Colleague used admin access to view my private employee order

Question

A colleague of mine in a different department is a developer for an internal, employee-only discounted retail site within our company. Today, I made a rather large purchase on that site before heading out of the office. Ten minutes later, I get a text from him

Hey, some people are kinda crazy. They spend like almost $X bucks on [site name] all at once!

where the amount he referred to is exactly what I had spent. Now, I know he meant the text itself as a joke but I was immediately shocked by this because this felt like a huge breach of my privacy. From my understanding, it's not like the developers on his team are getting emails per every invoice -- where he might have seen my name slip in an email subject line or something, but they do have an admin account (and database access). I was even more wary of the fact that he knew I had placed an order within 10 minutes when I know the site gets traffic in the thousands. I replied to his text, "Yeah big breach of privacy issue you guys have huh" and he responded with just, "lol".

As a developer myself, I feel that this is extremely unethical but I'm not sure if I'm overreacting. We've been forming a friendship outside of the office (both have been here for about the same five months) and I find him to be hard-working, a talented developer, and an all around benevolent individual. So my bias in that regard may be the motivation for the fact that I don't want to see him fired but I imagine taking this to his supervisor could result in termination. I also don't know if I am in the position to talk to him about this as I'm not his senior (except in age by a couple years). For context, if it matters, he's in his mid-twenties.

What would be the best way to handle this?

Answer 1

I'm going to go against the grain here. I'm probably wrong based on all the other answers and I'm looking forward to learning something from your comments. I'm also in the USA.

I think this is no big deal and you shouldn't push back.

Your colleague is a developer for the retail site. He could easily be monitoring the transactions and you jumped out as a familiar name. As far as we know he didn't somehow capture your sensitive information: SSN, CC#, etc. There's no indication that your purchases were of a sensitive nature: medications, undergarments, etc.

To me, this isn't any different from a colleague cashier at a grocery store smiling and saying "Wow, $60 on steaks all at once!"

Answer 2

Backend developer myself, I regret it's not uncommon from developers that have admin access to a database to witness private information being in it. It's also likely that because the retail site is internal, the company had/have lower security and privacy standards about it.

It is possible that this developer got you in a course of debugging something and just wanted to share because he thought it was funny, you can't be certain he's been breaching your privacy in a deliberate way. Possibly also, he doesn't understand how private is this data. Some benefit of doubt should be apparent on your exchanges, but you can definitely insist on the fact you feel uneasy about the issue.

I feel uneasy about the fact our purchases are in clear. It should be anonymous data, don't you think ?

And see where this is heading. It's likely that implementing the anonymization feature is going to be rejected by either your colleague or even his management. Raising the point definitely makes it clear your view is that this data should be private to everybody, yet avoiding pitfalls of a too harsh accusation toward your colleague.

Answer 3

If you talk to him outside of work, then you can do that and tell him a few things.

1. What he did was a severe breach of privacy.
2. In his position, he can be fired for breaches of privacy.
3. If the company is caught not respecting people’s privacy it can get expensive.
4. You are not complaining to HR this time and this time only.
5. If you hear of other cases you will complain.
6. This must never happen again.
7. This is not a game. This is serious.
8. Do you understand?

Answer 4

I would send him this email using your corporate email address:

If you have a script notifying you of other employee's purchases, that is not ok. And even if you don't have such a script, or if your script was for debugging purpose, your message to me was still not appropriate either way.

Do you understand what I'm saying? Please respond to let me know that you understand.

Obviously, use your own words.

If he still ignores your concern, or doesn't acknowledge the fact that he made a mistake, then threaten to bring this up to HR or to his supervisor.

This needs to be nipped in the bud right away. I understand that he's your friend, but if he doesn't understand the line he's crossed, he's going to cross it with someone else who isn't going to be as understanding.

Remember that Google employee who got fired for breach of privacy. I'm sure that he wish that a coworker had knocked some sense into him before he lost his job.

Answer 5

I'm going to suggest a course of action based on the information that you and the other developer have been forming a friendship and talk outside of work.

Talk to the developer, in person or by phone call, outside of work, about this. Do not use texts, social media, and certainly not any official channel like work slack or email. Leave no paper trail that suggests you know about the breach beyond what already exists.

When you have the conversation, it should go something like this:

Look, you know I don't really care (even though you actually do), but you could lose your job for this. Some humorless HR drone would take one look at this and not realize or care that it may have been a complete coincidence that you happened to be looking at the traffic when I made the purchase and that you and I are friends. I could even get in trouble possibly at this point because now I know about you breaching privacy and I'm doing you the solid of not reporting it. Not cool. Not trying to be a buzz-kill, but please be a little more discreet in the future.

If I have misread the level of friendship you have with this person, then I would still do a less casual version of the above. You're lucky (at least for the purposes of this conversation) to be in the US: if it was the EU it could be (IANAL) construed as a breach of the GDPR.

Answer 6

What would be the best way to handle this?

Your response to this depends heavily on how much trouble you want your colleague to get into.

The mild variant is to write him a strongly worded email along the lines of what Stephan's answer suggests, the key components are:

• What he did is not okay.
• You take violations of your privacy seriously
• Ask him to stop
• Ask him to confirm he read and acknowledged this email, via email.

Save copies of both emails on equipment or storage not controlled by the company. If your colleague is unwilling or unresponsive, or if you aren't feeling generous, directly proceed to:

Contact HR. Lay out what happened. Do this in writing (per email is best) and ask for confirmation that they've seen your report and are processing it. Save copies of both the report and any responses you get to storage not controlled by the company.

This may seem like gross overkill, but if you do end up going to HR or if your colleague reacts negatively, there's a real and non negligible chance that he might be summarily fired over this or make a complaint about you in retaliation.

