69

A colleague of mine in a different department is a developer for an internal, employee-only discounted retail site within our company. Today, I made a rather large purchase on that site before heading out of the office. Ten minutes later, I get a text from him

Hey, some people are kinda crazy. They spend like almost $X bucks on [site name] all at once!

where the amount he referred to is exactly what I had spent. Now, I know he meant the text itself as a joke but I was immediately shocked by this because this felt like a huge breach of my privacy. From my understanding, it's not like the developers on his team are getting emails per every invoice -- where he might have seen my name slip in an email subject line or something, but they do have an admin account (and database access). I was even more wary of the fact that he knew I had placed an order within 10 minutes when I know the site gets traffic in the thousands. I replied to his text, "Yeah big breach of privacy issue you guys have huh" and he responded with just, "lol".

As a developer myself, I feel that this is extremely unethical but I'm not sure if I'm overreacting. We've been forming a friendship outside of the office (both have been here for about the same five months) and I find him to be hard-working, a talented developer, and an all around benevolent individual. So my bias in that regard may be the motivation for the fact that I don't want to see him fired but I imagine taking this to his supervisor could result in termination. I also don't know if I am in the position to talk to him about this as I'm not his senior (except in age by a couple years). For context, if it matters, he's in his mid-twenties.

What would be the best way to handle this?

  • 14
    Friendship? Is he interested in you romantically? Does he have a script that specifically notifies him when you make a purchase? – Stephan Branczyk Oct 22 at 3:25
  • 7
    @StephanBranczyk I don't believe I'm of his sexual orientation and he is in a relationship. As for the script... yeah, that's kind of what I am wondering. I asked him how he knew and he hasn't responded; he ignored it and changed the subject. – 8protons Oct 22 at 3:26
  • 27
    Did he specifically refer to this order being yours, or is there any chance that he actually (even if still unprofessionally) had simply seen a massive order on the site and thought it was funny that somebody would spend $x? (That is, do you have any reason to believe the other developer knew it was you - other than that they texted you? e.g. the database to your knowledge does contain customer details in plaintext, in an easy to find way). It doesn't make it not-wrong, but it does change the dynamic a fair bit. – Bilkokuya Oct 22 at 12:01
  • 1
    The "some poeple", and "they" might infer that he didn't necessarily know it was the OP. If the OP reveals that information, it means offering up an even larger breach of privacy. – Val Oct 22 at 13:26
  • 3
    Do you know what the store's back end/control panel looks like? I've done work on various ecommerce platforms as a developer, and some of them show a list of the most recent orders as soon as you log in. Maybe your colleague logged into the control panel, and your name just happened to be at the top of the list. (This is especially likely since you received the text so soon after placing the order). – RToyo Oct 22 at 15:43

11 Answers 11

122

I'm going to go against the grain here. I'm probably wrong based on all the other answers and I'm looking forward to learning something from your comments. I'm also in the USA.

I think this is no big deal and you shouldn't push back.

Your colleague is a developer for the retail site. He could easily be monitoring the transactions and you jumped out as a familiar name. As far as we know he didn't somehow capture your sensitive information: SSN, CC#, etc. There's no indication that your purchases were of a sensitive nature: medications, undergarments, etc.

To me, this isn't any different from a colleague cashier at a grocery store smiling and saying "Wow, $60 on steaks all at once!"

  • Comments are not for extended discussion; this conversation has been moved to chat. – Snow Oct 22 at 19:10
  • 4
    This is the answer I would provide so I'll just leave a +1. I've had job duties before where I saw information fellow employees could show up in. I've always considered it insensitive to single someone out, but I've had plenty of coworkers who do single friends out and don't consider it a big deal. – Nathan Goings Oct 22 at 21:48
  • 4
    Important to note here that the OP has no idea how the information was actually obtained. Other answers assume that this was nefarious and advocate to try to get the other dev disciplined or fired. This is the only valid answer with the information provided. I would even add to this answer that if OP tries to get someone fired over this it may (and in my opinion should) reflect poorly on OP. – Joe S Oct 23 at 1:32
  • 6
    @JoeS: Nonetheless, digital collected data has to be used only for the purpose it was collected. Using it for anything else is again a privacy breach. So in fact the information OP provides are making already clear it being a privacy breach, since the use case for the retail site is for sure not: "So developers can make a joke on it to fellow developers using the retail." – Zaibis Oct 23 at 5:46
  • 6
    @NathanGoings I once worked in a bank, and got asked to optimize a query. And surprisingly, the first result page contained our own CEO's mortgage information. Now, it was pretty obvious that in this case, joking about how people spend $X.00.000 on a house would be highly inappropriate, and I restrained myself from even memorizing X. – IMil Oct 23 at 6:03
35

