I work in a small office in Scotland and the company main office is in England. Every month, the payslips for everyone is mailed to our office and as I sit closest to the door, I usually handle the mail. A few weeks ago, I made a mistake in handing out the payslips and ended up opening someone's payslip and looking at the figures.

My manager and HR had been giving me lecture about how it is against Data Protection etc and that the company will keep a record of this incident for 6 months.

I don't think this will have any impact on my job, but I am really annoyed at how they are blaming me for a simple mistake when they have taken absolutely no measures in preventing or reducing the chance of this Data Protection issue. For example, the company could have sent the payslip to home address of each person instead of our small office leaving us to sort it out.

What I wanted to know is the legal duty of the company in keeping the payslip information secure, because from the way my manager talked, he made it sound like it is all my fault and not the company at all.

Just to make it clear. The issue according to the company is what I did is against Data Protection Act. And according to Principle 7 of the act, the company has a legal duty to take appropriate measure to ensure security. The company has no policy for protecting the information in the payslips. So when I accidentally open someone's payslip, I break no company policy (because there are none in this case). I wanted to know how much is my fault and how much is the company's fault according the the Data Protection Act.

As I mentioned in one of the comment, it looks more and more like I am trying to get legal advice.

| improve this question | | | | |
  • 4
    Voted to close, as this explicitly asks about legal advice, which we cannot give. That said, the same could have happened with other types of confidential mail, e.g., bids/tenders or anything else which would necessarily arrive at the office, not at someone's home address. You will need to make sure you don't inadvertently open the wrong envelope – Stephan Kolassa Apr 15 '15 at 11:31
  • 4
    It is up to you to read an envelope before you open it. The company is within the law when sending the payslips to your office, you made the mistake of opening someone else's payslip because you weren't being careful enough. You should accept responsibility for the mistake instead of trying to find a way to blame the company. – clairebones Apr 15 '15 at 11:45
  • 1
    I admit I made a mistake, so what? People make mistake, that cannot be changed. We have a system where a single mistake (me), caused it to failed. A good system would require multiple point of failures before it would failed to reduce the chance of it happening. The more I think about it, it does sound like I wanted legal advice on if the company is required to provide a system to protect employee data. – user34100 Apr 15 '15 at 12:30
  • 2
    If the company appoints someone to collect the mail, then one precaution the company should take is to make sure the person who gathers the mail from the shared mailbox knows how to do it properly. If it were me in charge, I would have thought that the rule "don't open a letter that is not addressed to you" was already obvious, so I may not have bothered to explicitly mention it during the training. Maybe I missed something, but I don't really understand from the Q exactly how you "accidentally" opened it. Was the addressee too similar to your name or something and could be an honest mistake? – Brandin Apr 15 '15 at 12:36
  • 1
    What would your multiple point of failure system look like? Sending individual payslips to home addresses would've prevented you from making your error but increases the chance of loss and misdelivery and is still vulnerable to being opened by someone other than the named individual who happens to be in their home. Sometimes there is no sensible alternative to trusting someone to be careful. – Nigel Harper Apr 15 '15 at 14:12

I am not a lawyer and this is not legal advice.

"I made a mistake in handing out the payslips and ended up opening someone's payslip"

I'm assuming that the payslip was addressed to the right person, and that you opened it thinking it was yours. Yes, that's a mistake, but it's a fairly serious mistake - one that requires a certain amount of inattention to make. Most people go through entire careers without opening mail that is addressed to someone else, especially mail they know is important before they open it.

You ask if "the company has a legal obligation to keep payslip information secure", and they do. They fulfilled it by instructing one of their employees (you) to deliver the payslips without opening them and looking at them. You failed to do that.

You claim you admit to your mistake, but you seem very unwilling to face up to the consequences of making it. Owning up to the consequences is an important part of owning up to the mistake. In my opinion the company is being entirely reasonable. You are probably right that this will have no long-term effect on your career, as long as you don't do it again, and as long as you react to the situation well. Your current attitude is not 'reacting to the situation well'. Frankly it could have been worse - the company might be investigating whether you had opened the payslip deliberately, and the result of that might have been a firing. That would have been heavy-handed, but possible.

What I would recommend you focus on is what you are going to do to prevent this recurring. How about the simple thing of taking five seconds to always read the name on your payslip before opening it? How about an additional couple of minutes (per month!) to double-check the name on everyone's payslip right before you hand it to them? Posting to this forum has probably taken up more of your time than doing that for the next year.

"I made a mistake, but it's not my fault" never goes down well.

| improve this answer | | | | |

I am not a lawyer, and this does not constitute legal advice.

Firstly, it is your employer’s responsibility to ensure that employees receive Data Protection Act training and to prevent personal data being disclosed. An employer failing to comply with this can be reported to the Information Commissioner’s Office (ICO) and face penalties up to £500k.

Secondly, you can tell your employer to take this note off file. An employer cannot hold irrelevant data about you if you request it to be removed. Failure to do so can be reported to the ICO.

That’s the legal part. Should you take the heavy handed approach and squash your employer in the courts? I wouldn’t recommend it. It might be better to take the slap on the wrist. If you do decide to take the legal route, discuss it with a lawyer first, as this does not constitute legal advice.

| improve this answer | | | | |
  • 1
    To get the note removed you would need to prove that it is irrelevant. I don't see how that is possible, given that it's a record of something the OP actually did. – DJClayworth Apr 15 '15 at 13:36
  • 1
    As the OP was the person responsible for the breach of data security, reporting anyone to the information commissioner is going to be hugely counterproductive. – DJClayworth Apr 15 '15 at 13:52

Not the answer you're looking for? Browse other questions tagged .