Hello, we’re working on a Capability & Flourishing policy/procedures, and an expanded Sickness policy/procedures, and are wanting to figure out how we balance member’s privacy with the co-op’s need to know about things like illness, conflict, internal complaints etc. We are a small, flat structure co-op (11 folk, all part-time), and on a practical point, we use a file drive where all documents are accessible and can’t be individually password protected. We have not yet needed to store something that isn’t suitable for all staff to access, but I don’t know if that is always going to be the case…?
Can anyone share either policies or practical points on how you handle:
informing the wider co-op that two or more members are in conflict (where it is affecting decision-making and others need to know)
sharing/storing information about concerns about a member’s work, internal complaints or grievance or employment proceedings (not a live issue - including this just in case)
holding notes or documents about staff that contain health or other sensitive data
I don’t have experience of working in a Co-op/flat structure, but here are some general thoughts.
Since employee data has to be managed in line with GDPR, I would make that your starting point: Employment information | ICO.
Do you already have a data protection notice that covers use of employee data? If not, it would be worth developing one in collaboration with the team.
Since you will inevitably hold special category data (like health needs) about staff, it will be important for that information to be held securely, and it’s unlikely that an open file system will be suitable for those purposes.
When making decisions about access to team members’ personal information, the “need to know” principle is a very useful yardstick for me.
For example, if someone is off sick with a certain condition, does everyone need to know the details? The team member who is off sick may tell the whole team why, or they may prefer to keep the details private or shared only with individuals they trust. I would never share the details (such as the health condition) without their express consent. It is sufficient to say “so-and-so is currently off sick and hopes to return by [date]”, which allows the team to cover their absence.
A different situation would be that where someone’s performance is not meeting the expectations held by the team. Not everyone needs to know this, only whoever will be overseeing the process to help them to develop their performance. Others might need to know limited information, such as “so-and-so has asked to shadow you so they can learn from how you do this task”.
Another useful principle is empowerment - the individual retains the power to decide how their personal information is shared wherever possible.
Thanks for taking the time to share these thoughts.
On re-reading my original post, I’m not sure if this is clear: our file system is secure within the organisation - it’s just not restricted access within the team. Our privacy policy does cover employee data, but doesn’t go into depth on the storage and access of that.
I think the empowerment principle is highly applicable and I can definitely use that in developing these policies and procedures. ‘Need to know’ is absolutely applicable, the blurry area is that it’s not so obvious to me how we hold/restrict access to the info, when all members are directors, and we don’t have the roles which would more obviously be the keepers of this type of data eg. line managers or a HR department.
Hey Kate -
Thanks for sharing this - the transparency/privacy questions is such a tricky one in small flat orgs!
While this may not make sense for everything, in our RadHR work support policy, we have named a ‘work support lead’ (which happens to be me), to hold the work that relates to supporting a colleague who may be struggling to do some or all of their role.
In a slightly bigger team (there are 3 of us, part-time), we would ideally share that role across more than 1 person, but by making clear that specific people should hold that process, we try to avoid everything being sorted out via full collective process (which is obvs not always good, ethically, or legally).
The other thing that we haven’t made explicit, but might in the future, is thinking about if there is specific training or support that folks might need to take on that kind of role in the future, whether it relates to work performance, conflict, or health/mental health.
Definitely keen to hear how more groups do this, as our answers are definitely a bit of a fudge still!
Hi Liam, thanks for this - that’s very helpful and dovetails with a process we are starting to define our ‘People and Policy’ working group membership into roles that address specific areas of the work.