Backend developer myself, I regret it's not uncommon from developers that have admin access to a database to witness private information being in it. It's also likely that because the retail site is internal, the company had/have lower security and privacy standards about it.

It is possible that this developer got you in a course of debugging something and just wanted to share because he thought it was funny, you can't be certain he's been breaching your privacy in a deliberate way. Possibly also, he doesn't understand how private is this data. Some benefit of doubt should be apparent on your exchanges, but you can definitely insist on the fact you feel uneasy about the issue.

I feel uneasy about the fact our purchases are in clear. It should be anonymous data, don't you think ?

And see where this is heading. It's likely that implementing the anonymization feature is going to be rejected by either your colleague or even his management. Raising the point definitely makes it clear your view is that this data should be private to everybody, yet avoiding pitfalls of a too harsh accusation toward your colleague.

  • 44
    I was once in a position where I would unavoidably hear confidential information. The rule was very simple: You are not allowed to act on that information in any way whatsoever. He acted on this information, which makes it a severe breach of privacy. The colleague must stop this behaviour, or he should absolutely be fired if he cannot learn this. – gnasher729 Oct 22 at 8:08
  • @gnasher729 I find my answer a bit soft after re-reading it but OTOH he befriended OP and didn't share with anybody that didn't have the information in the first place. And you can't be sure he got warned enough about privacy in the first place. Too much opinion based to provide an accurate course of action, maybe. – Arthur Havlicek Oct 22 at 8:13
  • 3
    I think my point was that information is still private if everyone who may be able to access it knows that they must not act on it in any way under any circumstances. – gnasher729 Oct 22 at 8:23
  • Again it is also possible that the security is in fact high, and the colleague knew because orders from staff are intentionally monitored, for testing, fraud detection etc. – Neil Slater Oct 22 at 11:46
  • 2
    @Fildor: Yes, there are other possibilities too. I worked in an e-commerce company where test orders using dummy credit cards were common practice following production relrease. These orders were tracked and cancelled by a different team in the factory (to avoid actually making the goods) - so not a direct security issue, but something else. There are a wide range of reasons why the OP's colleague may of seen the order. The jokey comment which demonstrates they saw it seems off under most of those reasons, but assumptions about how they saw it in the answers should be avoided. – Neil Slater Oct 22 at 13:19
35

If you talk to him outside of work, then you can do that and tell him a few things.

