Is it a breach of GDPR and DPA to say a colleague is sick and off work? This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer then says he will call back next week when she's better. Suppose Bob's boss heard this and said that Bob had breached GDPR and DPA by telling the customer about Alice being off sick. Is the boss right and what punishment does Bob face if he is?
Possibly, but probably not. Personal data is any information relating to an identifiable person. The statement “Alice is sick” is information, and relates to Alice who is identifiable. Processing personal data is not inherently illegal, but does require a legal basis per Art 6 GDPR, such as a legitimate interest. Here, the information is data concerning health, processing of which is prohibited unless one of the explicit exceptions applies (such as explicit consent, or legal obligations). So it is legitimate to have concerns on whether disclosure of this information would be legal. If these rules were breached, that would be on the data controller. Here, the company would be the data controller, not Bob (unless Bob acted against training and instructions and processed the personal data for his own purposes). However, GDPR probably doesn't apply to this specific interaction. In Art 2(1), the GDPR says that This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. A conversation itself would not be subject to GDPR rules – there is no filing system or similar structured data involved. What GDPR would prevent is to keep records on Alice's health status, but doesn't necessarily prevent talking about it informally. For example, the EUR 35.3M fine against H&amp;M in Germany was imposed not because managers talked with employees about personal matters, but because they then maintained detailed files about those personal matters. Data controllers are responsible though for ensuring security and compliance through appropriate technical and organizational measures (TOMs). TOMs can include things such as non-disclosure agreements and training for staff. If Bob acts against such training, there could be repercussions along the Bob–Company employment relationship. But that would mostly be an employment law thing, not so much a GDPR thing.
You call their employer and impersonate them The onus is on the employer to keep your personal data secure. If they do not take reasonable steps to verify that the caller is indeed you, they fail that duty and can be held to account. So, not a loophole.
Yes, see the General Medical Council's Ethical Guidance for Doctors: Here: You must take prompt action if you think patient safety, dignity or comfort is being compromised. And here: All doctors have a duty to raise concerns where they believe that patient safety or care is being compromised by the practice of colleagues or the systems, policies and procedures in the organisations in which they work. They must also encourage and support a culture in which staff can raise concerns openly and safely. Whether any criminal, civil or disciplinary action is taken will depend on the particular circumstances and available facts.
A NDA can only cover confidential information, that is information that is not in the public sphere, and that was transmitted to the recipient in confidence, that is it is specifically identifiable information that the recipient knew or should have known from the circumstances of the communication was confidential. For example, "marketing techniques" are not confidential information although the specific marketing strategy (pricing, promotion etc.) to be employed for a particular group may be confidential if the circumstances of the communication are such that the recipient should have known they were. Telling them "Hey, this marketing strategy is confidential" is best, however, the nature of the communication may make it implicit, for example, if it is only communicated to a subset of employees and contains information that would obviously damage the organisation if made public such as a price or client list. An NDA that states "all information given is confidential" is probably not enforceable even if exceptions are given because a) it is manifestly untrue (how can the location of the bathrooms or which day is pay day be confidential?) and b) it places an unreasonable burden on the recipient to determine what is and what is not real confidential information.
If you publish a website, you are the data controller for this website. Serving a website necessarily implies processing (but not collection) of personal data. You have chosen to host your website on GitHub Pages. Is GitHub then a joint controller with you, or is GitHub your processor with which you sign a DPA? In 2019, I asked GH customer support about this. Their response: Our Privacy Statement, combined with our Terms of Service, is intended to serve as a data protection agreement for individual accounts — we specifically wrote our Privacy Statement to provide the information required by Article 28 of the GDPR, including a list of our subprocessors. Our Privacy Statement and our Terms of Service serve as our agreements with you, as the controller, instructing us as the processor, and you can always contact us to provide additional instruction. Should we receive a data subject request that relates to data we process on your behalf, we'll always let you know promptly and work with you to comply. — Github, 2019-04-10, private communication At the time, their Privacy Policy described GH Pages as follows: If you create a GitHub Pages website, it is your responsibility to post a privacy statement that accurately describes how you collect, use, and share personal information and other visitor information, and how you comply with applicable data privacy laws, rules, and regulations. Please note that GitHub may collect Technical Information from visitors to your GitHub Pages website, including logs of visitor IP addresses, to maintain the security and integrity of the website and service. (Update 2022: the privacy notice has since changed, and the quoted part is no longer part of the privacy notice.) Under this theory: you are the controller, and GH is your processor the terms of service incl. GH privacy policy form an effective Data Processing Agreement you have instructed GH to collect Technical Information in the sense of the privacy policy, for the purpose of maintaining security and integrity of the website, which can be covered by legitimate interest you have not instructed/allowed GH to process any other data from your site It is your call whether you subscribe to that theory. Note that GH organizations can opt-in to their corporate terms and sign an explicit DPA which will mostly contain the same provisions. Does it matter that you don't have access to the Technical Information? No. Being a controller means that you decide the purposes and means of processing, not that you store data. You as a controller can always decide to point your domain name to a different server if you no longer want to use GH as a processor.
