united-kingdom gdpr privacy england-and-wales data-protection-act
Is it a breach of GDPR and DPA to say a colleague is sick and off work?
<p>This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer then says he will call back next week when she's better.</p>
<p>Suppose Bob's boss heard this and said that Bob had breached GDPR and DPA by telling the customer about Alice being off sick. Is the boss right and what punishment does Bob face if he is?</p>

<p>Possibly, but probably not.</p>
<p>Personal data is any information relating to an identifiable person. The statement “Alice is sick” is information, and relates to Alice who is identifiable. Processing personal data is not inherently illegal, but does require a legal basis per Art 6 GDPR, such as a legitimate interest. Here, the information is data concerning health, processing of which is prohibited unless one of the explicit exceptions applies (such as explicit consent, or legal obligations). So it is legitimate to have concerns on whether disclosure of this information would be legal.</p>
<p>If these rules were breached, that would be on the data controller. Here, the company would be the data controller, not Bob (unless Bob acted against training and instructions and processed the personal data for his own purposes).</p>
<p>However, GDPR probably doesn't apply to this specific interaction. In Art 2(1), the GDPR says that</p>
<blockquote>
<p>This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.</p>
</blockquote>
<p>A conversation itself would not be subject to GDPR rules – there is no filing system or similar structured data involved. What GDPR would prevent is to keep records on Alice's health status, but doesn't necessarily prevent talking about it informally. For example, the <a href="https://datenschutz-hamburg.de/pressemitteilungen/2020/10/2020-10-01-h-m-verfahren" rel="noreferrer">EUR 35.3M fine against H&amp;M in Germany</a> was imposed not because managers talked with employees about personal matters, but because they then maintained detailed files about those personal matters.</p>
<p>Data controllers are responsible though for ensuring security and compliance through appropriate technical and organizational measures (TOMs). TOMs can include things such as non-disclosure agreements and training for staff. If Bob acts against such training, there could be repercussions along the Bob–Company employment relationship. But that would mostly be an employment law thing, not so much a GDPR thing.</p>
