In April a warehouse operative at one of our depots came to his manager with a printout. It was a colleague's fit note from her doctor, with her condition written on it, and he had found it by accident while looking for a delivery form he had scanned that morning.
The printers at our thirty one depots were installed by our print supplier in 2019. To make scanning simple, each one had a single button that turned paper into a file and dropped it into a folder on the depot file server, so the person could walk back to a PC and pick it up. For the same reason, everyone at the depot could read that folder. Nobody could tell in advance whose scan they would need to find.
That design worked well for delivery notes, which is what it was built for. It worked just as well for everything else people scanned, because the button did not know the difference. Supervisors scanned fit notes and accident reports to send to human resources. Managers scanned the notes of disciplinary meetings. Drivers scanned fuel receipts, and one office scanned a box of old employment contracts.
Across the depots the folders held about two hundred and fourteen thousand files, and nothing had ever been deleted. We read a sample of five hundred. Roughly one in six contained information about someone's health, their conduct at work or their home and family. Any of the twelve hundred people with a depot sign in could have opened them, and the server's own logs could not tell us who had.
We emptied and removed every shared scan folder in a week. The printers now require a badge, and a scan goes only to the mailbox of the person whose badge was used. Scans are cleared from the printer once they have been delivered. We told the people whose documents we had found, and the colleague whose fit note started it got an apology from me in person.
We had thought of the scan folder as part of the printer, a place files passed through. It was a store of the most sensitive paper in the company. Every place a device writes files to is somewhere people's data will collect, and it needs the same access rules as anywhere else.
– Serguey Shinder
Top comments (0)