Gdpr threat by ex employer

[Twiggie1]

I left my job 6 weeks ago.
On resigning, I asked if I could pick up my belongings and return a few items.
It took them 4 weeks before I did the exchange.
I returned their diary, to which had little written in it, as I was using my own (I transferred 3 future bookings as that's all was there for the rest of the year).
6 days after returning it, I receive an email, informing me that 'if I did not return my diary then I would be reported for a data breach'. They said that 'they know I have personal information in my diary'.
I do not having anything in my diary that could connect me to my ex work place. No names, addresses, no telephone numbers, absolutely nothing.
I will not return my diary as it is my evidence that there is nothing in it that I am accused of.
I do think, that even if I did send it back, then they would not believe it.
I have not answered the email as it could be used against me for their case to ICO (they should've reported the breach within 72hrs of knowing, so 6 weeks after me leaving is a little late).
I have received another email to which I am too anxious to open.
I feel as if I am being bullied when I have done nothing wrong. They are trying to pin something on me because they are disgruntled that I left the job.
Do I leave it and hope that they will back off (I dont think they will) or wait and see what happens or go to see a solicitor?

[PallasAthena]

This is your diary? It's a physical paper diary and you bought it for yourself? And you didn't claim the cost from the company on expenses? If so they aren't entitled to demand you give it to them. They seem to be on a fishing expedition to see if they can find any evidence they could use against you if a Tribunal or court case follows.

ULA is the expert on employment law and hopefully will give you the answer. I would just tell them the diary is my personal property and I will not be giving it to them. If they know it contains "personal information" in breach of data protection law can they please identify specifically what information they are referring to as you are not aware that it does contain any such information. But don't do that until ULA has advised.

I'm not a lawyer but my understanding of GDPR/Data Protection law is that their threat you report you to ICO is nonsense because it is the data controller (ie your employer) who is responsible for data breaches and if there has been one they have to report themselves. I don't believe they can report you. And as I said, despite their claim to "know" there has been a data breach I doubt they know any such thing and they are just fishing so I suspect they have nothing they could report.

Personal data breaches | ICO

There's a possibility that what they are really fishing for isn't evidence of a GDPR breach at all but evidence of some other breach of your employment obligations, eg trying to poach their customers, giving sensitive company data to competitors. Just a thought.

[R0b]

It is likely to look more suspicious not responding than to respond. If you are confident you have no personal data belonging to the company or its customers, then you should provide a robust response.

Tell them you have handed back the diary that contained little if any personal information and you no longer have in your possession any personal data belonging to them. You may also want to point out that they haven't actually specified what "personal data" they believe you to hold and you may want to suggest that you consider their threats and demands a form of harassment and if they don't stop, you will consider pursuing legal action against them. particularly unjustified threats.

[Retromau5]

Why not contact the ICO yourself? You don't have to give your details and they'll give you advise on the situation, I've always found them very helpful and I have a feeling they'll put you mind at ease. I agree with the things PallasAthena has said, but I'd also add that they'd need to be reasonable specific about the breach if the wanted to report it what the information is likely to be, when the breach occured etc. And as said before, they'd technically be reporting themselves as they're the data controller. Try not to get too upset about it (I know that's easier said that done), moving or losing jobs is hard enough as it is, without heaping this on too.

[ULA]

As PallasAthena has tagged me my response will confirm what as been said by the previous posters.

I agree that you should respond back in a robust manner as set out by R0b that you have handed back all company information held in your possession. Confirm that the dairy you have is your own personal diary for your own personal use and has no work related contained within it. Potentially as it is a personal diary you may have information contained in it of home addresses, email address of family and friends, which I am sure they would not want handed to your ex-employer.

I also think if the company makes a report to the ICO they would only be reporting themselves as the Data Controller but the suggestion for you to contact the ICO to put your mind at rest is a helpful one.

My one concern in your post is you say "transferred 3 future bookings as that's all was there for the rest of the year". Where did you transfer these from and to - your diary to the company diary your returned? If so what information was in those diary entries?