Should I speak about seeing private information about a person?

Question

information about one of my colleagues in the company’s server. Should I tell my colleague about what I saw or keep silent.

I’m asking for the best ethical viewpoint.

Answer 1

I would raise the issue to IT or whoever is in charge of maintaining access to the server. They should in turn take steps to restrict access to or remove the data entirely and I would expect maybe a reminder email to the company about keeping personal information off of the server in the first place. Unless you have a dysfunctional corporate culture, reporting an issue will be smoother for you than, for example, trying to defend yourself if this person's information is misused later and IT has logs showing you accessed it at some point.

If you know the person reasonably well and the information isn't of an exceedingly private nature, I would let them know. IT should do so in any case however.

Answer 2

This is a potential Minefield, so tread carefully.

First question: Did you come across the information as part of a legitimate Work activity?

Second question: Is the information you saw prejudicial your colleague?

Third question: Was the information you saw covered by any Legislation (e.g. Privacy law, HIPAA, GDPA etc.)

Assuming the answer to the first question is 'yes', the correct course of action is to raise this with your manager:

"I was doing XYZ as part of my job and I inadvertently saw what I believe to be confidential information" - then let your Manager have the Conversation with HR/The IT Team about locking down access to the correct people.

In regards to the second question - This is more a case of 'why would you consider telling the person in question?' - assuming you saw say a spreadsheet titled 'people we are going to fire in the next 6 months' and your colleague's name was in there, then perhaps I might drop them a hint that "You might want to look for another job, in say... the next 6 months" - I wouldn't go much further than that, and even then - I would only do that for people I really liked at work.

The last question can be either the most or the least important concern - most regulatory bodies where data is concerned have a degree of good faith to minor accidents (where it wasn't caused by gross negligence) so long as they are fixed quickly, however depending on what was seen and how covered it is, there might be legal ramifications.

The most pragmatic course of action is to alert your management and then let them deal with it and pretend you never saw anything.

If you are looking out for your friend - an off-the record hint is probably the most you could do, and even then - if you've alerted management that you saw something and then another colleague (who the something was about) starts acting funny - it's not going to take Sherlock Holmes to figure it out...