4

If it's relevant, this is from an 8 month university coop position.

Today while I was searching my team's network drive for code, I found a directory labelled "staffing" and my interest got the best of me. Inside I found folders for just about every position they had staffed for in the last decade, and within the folders it contained resume and interview results for every applicant for every position. It mentioned things like university grades and transcripts of discussions with references. It also contained all the HR paperwork for the successful applicants (things that would disclose salaries, home addresses, home emails etc.).

Is this a common or ethical practice? It seems off to me but I'm new to this style of workplace, none of my previous positions involved shared network access or this much computer work.

  • When you ask Is this a common or ethical practice?, does the word "this" refer to the ethics of the practice of keeping records, or your decision to look at them? Had you been explicitly authorized to access that data or is that simply poor security practices from whomever is supposed to be protecting that data? Also, in what country did this happen? That context matters, too. – code_dredd Jun 24 '17 at 21:06
  • What you did was totally unethical. Your best bet, honestly, is to "forget it happened" and never think about it again. Immediately tell someone in IT (or whatever) that they foolishly left a HR-looking folder exposed for all to see. – Fattie Jun 24 '17 at 22:07
  • It's a mistake they made. It's most likely not intentional. Most companies would freak out if they found out HR was potentially sharing everyone's salary information with everyone else inside the company. They don't want that information getting out. – Stephan Branczyk Jun 24 '17 at 23:25
  • @ray My question was mostly about whether or not the keeping of the documents was ethical. My decision to open the folder was obviously wrong, I wouldn't debate that. Some clarification, based on what I know, the hiring process is done entirely by the team and is fairly communal (big team discussions). HR only takes care of paperwork. Everything like drafting job listings, reading resumes, conducting interviews and selecting candidates is done by the team first, and then HR is only involved once a successful candidate is selected. It's not like HR misplaced a folder onto our network drive. – zach Jun 25 '17 at 2:04
  • Are you sure it wasn't a honeypot folder to catch wandering eyes? Report it to HR - you should never be in a position to have access to that. – PeteCon Jun 25 '17 at 4:39
9
  • in some countries that would be outright illegal
  • moreover, it is stupid (since it gives way too much room for conflict)

I guess it was carelessness, and the responsible person should be fired IMO.

  • Why would it be illegal for a company to keep records of their own data? This is probably an IT administration mistake. Nothing obviously illegal has happened yet. – Nelson Jun 25 '17 at 5:31
  • I think he refers to "keeping in unsecured place", not the general keeping records of HR, which is not wrong. Although nothing serious has happened, it is a information leakage, and the one responsible should have known better practice on handling private documents like those. – Vylix Jun 25 '17 at 8:07
  • 3
    In Germany, this would be a severe violation of laws. Resumes contain personalized data, and as such, are subject to the Datenschutzgesetz, which requires that access must be controlled, and that all people who work with such data actually sign an agreement that they will keep the law. And a company must have a persons maintaining these agreements and the list of people who have access to such data. – Sascha Jun 25 '17 at 9:24
  • @Nelson: "Why would it be illegal for a company to keep records of their own data?" - as pointed out by Sascha, the data can be subject to privacy laws. And if that is the case, there is an obligation to keep only such data that is still required. Once an employee has left, there may be an upper time limit (depending on the particular jurisdiction) for how long the data may be kept. – O. R. Mapper Jun 25 '17 at 21:26
1

Terrible example of maintaining personal data. In most jurisdictions it would be illegal.
What if some recruiters/spammers/scammers would obtain that folder? I mean such database is literally worth money and leaving it unprotected is just asking for troubles.
Report it to your HR.

  • "such database is literally worth money" - that in itself is not a very strong point. Probably, plenty of data that is available via the internal network exclusively to employees is "literally worth money". – O. R. Mapper Jun 25 '17 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.