Boss used my sensitive PII data without authorisation

Question

I work on the CRM system in a large recruitment agency in the UK. I applied for several jobs through job boards and spoke to a recruiter from the same agency as we work for and we discussed what I was looking for, experience and why I was leaving. A week later, my boss books in a last minute meeting before I go on annual leave where I was blindsided that she knew I was looking for a new job and how she knows is being looking through the system, opens my record and sees the application. I then tell her a generic reason as to why I'm leaving. She then says she's looked into the reasons why I'm leaving and then confronts and makes me explain each point in detail that I had discussed with the recruiter. I am visibly upset and the meeting is over a hour long. My private information was not obfuscated, I did not share my opinions openly and was used against me in work situation. I want to raise a grievance with HR and not return after my annual leave for the situation that I was put in. Can I do this? and her looking into my record to get this information, is this legal?

Answer 1

If you're in Europe, don't talk to HR. Talk to the Data Protection Officer.

You mention the acronym PII (Personal Identifying Information) in your question, so presumably you live somewhere covered by the GDPR, right? PII is a term associated with that piece of EU regulation.

If so, then I'd suggest that you refrain from talking to HR, but that you should rather talk to your company's Data Protection Officer about a data breach. If you're working for a company in an area covered by the EU, then your company is legally required to have one, and leaking your customer data to your manager seems like it would likely constitute a personal data breach.

As such, your employer would be legally obligated to both document that this breach occured, and to report the breach to the supervisory authority in your country within 72 hours.

Answer 2

Most likely recruiter, manager and company are liable for GDPR breaches.

I'd suggest contacting a lawyer and refrain from talking about this subject with anyone other than your legal counsel.

Make sure you keep records of the meeting, if any notes were taken, what was discussed, what PI (full name, full address, email, phone number etc) was presented in clear text.

Avoid interaction with HR as they will most likely move to mitigate all possible repercussions for your employer. This might result in your swift termination and removed access to any evidence that a GDPR data breach occurred. Basically it will be your word against theirs.

In the meantime, you can file a Right to Restrict processing request for your employer

See https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-restrict-processing/

Answer 3

If this was handled this way with me, I'd have decided to leave immediately, and walked out.

Regardless of the legalities of it, it's extremely unprofessional for your manager to have handled this in this way. It seems almost as though she took personal offense to the reasons you gave and tried to sit there and bicker with you about them.

A good manager would realize... that's futile and petty.

They can't argue away your own perceptions and experience.

She should have realized you were on your way out and started working towards a transition.

"Oh, I see you've started making applications. I understand. Please let me know if there's anything we can do while you're looking, and to make things easier on us, I'd like you to start documenting / shoring up some knowledge transfer documents.

As you haven't accepted an offer, please let us know if your status changes or if you have a date in mind, and we can discuss remaining work goals."

^ That is, in reality, about the sum of productive conversation that could be had after she realizes you're putting in apps for new work.

As others have noted there may be issues with this with GDPR. You should review what terms you agreed to when submitting the job application as well.

Seperate from that, though, it would have been good corporate policy to obscure this data somehow from an employee's current management, in the system, or to warn an employee that this might occur if they are currently an employee and submit an application through them.

Answer 4

This seems like very obviously a non-issue to me.

Your manager manages people who have your job. That's their job. That means they have a role in hiring, firing, evaluating, and adjusting compensation for people who have your job. That means they must be aware of the talent pool for your job, that's part of their job.

You gave your information to the recruiter so that they could share it with people who hire people who have your job. That's the explicit reason you gave it to them. That's the people who you wanted them to share it with.

Now they shared it with someone who is in that exact group of people you wanted them to share it with who has a definite need to know information like this in order to do their job.

I'm baffled why you're upset about this.

If you didn't want people who hire people who have your job to know this information, why did you share it with a recruiter?

I want to raise a grievance with HR and not return after my annual leave for the situation that I was put in. Can I do this?

Sure, but there's no point since everything that occurred was entirely appropriate.

and her looking into my record to get this information, is this legal?

Yes. Her job requires her to have this information and her accessing it was well within the scope for which you gave it. There's no argument that anything improper occurred here that's even remotely plausible.

Answer 5

As I understand it:

• You work for a recruitment agency

• You contacted the same recruitment agency to apply for a new job and gave your details

• Your boss, that works at the same recruitment agency, sees your details

I'm not a lawyer, but - I don't see how this breaks any data privacy regulations. It's not like your details were shared outside the recruitment agency.

(note: UK companies must comply with the UK data protection law and the "UK GDPR")

You could try to argue some type of misuse of your data, but I don't think you'll have much luck. I can think of many situations in which the boss could have seen or accessed your data under legitimate circumstances. Pursuing this seems like an unnecessary stress if you are leaving the company anyway.

You are not required to explain or provide a reason as to why you decide to leave a company. The company can ask, but you don't have to answer.

You could raise a complaint about your boss, and how they made you feel pressured to answer questions, but what do you expect out of this?

If you want your notice period waived, try asking first. Some companies will just waive it.

If your intention is to leave, then I wouldn't bother with complaints or legal action. By the time anything gets done, you'll have finished your notice.

Answer 6

Before starting any job search, you should try to communicate your concerns & needs to your current employer, and give them opportunity to accommodate you. If they can't (or won't) meet your expectations, it would be understandable to everyone involved for you to be looking for other opportunities (on your own time) while continuing to perform your work to meet their expectations.

With my last employer, I made my manager aware of my concerns and needs, which he sympathized & supported, but the company was not in a position to accommodate. I'm sure he expected that I had a side hustle or was looking for other opportunities.

I even made the same mistake you did, except that the recruiter in my case informed me immediately, before I could even really signal that I was considering a move, that it would be a conflict of interest to work with me while I was still employed with a client employer.

I am not a lawyer, but I believe the recruiter at the agency your employer works with would bear some ethical responsibility here. But unless the conversation was recorded or transcribed, it could be difficult to prove that the recruiter was breaking the law by allowing you to provide them information. They could even be contractually obligated to provide that information to their client / your employer. And your employer receiving & acting upon that information is not legally or ethically wrong.

The way you describe the conversation with your boss, it sounds like it was confrontational & made you uncomfortable. If that is part of a larger pattern of interaction, or if some part of the reason you were looking for other opportunities was your boss or other co-workers, that is definitely be something to discuss with HR.