I would send him this email using my corporate email address:
If you have a script notifying you of other employee's purchases, that
is not ok. And even if you don't have such a script, or if your script was for debugging purpose, your message to me was still
not appropriate either way. ...
Yeah, breaching your colleagues’ privacy is a great way to destroy relationships and friendships at work. Stephan is advising how to save the guy’s job.
@gnasher729 No he isn't. He saying he doesn't want to get the guy fired. Sure what this guy did was wrong. But doing what this answer suggest is clearly overreacting and will lead to nothing good.
@dan-klasson Your attitude towards a serious privacy breach is rather concerning in itself. Abusing access to production systems to snoop personal data is not a trivial offense and depending on the jurisdiction there are serious fines for this kind of behavior (it would violated the GDPR for example). By all rights this guy should be fired. Giving him a chance to understand how unacceptable this behavior is, is more than nice.
@dan-klasson Yes, most people would consider things they order to not be public information, hence private. Using your administrative powers that you have for specific business related purposes to gain access to private information of others is quite clearly a violation.
@dan-klasson, Doing what I'm suggesting will make things awkward. It may even end the friendship. Sure. I totally realize that. But no, cancel-culture is tamer in comparison, the work environment of a private company is actually much worse than that, a private company's work environment is more akin to an autocratic State. The thing is. If this idiot gets caught, it may put the OP's own job in jeopardy for not having reported him. And again, I'm not suggesting that he report him, only that he communicates to him how serious this issue is -- so he never does it again.
And at the same time, if the idiot gets caught, he can't just say "Everybody does it. Even Proton thought it was funny when I did it to him."
Is this situation a breach of privacy? OP's private data hasn't been shared with anyone except OP and the developer (who has access because their job requires it, I presume)
@AaronF It depends on how the colleague obtained the information in the first place. Typically, it's need-to-know. If he didn't have a business reason for running the query in the first place, that's a problem, even if he shared the result with nobody.
@AaronF He has clearance, which doesn't give him the right, only the means. What he needs first and foremost is a need to know, which isn't clear here. Accessing data you have the clearance for without the need to know is actually a serious breach.
@dan-klasson The colleague used his privileges to access information OP didn't communicated him. Maybe it was just a joke, maybe, but we don't know what information the system allow the admin to see : the same method could allow another person to access the delivery address of someone they are romantically interested in. Talking to the colleague is definitively not overreacting when the expected reaction to any possibility of privacy breach would be to directly report the information you have about it to the security team.
How is pretending you do not see data you do see, and have to see, is going to help? Quite possibly there was an automated notice for unusually big purchases, to prevent big orders due to mistake or malice. Assumption that this colleague was abusing his access has no base in facts presented in the question.
@Molot For the same reason you're presumably quite happy your doctor has to "pretend" (it's not pretending it's simply keeping it to yourself) he has no knowledge about your health to anyone else. What people with access to private data really should understand is that you don't have carte blanche to do with it as you wish. You have access to that data for the explicit purposes you're required to access it.
@Voo I'm happy my doctor does not have to pretend he does not know my health issues to me. In the question, admin sent text to user. It's just like doctor sending text to his patient about that patient's health. Not to others. Your comparison failed at the very beginning.
Comments in this thread are nothing short of scary! People, I'm willing to bet millennials or younger, who see nothing wrong in abusing power, breaching privacy and "it's all for the LOLs" and don't be so "cancel culture" (such an idiotic term, BTW). Well, thank you FB and other "social media" for yet another unintended, no one could see it coming, side effect of a generation born and raised under the notion that there is no such thing as privacy. Way to go humanity. Way to go!
@O.F. I'm much older than a millennial and I see no wrong doing by the OP's colleague. The post seems to involve two people who both have a reason to know... discussing it with one another. Big Deal! My generation doesn't make a mountain out of a molehill, unlike much of today's "triggered" youth.
@james, I can only, wholeheartedly, wish upon you a breach of privacy the like of what OP describes. Hopefully something juicy like your health record, or your entire banking history... We'll see then how much a "mountain of a molehill" you'll think it is when it is your life that's exposed without permission. It is only due to the CoC that I don't tell you my explicit opinion of you and your moral standard, or rather, lack of.
@O.F. That's pretty funny. The OP's order was "exposed" to the OP. That's hardly a life-changing event. Have you ever bought anything? Did no person witness what you bought? A cashier perhaps, or a shipping clerk? Are you scandalized if a cashier smiles and comments that you sure are buying a large bag of apples?
@James I hereby wish upon thee an incessant downpouring of similar privacy breaches! I can only hope that you, too, have to one day receive a joking text message from a colleague! I can but dream that aforementioned text message contains a number which is the total price of an order you recently made! Mark my words and mark them well! Only upon that day will justice truly have been served!
If one decides to go as suggested here, then all I want to add to this, is that tone plays a huge role in perception. Clearly the other dev intended this to be a joke and ins unaware of potential seriousness of the situation. The way this anwer is phrased they will be blindsided out of the blue. I understand the need to record interactions in some cases, but this is something that can be talked about eye to eye. Don't live out power-fantasies via email, just meet and decide beforehand how serious this is. Maybe you felt this was not okay. Maybe you want to save his job. Say exactly that.
The bottom line is this. I am not a nice person. You may be nice, but I'm not. So if you do stupid stuff at work, do not get me involved by texting me or emailing me about it. If you do, I'm not going to react well. I know my opinion is controversial, but it's not going to change. And if you think that I'm living out some kind of power fantasy, then so be it. I'm not going to try to change your mind about that.
Discussion on answer by Stephan Branc…
Discussion on answer by Stephan Branc…