5

I am working on a project that requires that I have access to accounting information in order to put it in a database for use in an application that I am building.

Some higher-ups in the finance department sent me an excel sheet that I asked for in order to do my job. The information in the excel sheet is the break down of salary budgets by department and it doesn't exist anywhere else. (That's why the application is being built). I needed the spreadsheet so I could both import the data into the database and analyze the structure of it so that a tool can be built to automatically extract/load the data going forward.

Everyone is okay with this, but there is a caveat. One of my coworkers is technically working as a contractor. Evidently, this person's salary was separated from my department's overall budget and in the sheet I was provided, there are clear markings of exactly what this person is paid every week.

I am not sure what to do at this point. My manager hasn't seen the spreadsheet as she doesn't need to (She already knows what my co-workers compensation is.) She knows that I know the department's budget for salary but she doesn't know that I know my coworkers specific compensation. I'm also not the only one who was sent the sheet. Two of my co workers have it as well. Presumably they saw this information, but no one has brought it up.

Half of me feels like I should just ignore this and continue on with my job. The other half of me feels like it would be more wise of me to inform my manager that I am now privy to this information in case somehow this blows up in the future. E.G. someone decides to make a stink about it and then my manager gets blind sided because she wasn't aware of the situation.

What should I do? If I tell my manager, what is the best way to frame this?

  • 6
    Your instinct is correct. It's irrelevant. It's not you business. Ignore it. – keshlam Jul 31 '16 at 1:29
  • 7
    If she is a contractor then it's not really even her salary, it's the rate for her service which will be much more than salary but also cover overhead and the additional risks of being a contractor. – Carl Veazey Jul 31 '16 at 1:44
  • "Oh hey {manager}, I saw some data in that dataset I got that might be sensitive... and I think you might have something in the corner of your mouth there." - Apply the second sentence if necessary. I've been accidentally emailed or otherwise sent coworker's salaries in more than one job. It happens, it will make someone embarrassed, but usually no cares that much. – Mark Rogers Jul 31 '16 at 4:02
  • 4
    Knowing a contractor rate isn't exactly a state secret, in fact in many public sector companies you'd likely know what all your coworkers earn (plus your manager and their manager), don't quite see what the issue is here? – The Wandering Dev Manager Jul 31 '16 at 18:55
7

There are two issues here.

Firstly, your becoming privy to confidential information. You may want to mention it to your boss, simply because other people were given the same spreadsheet. She should be made aware that this information is now public. But anyway - the actual information is none of your business. As long as you don't try to use that number as your colleagues salary (if they're a consultant, it isn't...), then you won't have any issues.

The second issue is more important. Someone in your company is providing confidential information - real numbers - in a spreadsheet that at the moment is being used to build software. There are privacy issues with PII here that your company's security people should be addressing. Just because you asked for information does not mean you should be allowed to have it - someone in the security department should have been anonymizing and changing the information before giving it to people who are not cleared to have that level of information. (are you cleared? No. Because if you were, the question would be irrelevant).

  • 2
    +1 for distinguishing between the two issues. But depending on their roles and the project plan, it might be perfectly acceptable for developers to have real data. OP mentions extract functionality; loading real data, even for tests, makes it much easier for the business users to validate. – Pedro Jul 31 '16 at 3:38
  • As a security analyst, I'd disagree here; it's pretty simple to change names to 'Fred Bloggs1' and add a random number to any figure that may be used. During UAT it's acceptable for the clients to work with real data, but development is (or should be) a no-no. – PeteCon Jul 31 '16 at 4:14
  • @Pete, In an agile setting, you'd want the ongoing prototype to be useful to management/users as soon as possible, and that usually means using real data and real names. Now, I am not saying that one shouldn't obfuscate such things, but ultimately it's a tradeoff decision. – Stephan Branczyk Jul 31 '16 at 5:15
  • 1
    @Pedro while having access to real data isn't inherently wrong; if needed proper confidentiality controls (eg the same NDA that anyone else with access to salary data has) should have been put in place beforehand. However in this case I agree with Pete that there's no reason why it couldn't've been anonymized first. And from the description of the question it appears that there wasn't an intent do so do; but in this case it was inadvertently leaked due to the person who provided the data not realizing one bucket only held a single persons data. – Dan Neely Jul 31 '16 at 11:52
  • @Stephan: In an agile setting, the management/users will be able to see changes soon enough - especially if continuous deployment is in place. I still maintain that developers don't need real data in order to test programs - and indeed, real data often gets in the way of good testing. Great discussion, but I'm out, as we're digressing from the original question. Thank! – PeteCon Aug 1 '16 at 15:16
4

Ignore it, and forget it. In theory it's a big no no in places, in practice some companies don't have a policy and expect to be able to trust professional employees.

I deal with confidential data all the time. Solution 'I never saw it'. This has never come back to bite me in a couple of decades, and is actually one of the reasons I get so much work.

I just focus on the job, unless I'm tasked to check for it, I couldn't care less if a machine is full of bikini babes or worse. If I have to import or repair an accounting package database I don't even look at the data.

2

I am a contractor (via a consulting company), and as such i provide service which can be bought at some price. I am not in competition with employees, and I am perfectly fine with the project manager knowing how much i cost per hour. This in not my salary (far away from it). Internally at my employer projects are only billed some average rate for the qualification, so i do not know any of my coworkers salary, even if I know the cost a team is billed at.

So I do not see any reason you should act.

2

Note that you cannot compare employees' salaries and contractor salaries.

Contractors are either supplied by a contracting company which makes its profit. The "salary" that you see isn't the actual salary, it's the payment to the contracting company. Subtract their profit, their overhead for finding suitable contractors and making them available, then subtract the usual cost that an employer has based on your salary but not visible on your salary. Then what remains is what the contractor gets paid as their salary, which will be much less.

Or a contractor is either self employed or runs his own limited liability company. That contractor has additional work running his or her company, filling out tax forms, paying an accountant etc. What they are paid doesn't include any taxes, any pension fund, any benefits like health insurance; the contractor has to pay that out of their own pocket. The contractor won't get a bonus, and won't get invited to the Christmas party at the office. The contractor doesn't get paid holidays, and it's up to them to line up new jobs all the time, with gaps being inevitable.

That's what you need to keep in mind if you compare payments.

As far as getting private information is concerned: Don't tell anyone, don't act on it, don't let it affect anything you do or say. Ignore it as if you had never seen it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.