4

I'm looking for a way of handling an issue where my employer accessed HR data to share my mobile phone number with another employee. This was to use their own personal phone to contact me in what they considered an emergency. IMO it wasn't an emergency for which they needed to contact me urgently or directly.

Personally my objection is on the basis of privacy. I control who has access to my personal number, not my employer. The company is making noises of grudging acceptance, but has placed the onus on me to be contactable while at the same time saying that a company mobile isn't possible. There are even suggestions that I should be widely contactable outside of core working hours. My outgoing manager (retiring soon) has suggested that sharing of my number is confined to only a small group of users.I'm not comfortable with the possibility of further sharing of my mobile no.

I always screen incoming calls so unknown numbers are always ignored (As in this case, I didn't answer the call as I didn't recognize the originating number). My problem now is how best to respond.

I've re-edited this question to concentrate on the central issue without other distracting information. I'd appreciate answers that reference both obligations and rights under GDPR, as well as strategy for tackling the issue with my managers.

6
  • 2
    @sf02: That is not universally true in all of IT. If it is true in some country, people should fight against it.
    – guest
    Jan 15 at 13:45
  • @psubsee2003 Thanks, I'm still getting used to this editor, I did think it odd that the returns didn't form paragraph spacings as expected.
    – Charemer
    Jan 15 at 14:09
  • 4
    @sf02 It's never been part of my job to provide out of hours support except in full on disaster recovery situations. Also it might surprise you to know that IT support and security officer are secondary and tertiary roles. My main role is database engineer.
    – Charemer
    Jan 15 at 14:11
  • 4
    @Charemer Even though those roles are not your primary role, they are still your roles in this company. Your employer believed the situation to be enough of an emergency to warrant contacting you after hours. Whether you agree or disagree with their assessment is a different matter altogether.
    – sf02
    Jan 15 at 14:40
  • @Charemer, FYI, I posted a slightly-related question a few years ago here: workplace.stackexchange.com/questions/101812/…. Not a duplicate, but maybe some of the comments there are useful?
    – spuck
    Jan 15 at 19:22
11

I'd like to de-escalate that response

Then stop riding the security angle. It escalates the situation and does nothing constructive to address the root cause.

It seems that my original incident report has triggered a nuclear level response

Of course it did. You started swinging the legal hammer, which is perceived as a threat. Legal arguments should always be a means of last resort only after everything else has failed.

I always screen incoming calls so unknown numbers are always ignored

That's probably the best path to a compromise. Given the scam level these days that's pretty much standard practice and hard to argue with. You can potentially agree to give your phone number, to 2 or 3 key people in the company and put these in your contact list. Then you can discuss with these key people what the rules of engagement are: what are the list of emergencies that warrant a call, how often do they expect these would happen, and what would you be supposed to actually do in these cases and what the expected outcome is.

Being specific about what constitutes an acceptable reason for out of work contact will help you to assess of how much a deal this would be. If it's maybe one call a month, that's probably all right. If it's 2 a day, it clearly isn't. At least not without extra pay or compensation.

while maintaining the privacy of my private phone number .... However I'm not comfortable with the possibility of being called outside of working hours

You may have to give a bit on these or prepared to pick a fight which probably will end your career at this employer,

3
  • 2
    thanks for your answer and suggestions, I haven't so far 'swung the legal hammer' at all. I just raised a possible security incident through the standard channel as I should. It's the company that has come back with a hard nosed legal approach. I'm actually expected to monitor regulatory compliance. I'd already supplied my phone no. to the relevant people in case of emergencies (and recorded their's in turn so I would answer their calls). I strongly suspect your last paragraph to be highly accurate.
    – Charemer
    Jan 15 at 16:15
  • 2
    @Charemer: Security incidents are legal incidents, and quite serious ones at that. A security incident can expose a company to a lot of legal liability in a very short timeframe. That liability will be much higher if documents emerge showing that employee X told them about vulnerability Y and they did nothing. Therefore, when you raise a security incident, you should assume that lawyers are going to get roped into it, because that's what a wise business will do.
    – Kevin
    Jan 16 at 6:39
  • 1
    @Charemer: The fact that you tagged this question as GDPR proves that you understand the legal consequences of privacy violations - which is specifically the issue you're raising with your employer. Of course they're going to go on the legal defensive.
    – Flater
    Jan 18 at 13:44
4

There are even suggestions that I should be widely contactable outside of core working hours. My outgoing manager (retiring soon) has suggested that sharing of my number is confined to only a small group of users. However I'm not comfortable with the possibility of being called outside of working hours. Or of the possibility of expanded sharing of my mobile no.

The question is how would people contact you? Your employer made it clear that they want to contact you outside of working hours.

The issue you listed sounded serious. Phones were out and you're the main POC for it. So why can't they contact you?

I always screen incoming calls so unknown numbers are always ignored. (as in this case, I didn't answer the call as I didn't recognise the originating number). My problem now is how to respond, it seems that my original incident report has triggered a nuclear level response. I'd like to de-escalate that response while maintaining the privacy of my private phone no.

So it sounds like you're listing multiple issues. I'm not sure exactly what problems you're trying to address. The issue of them accessing HR data to get your phone or the fact that you decided to ignore a phone call?

First I would mention that you were not contacted by that phone before and that you do not answer phone calls that you do not recognize. And secondly, I would establish clearly how you'd like to be contacted outside of work.

Be prepared that they may decide that they need to contact you and you need to be available. So you must work something out where you can respond as fast as possible to incidences.

