Whistleblowing in relation to breaches of data protection rules, the key source of which is the GDPR, can be a protected disclosure, as the Employment Appeal Tribunal recently confirmed in Okwu v Rise Community Action.
Miss Okwu started her employment with by Rise, a small charity, as a domestic violence and female genital mutilation specialist worker and was within her probation period. Her performance was lacking, her probation was extended. She then complained that Rise did not provide her with a work mobile storage and secure storage for sensitive personal information of her clients, in breach of the data protection regulations. She then was dismissed on performance grounds.
On appeal, the Employment Appeal Tribunal said that Miss Okwu obviously had a reasonable belief that her complaint of the data protection was in the public interest. Her complaint has to be considered as a protected disclosure relevant to her dismissal.
On average 55 vulnerabilities are identified daily.
What can I do?
Review your organisations priorities and ask ‘can we afford a breach?’. What do I do during an incident? Who do I involve? When do I involve the ICO?
If you’re unable to answers these questions, you need help from the experts.