The scope of the GDPR is entered when personal data is being processed in a structured manner. Personal data is any information relating to identifiable data subjects (definition in Art 4(1)). &quot;Peter attended the meeting on the 14th&quot; is personal data. &quot;That woman with the blue handbag said she wanted to return on the 25th&quot; is personal data. However, aggregate statistics do not relate to individuals, and are typically not personal data. &quot;On the 14th, we had 25 attendees&quot; is not personal data. Not all use of personal data is within the scope of the GDPR. For example, the GDPR would not apply if two organizers talk about who attended the meeting. However, Art 2(1) says the GDPR applies when personal data is processed wholly or partially with automated means (e.g. computers, smartphones), or forms a filing system or is intended for a filing system (e.g. keeping notes on attendees, keeping attendance lists) If GDPR applies, the organization would be responsible for ensuring compliance with its rules and principles, summarized in Art 5. Primarily, this means: having a clear purpose for processing selecting a suitable Art 6 legal basis for that purpose (e.g. consent or a legitimate interest) only processing the minimum data necessary for achieving that purpose determining and implementing appropriate technical and organizational measures to ensure compliance and security of the processing activities preparing for data subject rights, in particular by providing an Art 13 privacy notice when collecting data from the data subjects There are of course some complexities in the details. When the legal basis is &quot;consent&quot; (opt-in), the organization would have to ensure that this consent was freely given and sufficiently informed. Per Art 7(4), consent would not be freely given if that consent was a condition for access to the meeting. Using &quot;legitimate interest&quot; (opt-out) can be more flexible, but it requires performing a balancing test to show that the legitimate interest isn't outweighed by the data subjects' interests, rights, and freedoms. Roughly, relying on a legitimate interest is appropriate when the data subjects can reasonably expect the processing activity to occur. Regarding point 1, keeping general counts and aggregate statistics about attendees is probably OK since it wouldn't be personal data. If you are very conscientious about this, you could round all counts and use categories like &quot;0-4 attendees, 5-9 attendees&quot; for each facet, which makes it more difficult to make inferences about individuals. But the fundamental point is that all your data should relate to attendees as a whole, never to individuals. Regarding point 2 and 3, this is a question of legal basis. Since you gather names through informal conversations, I think that attendees would be weirded out if they learned that you kept detailed records on their attendance. So I think that you probably wouldn't have a legitimate interest here. However, being upfront with this and offering an opt-out could change this. On the aspect of keeping detailed notes on data from informal conversations, I'd like to point out H&amp;M's EUR 35 million fine back in 2020 (summary on GDPRHub.eu). In a callcenter, managers used to have conversations with employees. These conversations touched on anything from vacation experiences to health problems, marriage problems, and religious beliefs. All of that is fine. What was not fine is that the managers went full Stasi and kept detailed notes about all of this on a shared drive and used that information for management decisions. This went on until a configuration error made those files accessible to all employees. This violated all the points in the basic compliance process outlined above: the records had no clear purpose, no suitable legal basis, contained way more data than necessary (and even Art 9 special categories of data like information on health or religious beliefs which have extra protection), did not have appropriate measures to prevent unauthorized access, and did not fulfill data subject rights like the Art 13 right to be informed. In case this non-profit is a church or religious organization that had its own comprehensive data protection rules before the GDPR came into force in 2018, those can continue to apply per Art 91. This could probably address some issues of legal basis, but cannot circumvent the GDPR's general principles.
No. Theft is, in most jurisdiction, an action by which the offender takes another person's property with the intent to permanently deprive them of it. The clerk isn't taking any property from the store, and she doesn't have any intent to deprive the store of anything. She is therefore not guilty of theft. If she were doing this intentionally -- either in league with the customer or even without the customer knowing -- she could likely be held liable for the theft, either on a conspiracy theory or perhaps an innocent-agency theory. The lack of criminal liability of course does not mean that there can be no accountability. The employer is free to terminate the employee, and it will have different options -- depending on jurisdiction -- to recover the value of the uncharged printers, perhaps by docking her paycheck or through a negligence action.
You asked about other jurisdictions. As you'll probably be aware (from cases like EU vs Microsoft and EU vs Google) European countries and culture tend to have much stronger protection laws for consumer and employee rights than the US does. In the UK you could make a strong case, although such cases are not often undertaken. The current legislation is Part 2 of the Consumer Rights Act 2015, but the unfair contract terms clause goes back to at least the Unfair Terms in Consumer Contracts Regulations 1999. Basically the law protects a person in a situation where disparity of size and bargaining power have led to unfair terms in a contract (typically a large company offering "take it or leave it" standard terms) - and specifically if they create a significant disparity in the parties rights and obligations. In such a situation the company which drafted the terms alleged to be unfair must show they are reasonable. A list of common terms likely to be seen as unfair is provided. (Employment terms are covered by other laws but also aim to prevent abuses due to inequality of contracting power) A company which sold a product like Windows 7/8/8.1 and then later said "we are changing our terms of support and forcing you to upgrade" (especially to a different product the user may not want, or a product that is maintained in a different way),would almost certainly be at substantial risk of falling foul of this. It wouldn't matter if it was done by not providing the support/patches as originally implied (by custom or normal expectation) or as agreed in an explicit statement of support life cycle, or by saying "we have the right under the contract to do this", or by forcing what is essentially a change of product to get the updates. It also wouldnt matter how big they are, nor whether or not the user had already agreed "because I felt I had no choice". The law is there specifically to protect against abuses like this, so it is drafted to catch companies who try to find "wriggle room".