The HR Spreadsheet and the Sick-Note
A logistics firm with 240 warehouse staff keeps a shared HR spreadsheet listing each employee's name, home address, bank details, and a free-text 'notes' column. Managers across three sites can all edit it. One manager pasted a physiotherapist's report into the notes column, including a diagnosis of a chronic back condition, after an employee submitted it to support a flexible-hours request. Another employee found the file open on a shared terminal and saw a colleague's diagnosis. The employee whose diagnosis was exposed asks: what data do you hold on me, who has seen it, and can you delete the medical note? The firm says the spreadsheet is 'just how we've always done HR' and that the note is needed to justify the adjusted hours.
1. Classify the data and explain why the physiotherapist's report raises the stakes beyond ordinary HR data.
Read the worked answer
The spreadsheet contains ordinary personal data (name, address, bank details) plus special category data - health information in the diagnosis, which reveals a chronic condition.
Why it matters:
- Special category data needs an additional condition for processing (e.g. employment law obligations, or explicit consent) on top of a lawful basis.
- Health data attracts higher risk, so stronger safeguards are expected: restricted access, encryption, and a documented justification.
- Bank details add a fraud/financial risk if the file leaks.
- A free-text field shared across three sites is uncontrolled: any manager can read and edit, so the firm cannot say who accessed it - an accountability failure.
The firm's 'always done it this way' is not a lawful basis or a safeguard.
2. Answer the employee's three questions: what is held, who has seen it, and can the medical note be deleted?
Read the worked answer
What is held: she has a right of access to a copy of her data and to supplementary information (purposes, recipients, retention, source). The firm should give her the row contents and explain the physio report's role.
Who has seen it: access logs are the honest answer. If the firm has none, it must say so and explain the limitation - it cannot claim confidently that only authorised staff saw it. It should describe the access model (all site managers could edit) and any known disclosures (the colleague who saw the screen).
Deletion: she can request erasure, but the firm can refuse if retention is necessary to comply with an employment-law obligation or to justify the adjusted hours. A proportionate outcome: restrict access to the report to HR only, move it out of the shared notes column into a restricted file, and delete the free-text copy. Explain the retention basis and the restriction in writing. If she disputes accuracy, she can request restriction pending verification.
3. What immediate technical and organisational fixes should the firm make, and which is most urgent?
Read the worked answer
Most urgent: remove the health data from the shared spreadsheet and restrict access - the exposure is ongoing.
Then:
- Access control - role-based permissions; HR-only for health and bank data; no shared logins.
- Data minimisation - split the spreadsheet: a minimal operational roster, a restricted payroll file, and a separate confidential HR file for health/adjustment records.
- No free-text dumping ground - structured fields, or a controlled document store with audit logs.
- Encryption and screen hygiene - encrypted storage, auto-lock, no open files on shared terminals.
- Retention schedule - define how long adjustment records are kept and delete after.
- Training and a breach assessment - the colleague's viewing may be a personal data breach; assess risk to the employee and record the decision, notifying her if the risk is high.