Does storing personal staff information (names, addresses, dates of birth) on a shared network drive that allows anonymous and unrestricted access to all staff present a violation of the 7th principle of the data protection act - "To keep information secure"? Or is there a presumption of trust in the organisation for users and as there is no public access, it could be considered technically secure?

  • 1
    I'm a security analyst for a UK company and have discovered this at my own company by chance. I personally think is a security issue and is a DPA violation and have raised it for resolution.
    – iainpb
    Apr 6 '17 at 11:13
  • Push the big red button on this one, then. "That's a paddlin'"
    – schroeder
    Apr 6 '17 at 11:14

Yes that would count as a violation, if you consider principle no.2 that PII should only be "used for limited, specifically stated purposes" then unless every single staff member with access to that shared drive has a need to access that data for one of the "specifically stated purposes" (which I'd imagine is highly unlikely) then they have failed to comply with the "safe and secure" principle.

Unless the organisation has prior form for shady behavior in this area I'd be inclined to say Hanlon's Razor is at work here and that might influence how you approach the issue with them but it is definitely something I'd be raising ASAP.


The bigger question is if this violates the data protection laws of various jurisdictions (it does). From this perspective, you have not secured PII and it's a violation.

For instance, no one, NO ONE has any right to know how old I am. I do not want to be subject to discrimination, and my birthday is private information. If I found out that my employer posted that info internally, I would be calling up the meanest lawyer I knew.

No one needs to know this info except for HR, which means if it was posted, then is not being used for the purpose that it was collected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.