrypted.

Of note, the supervisor was responsible for not completing the paper work the day before which is why perhaps they are so angry. My colleague has been given a formal warning.

How would you respond to this? Is the formal warning appropriate or indicative of unprofessional behavior by the supervisor? (There was another incident with them overreacting to a clarifying question from another colleague recently.)

If it is the latter what is the best way to go about protecting myself?

  • 17
    Why did your colleague feel the need to photograph internal paperwork and post it to the group chat? Is this your colleague's personal phone? What cloud sharing services does your colleagues phone automatically upload photos to? – user44108 Sep 20 '18 at 12:35
  • 5
    This was WhatsApp from personal phone. The group chat is specifically for work. I think my colleague was making a point because the supervisor went on an aggressive rant the week before about not leaving this particular kind of work till the next day, then did it himself. Obviously my colleague regrets that now! – Owebee Sep 20 '18 at 12:38
  • 2
    So this question isn't about the sharing of the photo on WhatsApp, it's really about your supervisor being angry at being outed for not completed work and being shamed to the whole group. – user44108 Sep 20 '18 at 12:41
  • 5
    Welcome to the site Owebee. You got a few close votes and I've put your question on hold for now since it's not clear what exactly you need help with. Use of WhatsApp or any other tool for work purposes will be governed by your IT policy, but we get the impression that your real issue is that you have a volatile manager and are looking for a strategy to protect yourself? Can you edit your question to focus on a practical goal that you have in mind? Check help center and tour for info on how to phrase your question to get better answers. – Lilienthal Sep 20 '18 at 13:07
  • 13
    failing to understand why you need to prepare yourself for protection from an issue clearly between two other people – NKCampbell Sep 20 '18 at 20:45

Is the formal warning appropriate or indicative of unprofessional behavior by the supervisor?

A formal warning is certainly not unwarranted. What you coworker did was incredibly stupid and unprofessional. Let me count the reasons:

1. Publicly criticizing their boss to the entire company

You said your coworker was complaining about the work he was given by his boss, who just ranted about how bad it is to put off this type of work. This criticism of the boss is pretty blatant and not really subtle, and it was posted on the company's internal social media for everyone in the company to see! Even if your boss weren't prone to aggressive rants, this would be immensely unprofessional.

2. Photographing confidential documents on a personal phone

Regardless of whether you can read the documents in the photo, your coworker now has confidential company information on his personal phone. As was pointed out in the comments, the company has no way of knowing if this information is now up in the cloud somewhere because the phone syncs all photos automatically. Definitely warrants a reprimand.

3. Sharing confidential documents to the entire company

Just because your coworker has the right to read this information doesn't mean that everyone in the entire company can. HR has confidential documents with my SSN and home address, but that doesn't mean that a random software engineer needs to know that. And that HR person doesn't need to know the inner workings of the company's proprietary software. This was also a mistake.

So regardless of whether your boss has a vendetta out for your coworker or not (which isn't really clear either way), they are entirely within their right to formally reprimand him for this hugely unprofessional behavior. Your coworker screwed up and needs to deal with the consequences.

  • 5
    Well, if the documents are not readable (that's a separate concern but let's pretend they are really not readable) then it's arguable whether information sharing, copying, whatever else has occurred. Technically this doesn't differ much fro those documents put into a box and photographed. – sharptooth Sep 21 '18 at 7:11
  • 16
    @sharptooth OP has no way to know whether the information is truly unreadable with the right tools. And he is not in the position to decide whether it is ok to take that risk. – Polygnome Sep 21 '18 at 8:26
  • 2
    @sharptooth I would guess it is reasonably unlikely the OP's friend made a conscious decision to ensure the documents were unreadable ... they probably just "snapped the pile" and it happened that they were more or less unreadable. – TripeHound Sep 21 '18 at 11:18
  • 4
    @sharptooth Whether or not the documents are readable this time is mostly irrelevant. The fact that there was any chance at all they're readable is the issue. If the company adopts a de facto policy that it's ok to post confidential documents so long as noone can't read them, then their security relies on every single employee being a good judge of what's readable and what isn't. That's not an approach I'd have a lot of faith in. – Lord Farquaad Sep 21 '18 at 12:56
  • 4
    Also note that most social media compresses photos to the minimum they can get away with while the original phone photos may be much clearer and actually readble. And by now on a server at google or apple. – Borgh Sep 21 '18 at 13:02

what is the best way to go about protecting myself?

