Question regarding what an employer can say- caution

[help2019]

Hi all,

Have a friend who I am trying to help,

She did something silly at work ( was under severe mental stress at the time following a sexual assault ) a few months ago, she was sacked for Gross Misconduct and then a month later accepted a police caution for the offence.

She has since found out that the CEO has informed all staff within the organisation and third parties she dealt with of the caution

I may be wrong but I was under the impression that as it was "spent" instantly that under ICO/ GDPR it was sensitive information and could not be shared with staff/ third parties?

Anyone have any idea what advice I can give her with this- at the very least to try and make them stop bad mouthing her- as they are only telling half the story as much as anything

Thanks a lot

[ULA]

I would suggest that your friend writes to the company, explaining that it has been brought to her attention that staff in the company and third parties have been informed by an individual in the organisation of the action taken by the police. Under GDPR this is considered to be sensitive personal information and should therefore be treated in accordance with the Privacy Policy of the company which should be in place regardless of whether she is a current or ex-employee. Based on the fact this is a GDPR issue your friend should ask them to desist immediately with discussing such sensitive personal information.