4

This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer then says he will call back next week when she's better.

Suppose Bob's boss heard this and said that Bob had breached GDPR and DPA by telling the customer about Alice being off sick. Is the boss right and what punishment does Bob face if he is?

Improve this question
5
  • The most likely punishment is to be disciplined under the company's employment policy, which could happen even if this isn't a violation of GDPR or DPA. Are you asking about punishment imposed by the employer on the employee or about punishment imposed by the government for violating the law?
    – phoog
    Jan 23, 2023 at 10:06
  • 2
    Come to think of it, how does Bob know that the reason for Alice's absence is that she is off sick with the flu?
    – phoog
    Jan 23, 2023 at 10:27
  • @phoog Don't you know why your co-worker is not in the office? Even if technically all you need to know is that she's having a health problem, I typically know whether my collegues are sick or having a surgery or whatever. Even if Alice could insist that the reason of her absence is not communicated internally, that's really unusual.
    – PMF
    Jan 23, 2023 at 10:35
  • 1
    @PMF I don't necessarily know why someone is out of the office, no. It's not really anyone's business whether Alice has the flu or a hospitalized family member or is on scheduled leave. Sometimes people say why; other times they don't, and I don't ask. But if Bob found out that Alice had the flu from his boss then the boss has probably violated Alice's privacy just as egregiously as Bob did by passing the information on to Alice's customer.
    – phoog
    Jan 23, 2023 at 15:04
  • @phoog Technically, that's probably true, but in a sane work environment, people would not usually worry about that. After all, I'm sitting 8+ hours a day in the same office with them, so I should be able to trust them.
    – PMF
    Jan 23, 2023 at 15:14

1 Answer 1

Reset to default
5

Possibly, but probably not.

Personal data is any information relating to an identifiable person. The statement “Alice is sick” is information, and relates to Alice who is identifiable. Processing personal data is not inherently illegal, but does require a legal basis per Art 6 GDPR, such as a legitimate interest. Here, the information is data concerning health, processing of which is prohibited unless one of the explicit exceptions applies (such as explicit consent, or legal obligations). So it is legitimate to have concerns on whether disclosure of this information would be legal.

If these rules were breached, that would be on the data controller. Here, the company would be the data controller, not Bob (unless Bob acted against training and instructions and processed the personal data for his own purposes).

However, GDPR probably doesn't apply to this specific interaction. In Art 2(1), the GDPR says that

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

A conversation itself would not be subject to GDPR rules – there is no filing system or similar structured data involved. What GDPR would prevent is to keep records on Alice's health status, but doesn't necessarily prevent talking about it informally. For example, the EUR 35.3M fine against H&M in Germany was imposed not because managers talked with employees about personal matters, but because they then maintained detailed files about those personal matters.

Data controllers are responsible though for ensuring security and compliance through appropriate technical and organizational measures (TOMs). TOMs can include things such as non-disclosure agreements and training for staff. If Bob acts against such training, there could be repercussions along the Bob–Company employment relationship. But that would mostly be an employment law thing, not so much a GDPR thing.

Improve this answer
5
  • GDPR certainly does not prevent an employer from keeping records about employees' health status, at least to the extent that "health status" includes whether an employee is absent from work because of illness or for some other reason.
    – phoog
    Jan 23, 2023 at 10:10
  • 1
    @phoog It is definitely contractually and legally necessary to keep track of sick days, but not of health information like diagnoses.
    – amon
    Jan 23, 2023 at 18:02
  • 1
    Would this suddenly become a problem if the same conversation happened via email, which is, at least partly "an automated system"?
    – manassehkatz-Moving 2 Codidact
    Jan 23, 2023 at 18:20
  • 1
    @manassehkatz-Moving2Codidact Yes, electronic means such as a work email account or messengers used for work are in scope of the GDPR, giving rise to potential problems here. A prudent employer might train its workforce to avoid creating unnecessary records. (Has the nice side effect of reducing incriminating evidence that could be disclosed during litigation, lol). I'm not convinced though that such emails would necessarily be a GDPR violation.
    – amon
    Jan 23, 2023 at 18:34
  • @amon agreed, though I suppose such information might become necessary if a dispute arose about the legitimacy of an employee's claims of illness, or in case of a disability claim.
    – phoog
    Jan 23, 2023 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .