GDPR Breach?

[James_H]

Hi, thank you for taking the time to read this.

Can anyone confirm if my experience is a clear data breach and it’s severity please.

I work for a large contractor that is currently having costs audited by a consultant on behalf of the client. The consultant was permitted to sit with payroll and be shown how the process follows through. Somehow the consultant (I am told he made notes) of my employee number, my salary, my car allowance and bonus I received for that year.

This information was documented on an excel sheet. The consultant was apparently given notice and a new consultant company was brought in. The new consultant emailed this spreadsheet to myself, a colleague and a third party I have never met.

My company originally confirmed that they felt it was a data breach and raised this directly with the relevant client department. They have concluded a supposed investigation and have advised me that although they agree it is an uncomfortable situation they do not believe they are in breach. We are currently negotiating an extension with the client and my company have now gone cold despite the support at the outset. They have now said to me that the ball is in my court if I wish to refer to ISO.

any advice would be appreciated.

[atticus]

Does your employer have a privacy policy? If so, have you looked at it, and how does what happened compare with the policy?

[James_H]

Hi, it does and I will read through it and get back. Thanks

[R0b]

The answer to your question could go both ways. The key question is whether or not the information that the personal information gathered by the auditor was relevant and necessary for the purposes of the costs audit.

My initial thoughts would be to understand how the contractor charges out to the client. Quite often, contractors and consultancies will charge an hourly or day rate to clients. That rate may be based on the salary they pay their employees or subcontractors plus a percentage mark up. If that is the way the contractor is charging the client, I don't immediately see how the auditor requires individual information about each contractor's personal finances and expenditure. Rather, the auditor should be looking at the hourly/day rates charged by the contractor to the client to ensure they have been properly invoiced, there are no overpayments etc.

Now, that being said, the GDPR allows personal data to be processed if there is a legitimate interest in doing so and this sort of action may fall under the legitimate interest category. It also depends on what the contractor has signed up to in their contract with the client as to what audit rights the client has and how they should be exercised.

If there is a data breach, it would likely be against the contractor for allowing the client to access that information if it was not necessary to do so and the audit could have been carried out by less intrusive means. If I were to guess, maybe the auditor wanted that information so the client could use that as a negotiating tool to justify paying less costs being charged to them. Of course the client is going to say they don't feel there is a breach but they would say that, wouldn't they?

If you feel strongly about, you can make a complaint to the ICO for investigation.

[James_H]

Thank you. The contract is an nec 3. We have item rates for an activity that incorporates a % fee for overheads of which my salary is included. We have never passed individual breakdowns to the client. It has always been an overall sum against a number of employees. What are your thoughts on my salary etc being emailed to colleagues inside and outside the business? If I am to be honest this where my biggest concern is as it has exposed me to bitterness due to comparison of salary . Really appreciate your reply.