Some advice needed on data protection- quite sensitive

[trfc2019]

Hi all,

This is quite a sensitive one so a little warning on that....

Last year a friend of mine was raped, it had an enormous effect on her ( as you can imagine ) and she ended up coming off the rails a bit, this led to her doing some bits at work that led to her being dismissed- this led to her receiving a caution - not convicted or arrested for any offence so is spent

During the disciplinary she revealed what had happened to her and she was informed in writing that it will be dealt with in the strictest of confidence, unfortunately they still took the option to dismiss her

In the past year she has been off work and been diagnosed with Post Traumatic Stress Disorder amongst other things and after intensive therapy is now for the first time able to return to work

However, here is where the issue has been, over the last few weeks she has learned that details of what happened to her + details of her disciplinary have been leaked to both staff and to third parties ( potential future business connections ) my question is simple really, is this allowed? I get gossiping happens in any job environment but this is very sensitive information and with the third party they were informed by her line manager that he had told them she was dismissed for being drunk constantly and disruptive, this means she now faces the difficult decision to reveal the full extent of what happened to her to a third party

She is about to start a new role and they have not needed her previous employer as a reference and is due to start in two weeks, however she is worried currently that her previous employer are going to contact her new one with details of her caution and what happened to her, am I right in saying that as it is spent and she had no conviction her previous employer would have no legal basis to do so?

Any advice on whether this breaches GDPR rules would be greatly appreciated, she has no real intention of putting a complaint in as she has enough going on but she just wants her previous employer to stop spreading things about her to staff/ third parties/ new employer

[Afterthefact]

My understanding is hat any personal information must be kept secure and only revealed to the people directly involved in the matter or the authorities. Therefore the company who dismmissed your friend is in breach of GDPR. I would suggest that she contact the ICO office to make a complaint.
Also her previous company are not allowed to divulge any information to her prospective employers.

[trfc2019]

Thanks that is what I thought, I don't think she intends to pursue it through the ICO purely because she has enough on with the reporting of what happened to her, however, she is going to write to them and state in the strongest possible terms that if she discovers another breach she will have no choice but to report it