  1. What he did was a severe breach of privacy.
  2. In his position, he can be fired for breaches of privacy.
  3. If the company is caught not respecting people’s privacy it can get expensive.
  4. You are not complaining to HR this time and this time only.
  5. If you hear of other cases you will complain.
  6. This must never happen again.
  7. This is not a game. This is serious.
  8. Do you understand?
  • 13
    @AaronF Yes it is a breach, IMO. The breach was not seeing something that the developer is legally permitted to see. It was the communication about what was seen - especially since no emails are intrinsically private messages. Working in an environment with formal security classifications and clearances, I see things almost every day which I would never mention in an unsecure email. – alephzero Oct 22 at 13:34
  • 8
    Yes, @AaronF, it is a breach of data, and it's scary and sad you don't understand that on your own accord. That "person X" has come by the information he should not have: how did he know about the OP's buy out of all data he oversees. He then used the data in an inappropriate, some may say even threatening way, and lastly, not only didn't take any responsibility for it... he finds it funny! How does this even qualify as a possible breach in your mind instead of red-hot infringement is beyond me! – O.F. Oct 22 at 14:30
  • 9
    The developer has access to the data as part of their job. It's common to have developer permissions but not be able to access customer data. E.g, Gmail developers can't read anyone's Gmail. Having-access and "snooping for personal reasons" are also very different things. – RJFalconer Oct 22 at 14:36
  • 7
    @RJFalconer it's common if you work for Google or Microsoft on a big public service like the G Suite, Hotmail, Office365, etc. It's less common, in my experience at least, if you work in Any Old Company on their Internal Not-Public-Facing System. In the smaller companies working on the internal-only systems, it's commonplace for the developers to be to access all of the data, whether it's needed or not. (Note for O.F.: just because I'm saying that this thing happens, does not constitute a statement of agreement or disagreement on my part) – Aaron F Oct 22 at 16:11
  • 7
    Yeees, add a "do you understand?" at the end, like they are a dog who is being told not to piss on the carpet twenty times in a row. You can say the same thing in a lot of ways, I feel some of the answers just play out some office power fantasies here. OP mentioned the other person is benevolent and they develop a friendship. If I am your friend, you can tell me I made a mistake and once I see this, I will apologize and better myself. However with this little speech right there we can be professional colleagues, but other than that - you're on your own. Context is always important. – Mär Oct 22 at 18:30
32

I would send him this email using your corporate email address:

If you have a script notifying you of other employee's purchases, that is not ok. And even if you don't have such a script, or if your script was for debugging purpose, your message to me was still not appropriate either way.

Do you understand what I'm saying? Please respond to let me know that you understand.

Obviously, use your own words.

If he still ignores your concern, or doesn't acknowledge the fact that he made a mistake, then threaten to bring this up to HR or to his supervisor.

This needs to be nipped in the bud right away. I understand that he's your friend, but if he doesn't understand the line he's crossed, he's going to cross it with someone else who isn't going to be as understanding.

Remember that Google employee who got fired for breach of privacy. I'm sure that he wish that a coworker had knocked some sense into him before he lost his job.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Snow Oct 22 at 18:52
10

I'm going to suggest a course of action based on the information that you and the other developer have been forming a friendship and talk outside of work.

Talk to the developer, in person or by phone call, outside of work, about this. Do not use texts, social media, and certainly not any official channel like work slack or email. Leave no paper trail that suggests you know about the breach beyond what already exists.

When you have the conversation, it should go something like this:

Look, you know I don't really care (even though you actually do), but you could lose your job for this. Some humorless HR drone would take one look at this and not realize or care that it may have been a complete coincidence that you happened to be looking at the traffic when I made the purchase and that you and I are friends. I could even get in trouble possibly at this point because now I know about you breaching privacy and I'm doing you the solid of not reporting it. Not cool. Not trying to be a buzz-kill, but please be a little more discreet in the future.

If I have misread the level of friendship you have with this person, then I would still do a less casual version of the above. You're lucky (at least for the purposes of this conversation) to be in the US: if it was the EU it could be (IANAL) construed as a breach of the GDPR.

  • In USA, if it violates promises made to the customers when they create an account, it could result in a class action lawsuit. So even though OP wants to maintain friendship, a true friend would warn him. – WGroleau Oct 22 at 17:35
  • 1
    @WGroleau OP stated that this was an internal retail site, for employees only, so I"m not sure how that shakes out. But yeah, definitely a "dude, this is serious" kinda moment. – Jared Smith Oct 22 at 17:38
  • I forgot that details. But if it’s internal, maybe admins are supposed to be monitoring, for signs of abuse. And if it is truly internal, there might not be any privacy policy. – WGroleau Oct 22 at 17:43
  • This doesn't violate GDPR by default. GDPR states that there should be defined plan on what data is stored and how long, way to retrieve and delete it, access control and plan defining who has access, and audit trails to verify what has happened. This doesn't necessarily violate any of those. – Sopuli Oct 22 at 19:06
  • @Sopuli thanks for that. I don't deal with user data, so not really my area of expertise. – Jared Smith Oct 22 at 19:19
8

What would be the best way to handle this?

Your response to this depends heavily on how much trouble you want your colleague to get into.