10
  • 4
    I'm not objecting to my employer contacting me in emergencies at any time: via established channels (laid on in our Disaster plan) or for any reason during working hours. Internet down for a brief period is not an emergency, it's a regular occurrence. My employer has just now (after 4 years) decided that they want me contactable outside of working hours without consultation. Previously when out of hours standby has been required by previous employers a payment for being on standby was made. I'd expect the same here.
    – Charemer
    Jan 15 at 14:17
  • 6
    "My employer has just now (after 4 years) decided that they want me contactable outside of working hours without consultation. Previously when out of hours standby has been required by previous employers a payment for being on standby was made. I'd expect the same here". That significantly changes the nature of your original question... like to the point where it's a completely different question imho...
    – neubert
    Jan 15 at 14:27
  • 2
    @neubert Proper channels in a disaster situation are to contact my manager who will contact me. Not share my phone number with the nearest passing employee. Office internet down and up 10 minutes later all on it's own is normal. it is not a disaster. The building flooding or blowing up is a disaster.
    – Charemer
    Jan 15 at 14:32
  • 2
    @Charemer I would just say that the established disaster plan for the past 4 years has been to contact your manager first who will then contact you. If they decide that's not the case and that now they're going to contact you directly, then you have a choice to either comply or leave. No laws or some magical speech is going to change their minds short of you telling them that it is not something you're willing to do and that you found a new job and turning in your 2 weeks notice.
    – Dan
    Jan 15 at 16:32
  • 2
    @Charemer As I said in my answer, I think this is a pretty severe issue. Perhaps they went to HR because they just wanted to make sure that you knew about the issue. To me, it sounds like a 1 off event. However, I get that you have a slight attitude and smart-alecky response to everything and I'm a bit surprised they didn't fire you on the spot. That's nothing personal to you just that some people come off like that and it takes a little to get used to.
    – Dan
    Jan 15 at 17:09
1

I was also contacted via Skype from my technical director who had been my direct manager until recently. And also by our external network support contractor. So from my POV it wasn't necessary for anyone else to contact me by any means.

The person who contacted you may well not have known that other people had contacted you about the situation. If there's a fire people are usually gonna do whatever it takes to get the issue resolved. If they don't then their own heads are liable to roll so contacting you kinda doubles as a CYA (cover-your-ass) move.

This response listed company policy and procedure as justification for consent to processing (even though both documents cited were formulated long after commencement of employment).

Had you read and signed off on that company policy?

Even if you hadn't, before the company policy and procedure had been drawn up the informal company policy was probably something along the lines of "use your own judgement". Judgement, of course, being a subjective thing, limited based on what you know.

while at the same time saying that a company mobile isn't possible

Maybe you should get a second phone number yourself then? I mean, you don't get a company car to drive to work, do you? Do you get reimbursed for gas when presumably driving your personal car to work? Do you get reimbursed for the clothes you wear to work?

Just because a personal resource may be used in the commission of your job doesn't mean that you ought to get reimbursement for it - you're expected to spend out of your own pocket for some resources.

You're the one that has the problem with your current phone number being handed out - not your company - so it seems to me that the onus is on you to resolve the situation with your own money.

However I'm not comfortable with the possibility of being called outside of working hours. Or of the possibility of expanded sharing of my mobile no.

Seems to me that that goes hand in hand with being the "1st line IT support"? And if it's such a big issue then you probably should have made that very clear when you were interviewed for the position to avoid the situation you're in right now. Maybe that would have resulted in them going with another candidate but at least there wouldn't be any surprises...

1

First off, get yourself a Google Voice number. It's now available in the UK.

It can forward your calls. It can convert your calls to text and send them to you by email (previously, it could send SMS too, but that feature has been discontinued in the US at least. I don't know about the UK). It can whitelist numbers. It can be scheduled and programmed like you wouldn't believe. And all that awesome functionality actually comes for free.

The only problem is that it might not work during a true disaster, but then again, I'm not sure mobile phone networks would work either.

In addition to that, you may need to block your cell phone from broadcasting your caller id, either that, or use Google Voice to call others when you need to reach them via phone.

I'd like to de-escalate that response while maintaining the privacy of my private phone number.

Just think about what they're saying. Find a kernel of truth that you can agree with. And apologize for that part. You do not need to apologize for everything.

Also, if you don't think the incentives are properly aligned, maybe consider asking for extra pay each time they contact you outside of work hours.

2
  • Google voice is a good suggestion, and one I already made to my managers, they don't seem to want to pay the £7.xx a month for it though.
    – Charemer
    Jan 18 at 10:54
  • @Charemer, Again, I really don't think you would need the paid version, the free version should work just fine. Your employer doesn't even need to know you're doing this. You could just change your emergency contact number with HR and that's it. Just be sure to use your google voice number frequently enough, otherwise Google will recycle it and give it to someone else. Jan 19 at 0:32
-3

You dun F'ed up.

You call yourself the security officer and 1st line support and complain when the company has a security incident and needs to call you?

Then why did you give your phone number to HR? Who is expected to use this number if not emergency personnel?

Then you had the gall to "raise a report" to every HR and management in the company and you're surprised by their response?

I honestly can't tell if you're trolling or if this is real. IT security is not right for you, look for another line of work. Also your job at this company is finished now that they realize how unreliable you are and how much of a drama queen you are.

I wish you luck in your next job.

1
  • 2
    No, the company call me security officer and firstline support. I'll amend the question. I am a senior data engineer.
    – Charemer
    Jan 15 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .