Work Privacy Policy

I take privacy seriously, and want people to trust that they can share information with me. I also don't want people to be confused or surprised about how I might use that information.

This policy sets out the guidelines I follow when given information in a work context. For other privacy policies, please see my general privacy policy disambiguation page.

Overrides:

• I may disclose information where it is strictly necessary to prevent serious physical or mental injury, loss of life, sexual abuse, or similar harms. I will also comply with lawful and reasonable court orders.
• If information comes with specific handling instructions, I will follow those instructions.

Shareable at my discretion:

• Solely work related info that doesn't include personal data. Example: project plans, workstreams, status updates.
• Minimal work-related personal data. Example: people's names, work emails, Slack handles, what people are working on.
• Personal data that appears to be low risk and already shared widely. Example: people's hobbies they have talking about during a team meeting.
• Public information. Example: information about people that is already on their LinkedIn.
• Meetings of 3 or more people discussed this info. Example: written notes of such meetings (including attributing particular people to certain viewpoints).

Shareable with consent OR where it would be very reasonable:

• Personal data. Example: people's personal phone numbers, personal emails, home addresses, age, disability, gender, sex, race, ethnicity, religion, sexual orientation, medical conditions.
• Discussions in 1:1's that don't fall into categories above. Example: chats discussing difficulties someone is having at work, opinions of other people.

Expectations of others

• You follow handling instructions I give you.
• You keep my personal data and 1:1 discussions with you confidential.

Example case studies

• Someone gives me their number, and asks to be put in a WhatsApp conversation with someone else. I might check with the person they're being connected with if that's okay, and offer that person's work email in the interim.

  • Why: I consider this personal data that requires consent to share.

• I'm hosting a social and inviting 10 people to mini golf, including one person who I know has musicogenic epilepsy. I feel okay asking the venue for information about what music is played and what adjustments could be made. However, I don't disclose the specific condition as far as practicable, and certainly not the individual's name without getting the consent of the person first.

  • Why: I consider this personal data that requires consent to share. I consider revealing that one person in a group of 10 may require adjustments to be very reasonable though.

• I join a team meeting with 20 people. It introduces some new joiners to the team and explains what they'll be working on. I feel fine writing notes of this meeting, including the names of the new joiners, what their work emails are, and what they'll be working on.

  • Why: Matches 'meetings of more than 3 people'.

• I have a 1:1 with a colleague to discuss adding live chat to our website. They suggest a provider that looks like it might be a good match for our requirements. I feel okay sharing this with other people in the team given it is solely work related.

  • Why: Matches 'solely work related', despite being in a 1:1

• I have a chat with a colleague to discuss migrating data between databases. During the meeting, they mention they've been having difficulty working with someone else on the team who they have found abrasive. I keep this conversation confidential.

  • Why: Matches 'other discussions in 1:1s'.

• I have a meeting with two colleagues on my immediate team about progress on patching security vulnerabilities. They state that all the vulnerabilities have been fixed except for those blocked on one external team, and that this team has been very annoying. Nobody says to keep this confidential. I feel confident sharing meeting notes on this with my immediate team, and separately going to the external team and highlighting the difficulties we're having with them.

  • Why: Matches 'meetings of more than 3 people', so I would share this. While at my discretion, I would not directly share the meeting notes with the external team unless I had a good relationship with them given the potential political fallout.

• I am volunteering giving vaccinations to members of the public. An elderly person comes in and in private tells me that their carer often physically hits them, showing me several bruises they claim to be caused by this. Even if they said they didn't want to raise this, I would still share this on with someone responsible for safeguarding / the police.

  • Why: Matches the serious harm override.

• Someone new joins the team. They ask me who else is on the team and what people are like. I share the names, emails and work priorities of the people. I also share a bit of their prior work history and what hobbies they're interested in, given we discussed this in a team meeting before the person joined.

  • Why: People's work histories and hobbies may have been previously shared in a fairly open context, or available from public sources (e.g. LinkedIn, Twitter, etc.). They are fairly low risk to share onwards to someone joining the team.

• A person organizing a social asks me where members of the team live to book a venue that is connivent for us all. I share that one team member said they had recently moved into a flat by Oxford Circus tube in a team meeting. However, I don't share information about other team members, despite knowing where they live because I had to pass it on to HR during onboarding processes.

  • Why: This is personal data, and that has not been shared widely before or for this purpose.

• The manager of our small team announces someone on the team made an anonymous sexual harassment complaint. In a private conversation, a colleague asks me if I'm that person and I refuse to answer.

  • Why: Revealing that I am not the person would reduce the anonymity and potentially unmask the actual person - indirectly therefore revealing personal data. Given the complaint was anonymous, the complainant would not want this to happen. Additionally, if I were that person I'd want to stay genuinely anonymous so I think this is a good norm to have.

## Contact

If anything isn't clear here, please let me know! If you were confused by something, chances are someone else was here too so it's worth me updating the policy to clarify it.

Details on how I prefer you communicate with me, including a contact email, is on my homepage.