The mild variant is to write him a strongly worded email along the lines of what Stephan's answer suggests, the key components are:

  • What he did is not okay.
  • You take violations of your privacy seriously
  • Ask him to stop
  • Ask him to confirm he read and acknowledged this email, via email.

Save copies of both emails on equipment or storage not controlled by the company. If your colleague is unwilling or unresponsive, or if you aren't feeling generous, directly proceed to:

Contact HR. Lay out what happened. Do this in writing (per email is best) and ask for confirmation that they've seen your report and are processing it. Save copies of both the report and any responses you get to storage not controlled by the company.

This may seem like gross overkill, but if you do end up going to HR or if your colleague reacts negatively, there's a real and non negligible chance that he might be summarily fired over this or make a complaint about you in retaliation.

In any cases with high stakes outcomes like these, you want to cover your bases.

  • 2
    It’s possible that saving company emails to mediums outside company control might breach workplace policies. Even just printing it out and taking it home might get him in trouble. – nick012000 Oct 22 at 8:39
  • Emails at work (even deleted ones) might be retained by the company for a long time. It's unlikely, but an email might come back to haunt him some time in the future. As friends, you should try to resolve this outside of company channels first. – user24582 Oct 22 at 12:29
4

Query what happened, and why

Reading the answers presented, I notice they either suggest going in guns blazing or backing off. I would suggest instead using this as an opportunity to ask questions about how the system is run, and specifically whether he knows it's your order (E.G. 'why did you mention X amount at me?'),if he does, why he knows it's your order, and finally, what privacy practices, if any, they have regarding personal customer information.

It's not unusual for a dev or admin to see private info within a system. Systems can be designed to obscure information (E.G. requiring a ref number to retrieve or using encryption). In the event of an issue (such as customer complaint), the information still has to be, for legal reasons, retrievable.

It isn't so much they saw the information, but they opted to comment, with the implication they may have searched for it (it's just as likely they may have stumbled across it because it's a large purchase).

Whether they know it's you or not, it's still a privacy breach: if they didn't know it's you, they tried to comment on a 'random' customer's purchase, which is unprofessional.

Raise the issue with their manager

If you feel it's a serious matter, you may want to raise it with their manager in private, specifically that you have concerns the retail shop lacks sufficient privacy safeguards, and propose that the software is modified to help keep customer's information private and have privacy rules implemented.

If you feel the colleague's behaviour was malicious, then you may also raise up your concerns about them at this juncture too, although the fact they texted you directly suggests they didn't understand what they were doing was wrong.

You'll want to gather information first about the incident before you start accusing or assuming, as it will both allow you to understand your colleague's reasoning and open a dialogue in the process. It will also allow you to present the other side, including any rebuttals, when raising your concerns with the manager.

3

This is definitely a data breach, violating the data protection act, and most likely illegal.

I would definitely talk to a superior within a given situation like this. Make sure you log all evidence; if you want to tell a superior

If not, I would speak to him outside work. I would say something along the lines of:

I know exactly what you did. You used admin access to view my private employee order. If you want to act like this is a game, be my guest but I am not hesitant to speak about this against you. If you want to go along that route, things will not go your way. I am being serious. Attempt this again and I will guarantee you will be (fired/punished etc.), if you want to continue, I will take things further.

  • I'm not a lawyer. Are you talking about UK laws? The post involves the USA. Are you referring to USA laws? Thanks! – James Oct 22 at 14:46
  • I am talking regarding UK laws, do you guys not have a data protection act? – yosh Oct 22 at 14:48
  • I don't know if any USA laws govern this situation or not. No one has mentioned any yet that I've noticed. – James Oct 22 at 14:49
  • @yosh yes, but nothing that would cover this. It was unethical and would likely result in a stern censuring or job loss, but likely not illegal per se (IANAL). There has been talk of adopting an GDPR-like law, but we're not there yet. – Jared Smith Oct 22 at 14:55
  • 2
    OP doesn't want him to be punished. – gormadoc Oct 22 at 15:53
1

No need to go into big detail on this answer. All you do is contact your companies Security team. They'll do the forensics on how this colleague got the information, and take any appropriate actions. He may get a stern telling off, or he may lose his job; in either case, it's his actions that have led to that, not yours.

