-7

information about one of my colleagues in the company’s server. Should I tell my colleague about what I saw or keep silent.

I’m asking for the best ethical viewpoint.

3
  • 2
    Details would be helpful. Depending on what the information is, where you saw it and who has potential access to it the answers could be very different.
    – Kaz
    Dec 27, 2022 at 21:34
  • 1
    @SergeMoubayed Why did you read it? Dec 28, 2022 at 0:07
  • Be prepared to answer why you read the files in the folder, when you new that might be a bad thing
    – cdkMoose
    Dec 28, 2022 at 17:33

2 Answers 2

5

I would raise the issue to IT or whoever is in charge of maintaining access to the server. They should in turn take steps to restrict access to or remove the data entirely and I would expect maybe a reminder email to the company about keeping personal information off of the server in the first place. Unless you have a dysfunctional corporate culture, reporting an issue will be smoother for you than, for example, trying to defend yourself if this person's information is misused later and IT has logs showing you accessed it at some point.

If you know the person reasonably well and the information isn't of an exceedingly private nature, I would let them know. IT should do so in any case however.

1
  • 2
    HR might have an interest also. It is their job to keep personal information private.
    – David R
    Dec 27, 2022 at 22:51
1

This is a potential Minefield, so tread carefully.

First question: Did you come across the information as part of a legitimate Work activity?

Second question: Is the information you saw prejudicial your colleague?

Third question: Was the information you saw covered by any Legislation (e.g. Privacy law, HIPAA, GDPA etc.)

Assuming the answer to the first question is 'yes', the correct course of action is to raise this with your manager:

"I was doing XYZ as part of my job and I inadvertently saw what I believe to be confidential information" - then let your Manager have the Conversation with HR/The IT Team about locking down access to the correct people.

In regards to the second question - This is more a case of 'why would you consider telling the person in question?' - assuming you saw say a spreadsheet titled 'people we are going to fire in the next 6 months' and your colleague's name was in there, then perhaps I might drop them a hint that "You might want to look for another job, in say... the next 6 months" - I wouldn't go much further than that, and even then - I would only do that for people I really liked at work.

The last question can be either the most or the least important concern - most regulatory bodies where data is concerned have a degree of good faith to minor accidents (where it wasn't caused by gross negligence) so long as they are fixed quickly, however depending on what was seen and how covered it is, there might be legal ramifications.

The most pragmatic course of action is to alert your management and then let them deal with it and pretend you never saw anything.

If you are looking out for your friend - an off-the record hint is probably the most you could do, and even then - if you've alerted management that you saw something and then another colleague (who the something was about) starts acting funny - it's not going to take Sherlock Holmes to figure it out...

3
  • Okay, so if it's Personal Info and therefore info that's known to the individual, then simply raise this with your management team, you don't need to let the person whose info it was know - your only obligation is to make sure the issue is passed onto the team who can fix it. Dec 29, 2022 at 7:39
  • @SergeMoubayed: "3- I don’t know how to answer this question, I don’t think it’s in the scope of the issue" – The reason for this question is that depending on the kind of data, there may be legal reporting requirements. For example, for the kind of data you describe, in my country, there is a legal requirement to report a data breach to the proper authorities "without delay", at the latest after 72 hours. Failure to do so can incur a fine of up to 20 million Euros or 4% of the worldwide annual revenue, whichever is higher. Considering that you posted this question over 111 hours ago, your … Jan 1, 2023 at 13:46
  • … employer may already be in violation. Jan 1, 2023 at 13:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .