HR sent my pay and sickness details to all staff: who helps?

Summary

Emailing your pay, sickness absence and holiday to all staff is a data breach: your employer must keep that information secure. Sickness absence is health information, which gets extra protection. Ask HR in writing what was sent, who saw it, what they have done to contain it, and whether they reported it to the ICO. Ask for a copy of your data, raise a grievance if you are treated badly because of it, and complain to the ICO if the answer is poor. Compensation for distress is possible through the courts, but awards for a one off breach are often modest.

Key information

• It is a breach: sharing personal data with people who should not see it counts, even by accident.
• Health data: sick days are health information and need extra care.
• Employer duties: record the breach, contain it, and report it to the ICO within 72 hours if it is likely to put you at risk. Tell you directly if the risk is high.
• Copy of your data: you can make a subject access request for the email and the breach record. The usual deadline is one month.
• Grievance: if colleagues mock you or you are treated badly, raise it in writing, even if you are working your notice.
• Compensation: you can claim for distress caused by a breach through the courts. Speak to a data protection solicitor first.
• Your employer can: explain what happened, ask recipients to delete the email, and record or report the breach; answer your subject access request and any grievance. They will not always tell you everything unless you ask in writing.
• The ICO can: explain your options using steps if you have been affected by a personal data breach; look into your complaint after you have complained to your employer, and recommend improvements. They will not award you compensation.
• ACAS can: explain the grievance procedure if you are being treated badly at work after the breach. They will not deal with the data protection complaint.

Practical guidance

• Email HR: ask what was sent, to whom, what was done to contain it, and whether it was reported to the ICO. Ask for a reply within one month.
• Make a subject access request for the email and the breach record.
• Keep evidence: messages from colleagues, dates and how it affected you.
• Raise a grievance if you are mocked or treated badly.
• If HR's answer is poor, complain to the ICO.
• For compensation, speak to a data protection solicitor. Check whether home insurance includes legal cover.
• Ask the Shaman to map the steps.

Related topics