Data protection violation?

[LDSI]

Hello everyone!

I am so glad i found this website, as i am extremly confused and don't know where i'm standing at the moment. Sorry for my English, if it's wrong sometimes, but it's not my native language. I will try to explain the whole background, thanks for reading!

So i'm working for the IT company for a few years as a self employed person, but have normal working hours (9-5) and have to be in the office few times a week (despite the fact, i can do all my work from home). I was full time employee before, but i decided to change my contract to self employed, because that was the only chance that i will be paid money for extra work for the company. Everything stayed the same, and while i'm working in the office i am using company's computer - i am the only person that is using it.

Few days ago other employee (self employed as well) came to the office to fix that computer, because it was not working anymore. I was working that day at home and something strange happened - my WhatsApp told me, that someone else is using it on another computer. We have to use WhatsApp to communicate inside the company, but it's also my way to contact friends, family etc. It happened few times, so i started panicking, that someone is gaining my personal data. Soon i discovered also that someone is using my Facebook from the IP of my office computer - i found it on Activity log on Facebook. I log out myself, changed the password and ask my company about that. And now it started to be difficult.

From the very beggining director of the company was trying to wave my objection, asked me for a proof, told me that i should "carefully think about making accusations" and told me also that im overreacting. I sent him screenshots stating that someone was using my Facebook from that IP, and he told me - "this is not IP from our company, keep searching somewhere else :/". Next day i came to the office, typed "My IP" and of course it was that IP. So he lied to me.

Then he called me, told me to "grown up and say sorry for that accusations" (beacuse i asked on working group chat why somenone is using my social media and that i'm going to report this). He also pointed out that "is should not keep private data on work computer". The problem is, both WhatsApp and Facebook, are required for my job.*

This situation is even worse, because the person, who was fixing my computer, don't like me personally, have long history of criminal activities (including attack on another worker), cheating, manipulating and no one trust him.

I know that i should problably keep my Facebook and WhatsApp secured after finishing work in the office, but we trust everyone in the office, everyone have their own computer protected by password and there was never any problem with that.

I have long history of anxiety, stress and mental health problem, two weeks ago i started another treatment, and i started feeling even worse now, and very unsecure, like my privacy was violated, because of the fact, that someone used the access to my social media, and - possibly - gained some information, even maybe stealed some data. I started receiving some strange calls from Nigeria (that person, who was using my computer, have family from Nigeria). What's worse for me - no one is seeing this as a problem, and i should now apologise for "making accusations".*

I am very confused, could anyone help me with what should i do on that matter? Should i report it, was there any violation? If yes, where should i report it?*

Thank you in advice for any help!*

[D_Pappa]

I am certainly no expert in this area.

However, I do think you are likely to face some serious challenges in bringing any legal weight to bear using employment law, due to you being self-employed (you are not an employee any longer, effectively).

Take all the steps you can to secure your data now, as you have. Make sure you remove privileges from people or devices that may have access, as well. Then monitor everything actively, checking for any further breaches and collecting evidence when needed.

Be careful about levelling any accusations, as it will sour the relationship and you aren't in as strong a position to resolve these as if you were employed (where you have employment rights, can lodge a grievance, claim unfair/wrongful/constructive dismissal, etc).

If you are certain that you have been wronged, and you can't right that wrong, speak to the Information Commissioner's Office (ICO). They regular this matter and can take enforcement action against a company in breach of its legal obligations to secure data (under the UK Data Protection Act and EU General Data Protection Regulation).

Best of luck - keep us updated!