When you feel the urge, resist it and don't post pictures of confidential information anywhere you're not authorised to.

  • 33
    Also, resist any urges to criticize your boss, implicitly or explicitly, on a mailing list, chat etc. – Patricia Shanahan Sep 20 '18 at 14:27
  • 31
    Actually, forget posting them, just don't take pictures of confidential information at all. It surely violates any reasonable company policy for the protection of confidential information. – ColleenV parted ways Sep 20 '18 at 15:32
  • 1
    @ColleenV We've got posters all over our office stating this exact thing. Don't take pictures of work, especially if there's any chance that what you're working on could be confidential or even proprietary. – AlexanderJ93 Sep 20 '18 at 21:22
  • 2
    Yeah, anything you possibly have an impulse to do with social media or with your phone, don't. GenX and boomers figured that out all by themselves, perhaps because we were adults before social media and ubiquitous smart phones were a thing. – Harper - Reinstate Monica Sep 21 '18 at 9:29
  • 3
    Actually - forget posting anything about work, ever, unless you're in marketing and posting marketing material. – UKMonkey Sep 21 '18 at 10:34

Just one point: The excuse “you couldn’t read these papers” doesn’t count. Publishing them might mean major trouble for the company. If they had a deal with a customer to keep information safe, then they breached the contract, which could mean losing a contract or getting a fine.

Importantly, it wasn’t up to your colleague to decide what can be read. He doesn’t know what I can read with the right tools. And you don’t decide because that means you never decide wrong.

Even if the data is absolutely not readable, posting this information proves that the company isn't keeping the data secure (because he could have posted it on Facebook, for the world to see and read, and the company wouldn't have stopped him). That alone would likely make it illegal for any EU company to let this company access and process their data.

  • 4
    This is true. There might be a document with Another Company logo on it which was identifiable and showing it would indicate that the employer was doing some business with Another Company. That alone might count as disclosure. – sharptooth Sep 21 '18 at 7:13

From the sounds of it your colleague's actions weren't too bad if nothing was actually visible in the paperwork. However confidential information is not an area to mess around in.

Remember that a posted photo on a group chat (encrypted or not) doesn't tell the whole story. The image had to be taken on a device (likely their phone) which may a) still have a copy b) have uploaded the photo to a cloud backup (iCloud, OneDrive etc) so it's not quite as cut and dried as it seems.

An alternative (or possibly even concurrent) explanation is that the Supervisor wasn't particularly amused at the implied criticism of their performance by one of their subordinates in a work group chat.

Regardless of the rights and wrongs of the supervisor not doing the paperwork the previous day and whether your colleague had legitimate cause to be annoyed he didn't go about it the right way. Doing what he did was neither professional nor smart - if the supervisor is the sort to "attack" staff as you put it then why on earth would you go around giving them ammunition?

FWIW I'd probably have given your colleague a dressing down as well. At this point his best bet is to take the warning on the chin, keep his head down and wait for it all to become ancient history.

EDIT: I see from the latest comments that this was on WhatsApp from a personal device. My inner CISO is cringing, depending upon the nature of the information even if nothing was actually breached that could still cause quite a big headache.

  • even if nothing was actually breached that could still cause quite a big headache Would launching an investigation to find this out count here? – VLAZ Sep 21 '18 at 11:24
  • @vlaz Potentially yeah - I've worked in environments where even a possible breach would require tedious amounts of investigation, writing reports etc etc – motosubatsu Sep 21 '18 at 11:27
  • Which means that this photo that (maybe) doesn't expose any data could still eat up man-days of work across multiple people in the entire company just by its existence. It's thus not really without any consequence. – VLAZ Sep 21 '18 at 11:30
  • 2
    @vlaz yep.. in one particularly sensitive contract my then employer had with a client (large government dept) they were required to disclose even investigations that lead to NFA verdicts and give the client the opportunity to investigate themselves. One like this would have been particularly embarrassing for the company! – motosubatsu Sep 21 '18 at 11:42
  • Relevant meta from RPG.SE: Don't signal your edits in text. Your answer should stand as if it were always the best version of itself. Rather than leaving partially irrelevant/inaccurate information in the answer and then maybe contradicting it or pointing out its irrelevance later, you should edit out the inaccurate/irrelevant info (if applicable) and simply make the answer "be its best self". – V2Blast Sep 22 '18 at 4:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.