GDPR breach?

[scruple]

Afternoon. Is it a GDPR breach if someone from Administration team accidently has emailed a list with salary information? Email has been sent with hourly rates for the whole company site to management team. Thank you in advance

[atticus]

Please clarify to whom this email has been sent.

[scruple]

Afternoon. Is it a GDPR breach if someone from Administration team accidently has emailed a list with salary information? Email has been sent with hourly rates for the whole company site to management team. Thank you in advance

The whole Team Leaders and Managers Team. Thanks for your time

[dslippy]

Did the list directly associate names and salary?

[scruple]

Did the list directly associate names and salary?

Yes. Name and hourly rate

[ULA]

In many organisations I have worked with, depending on the definition of management team and seniority they would potentially be party to such information as part of managing the business.

[scruple]

In many organisations I have worked with, depending on the definition of management team and seniority they would potentially be party to such information as part of managing the business.

Thank you for respond. However email has been sent accidently and I'm not happy that other colleagues know about my hourly rate

[R0b]

From the sounds of things, it is likely to be some kind of breach yes, but the question is what do you want to do about it.

If you are looking for compensation then don't expect much as the level of compensation (if any) depends on a number of factors such as how much personal data has been disclosed, who has obtained access to it, how the breach occurred and whether it was a one off or accidental breach etc.

The courts have generally confirmed that (subject to a decision in the European Court decision that's discussing this) a data breach alone is not sufficient to trigger compensation. There has to be some kind of 'damage' in the form of financial damage or non-financial damage like distress, inconvenience etc.

Your company should have privacy policies in place and you may want to raise a complaint about this. If you're not happy you can go to the ICO and make a complaint but last resort you could go down the legal route though as I said you will need to prove the breach was sufficient enough to warrant damage.

[scruple]

From the sounds of things, it is likely to be some kind of breach yes, but the question is what do you want to do about it.

If you are looking for compensation then don't expect much as the level of compensation (if any) depends on a number of factors such as how much personal data has been disclosed, who has obtained access to it, how the breach occurred and whether it was a one off or accidental breach etc.

The courts have generally confirmed that (subject to a decision in the European Court decision that's discussing this) a data breach alone is not sufficient to trigger compensation. There has to be some kind of 'damage' in the form of financial damage or non-financial damage like distress, inconvenience etc.

Your company should have privacy policies in place and you may want to raise a complaint about this. If you're not happy you can go to the ICO and make a complaint but last resort you could go down the legal route though as I said you will need to prove the breach was sufficient enough to warrant damage.

Thanks mate. My main concern is not to get compensation, but a person who has sent this email should be investigated and removed from this possition. I know it's up to HR and Senior Management, but I wondering if I can put a grievance agains company. Thanks

[atticus]

You may do that if that is your wish.