In any cases with high stakes outcomes like these, you want to cover your bases.

Answer 7

Query what happened, and why

Reading the answers presented, I notice they either suggest going in guns blazing or backing off. I would suggest instead using this as an opportunity to ask questions about how the system is run, and specifically whether he knows it's your order (E.G. 'why did you mention X amount at me?'),if he does, why he knows it's your order, and finally, what privacy practices, if any, they have regarding personal customer information.

It's not unusual for a dev or admin to see private info within a system. Systems can be designed to obscure information (E.G. requiring a ref number to retrieve or using encryption). In the event of an issue (such as customer complaint), the information still has to be, for legal reasons, retrievable.

It isn't so much they saw the information, but they opted to comment, with the implication they may have searched for it (it's just as likely they may have stumbled across it because it's a large purchase).

Whether they know it's you or not, it's still a privacy breach: if they didn't know it's you, they tried to comment on a 'random' customer's purchase, which is unprofessional.

Raise the issue with their manager

If you feel it's a serious matter, you may want to raise it with their manager in private, specifically that you have concerns the retail shop lacks sufficient privacy safeguards, and propose that the software is modified to help keep customer's information private and have privacy rules implemented.

If you feel the colleague's behaviour was malicious, then you may also raise up your concerns about them at this juncture too, although the fact they texted you directly suggests they didn't understand what they were doing was wrong.

You'll want to gather information first about the incident before you start accusing or assuming, as it will both allow you to understand your colleague's reasoning and open a dialogue in the process. It will also allow you to present the other side, including any rebuttals, when raising your concerns with the manager.

Answer 8

This is definitely a data breach, violating the data protection act, and most likely illegal.

I would definitely talk to a superior within a given situation like this. Make sure you log all evidence; if you want to tell a superior

If not, I would speak to him outside work. I would say something along the lines of:

I know exactly what you did. You used admin access to view my private employee order. If you want to act like this is a game, be my guest but I am not hesitant to speak about this against you. If you want to go along that route, things will not go your way. I am being serious. Attempt this again and I will guarantee you will be (fired/punished etc.), if you want to continue, I will take things further.

Answer 9

No need to go into big detail on this answer. All you do is contact your companies Security team. They'll do the forensics on how this colleague got the information, and take any appropriate actions. He may get a stern telling off, or he may lose his job; in either case, it's his actions that have led to that, not yours.

Answer 10

What would be the best way to handle this?

I think the first thing you should do is gather more information. You don't know who breached and why.

Here are some alternate scenarios:

• The webapp crashed and the order needed to be manually submitted
• The server was rebooted and the order needed to be manually submitted
• Employee purchases is a manual process and the order is actually an email the whole department receives
• Someone else saw your purchase and told your friend who pinged you
• HR has to approve the discount, so the information was extracted and shared with several departments
• Accounting has to approve the discount, so the information was extracted and shared with several departments
• Orders with different shipping and billing addresses require human approval to move forward
• Orders over a certain amount require human approval to move forward

There are probably another five or ten reasons someone may have come across the purchase details during the course of the business process.

Once you learn more, then you can plot a course of action.

One thing I would not do (that most answers seem to indicate), don't go on the offensive with talk of data breaches and hr involvement until you learn more. Imagine how far you would swallow your foot if things are not like you expect.

Also, since the order is company data handled by company employees, I doubt it qualifies as a breach per se. If you start raising data breach alarm bells you may only serve to discredit yourself.

Answer 11

I occupy this quadrant:

1. Yes, this is unethical and a problem, but a minor one.
2. You should treat it as if it were a minor problem (not a big one)

Assuming you want to continue a friendly relationship with this person, I would not imply that you're going to get HR involved -- as "please confirm that you've read this email" would. If I got such an email from someone, I would either be distraught that I so badly read our friendship (if I considered the person a good friend), or I would just make the mental switch and treat this person very neutrally and strictly professionally from now on, with no kidding around. In other words, if someone indicated that they're going to navigate social interactions with me through official business protocol, then that's how I'd treat them, too.

So with all that said: if this made you uncomfortable, just tell them that it did. It doesn't have to be a big deal: "hey, that text did kinda weird me out, fyi. I really do find it unethical." Be straightforward, and treat this exactly as much of a problem as you think it is: no less, but also no more.

That could have a few outcomes:

1. There's a good chance the person will just apologize, and that'll be the end of the story. They'll be less likely to do it again.
2. If they ask why, I wouldn't make up any straw man arguments like "what if I had been using the internal site to buy weird personal things." I also wouldn't mention that it could get them in trouble. Just tell them why it made you uncomfortable. Maybe it makes you feel like big brother is watching, maybe it just feels like an encroachment into personal space -- you know your reasons better than I do. Personally, I would consider even staring over someone's shoulder to read an email they're writing to be an invasion of personal space, and this is more than that.
3. If they push back, you can either push back again or say that you don't want to get into it in more depth. Again, you know your feelings better than I do. If it were me, I'd say something like "I don't really want to get into it, it's not a huge deal. It just made me uncomfortable, and thought you should know. Let's drop it."

It sounds like you may have tried to do something along the lines of that third option with your reply text, but to be honest, it reads like a joking reply to me. If I were your colleague, I would interpret it as you agreeing that the joke was funny, and I wouldn't change my behavior in the future. It's okay to be direct, if you stick to your guns in terms of knowing how far you want to escalate the situation, and not letting it get past that.

As a bonus, treating this as a primarily social interaction -- not an official, professional one -- mitigates your question of seniority. If you're not appealing to official policy, there's no question of whether you have the authority or jurisdiction to appeal to it. You're just telling a person how their actions made you feel, and that's a perfectly reasonable thing for peers (or really anyone) to do.