  • What the colleague did may or may not be illegal, and it may or may not be grounds for termination. But the fact that the colleague did it indicates that the colleague can't be trusted with confidential information. The colleague almost certainly did a search on one of his colleagues, which is not appropriate: He used his access to company data to spy on a colleague. Then he was so excited by what he found that he just had to share the knowledge. That is wildly inappropriate. He's out of control, and this is not the last of it. I'd go straight to HR. – Ed Plunkett Oct 22 at 16:53
1

What would be the best way to handle this?

I think the first thing you should do is gather more information. You don't know who breached and why.

Here are some alternate scenarios:

  • The webapp crashed and the order needed to be manually submitted
  • The server was rebooted and the order needed to be manually submitted
  • Employee purchases is a manual process and the order is actually an email the whole department receives
  • Someone else saw your purchase and told your friend who pinged you
  • HR has to approve the discount, so the information was extracted and shared with several departments
  • Accounting has to approve the discount, so the information was extracted and shared with several departments
  • Orders with different shipping and billing addresses require human approval to move forward
  • Orders over a certain amount require human approval to move forward

There are probably another five or ten reasons someone may have come across the purchase details during the course of the business process.

Once you learn more, then you can plot a course of action.

One thing I would not do (that most answers seem to indicate), don't go on the offensive with talk of data breaches and hr involvement until you learn more. Imagine how far you would swallow your foot if things are not like you expect.

Also, since the order is company data handled by company employees, I doubt it qualifies as a breach per se. If you start raising data breach alarm bells you may only serve to discredit yourself.

1

I occupy this quadrant:

  1. Yes, this is unethical and a problem, but a minor one.
  2. You should treat it as if it were a minor problem (not a big one)

Assuming you want to continue a friendly relationship with this person, I would not imply that you're going to get HR involved -- as "please confirm that you've read this email" would. If I got such an email from someone, I would either be distraught that I so badly read our friendship (if I considered the person a good friend), or I would just make the mental switch and treat this person very neutrally and strictly professionally from now on, with no kidding around. In other words, if someone indicated that they're going to navigate social interactions with me through official business protocol, then that's how I'd treat them, too.

So with all that said: if this made you uncomfortable, just tell them that it did. It doesn't have to be a big deal: "hey, that text did kinda weird me out, fyi. I really do find it unethical." Be straightforward, and treat this exactly as much of a problem as you think it is: no less, but also no more.

That could have a few outcomes:

  1. There's a good chance the person will just apologize, and that'll be the end of the story. They'll be less likely to do it again.
  2. If they ask why, I wouldn't make up any straw man arguments like "what if I had been using the internal site to buy weird personal things." I also wouldn't mention that it could get them in trouble. Just tell them why it made you uncomfortable. Maybe it makes you feel like big brother is watching, maybe it just feels like an encroachment into personal space -- you know your reasons better than I do. Personally, I would consider even staring over someone's shoulder to read an email they're writing to be an invasion of personal space, and this is more than that.
  3. If they push back, you can either push back again or say that you don't want to get into it in more depth. Again, you know your feelings better than I do. If it were me, I'd say something like "I don't really want to get into it, it's not a huge deal. It just made me uncomfortable, and thought you should know. Let's drop it."

It sounds like you may have tried to do something along the lines of that third option with your reply text, but to be honest, it reads like a joking reply to me. If I were your colleague, I would interpret it as you agreeing that the joke was funny, and I wouldn't change my behavior in the future. It's okay to be direct, if you stick to your guns in terms of knowing how far you want to escalate the situation, and not letting it get past that.

As a bonus, treating this as a primarily social interaction -- not an official, professional one -- mitigates your question of seniority. If you're not appealing to official policy, there's no question of whether you have the authority or jurisdiction to appeal to it. You're just telling a person how their actions made you feel, and that's a perfectly reasonable thing for peers (or really anyone) to do.

protected by Snow Oct 23 at 12:13

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.