Is It Legal for a Colleague to Share My Personal Information?

[beBoss]

Hi everyone,

I will try to keep this short. I work at a university, and one of my colleagues, who holds the same position as me, has started spreading personal information about me, namely that I have a second job. I believe that this information should be kept private, and only departments like finance or HR should be able to access it, not everyone.

I think my manager may have obtained this information from HR or finance, which is acceptable since he needs to know, but sharing it with others without my consent is not acceptable. I believe there may be a breach of privacy here.

This isn't the first time something like this has happened. Previously, someone shared that I was a student while working, which I hadn't disclosed to everyone. I don't think it's appropriate for someone to share personal information about others publicly. Are any laws being broken here? Can I have access to everyone's personal information outside of work in the same way?

Sorry, I'm a bit frustrated with this.

[charitynjw]

You have not made clear exactly how your colleague obtained personal data from your manager..
It is not clear whether your colleague would be a data controller/data processor for the purposes of the Data Protection Act 2018/UKGDPR.
If the answer is yes, you could either make a complaint of data breach to the ICO, or make a claim via the County Court , citing s168 DPA 2018/Article 82 UKGDPR.
You would probably be allocated to the Small Claims Track.

"In my judgment, this claim can, however, be managed in a way thatis proportionate to
its value through allocation to the small claims track. This would allow for it to be
dealt with under what was intended to be an informal process, with limited additional
work needed to prepare for a two or three-hour final hearing."

Stadler v Currys Group Ltd :[2022] EWHC 160 (QB)
QB-2021-002102
HHJ Lewis at 44

Another possibility is action via the Protection from Harassment Act 1997 s1(1).

[beBoss]

Thank you for your response to my post.

I acknowledge that I may not have been clear regarding how my colleague obtained my personal information from the manager.

While I suspect that my manager may have shared this information due to his talkative nature, there is no concrete evidence to support this.

As for my colleague, although I am uncertain if he falls under the category of 'data controller/data processor,' it is clear that this kind of data is not related to our job responsibilities.

I appreciate the information you provided on how I may proceed, and I apologize for any lack of clarity in my initial post.

[atticus]

I would take this up with a manager at your university who is higher up the line. Maybe the Data Protection Officer of the faculty (if it has one) or the university.

I work in a university, and my institution is very clear about obligations regarding personal data - of colleagues, students and others.

My wife recently ceased working at my university. After she left, a colleague chose to find her private email address and share it with a student. That colleague has been hauled over the coals.