I am looking for an impartial view on a situation my fiancee is in. Hopefully I can help put her mind at ease as she is in pieces.

Anna is being investigated for potential gross misconduct for sharing a username and password. She sent a website link to a colleague but unknowingly this link included her expired username and password for a third party credit reference agency (access is revoked after 28 days inactivity).

Anna had never used the details due to a recent promotion and on original receipt of the access sent an email to her IT support to have her access transferred to a colleague. IT set her colleague up with her own username and password which have only been accessed by that colleague. No customer information was ever exposed as Anna's access was decommissioned. The investigating officer of her employer has confirmed the details were never used but she is worried that even though this is the case the access details (even though decommissioned) were passed on by mistake...

Sharing of a username and or password is warrant for gross misconduct in the employee handbook...

Your thought's would be appreciated.

The fact that she did it cannot be disputed, so Anna needs to concentrate on mitigation and an explanation of how it happened, as I guess that the fact that the information could not be used is of less importance to the employer than the fact that it COULD have been something really confidential. Emphasise that in X Years she has never made such an error, is unlikely to ever do so again and has learned a very harsh lesson in checking that emails do not contain information that should not be there. Heartfelt remorse, embarrassment and a sincere apology that the employer should have had to waste time in investigating this should go a long way. Explain that it was a simple oversight, nothing more and hopefully a warning will be the worst that will happen.

Hi, I think that the employer has been over-zealous in launching a gross misconduct investigation for this. Your fiancee can't be guily of sharing the password as it was not sent deliberately. She hasn't shared the password, she has inadvertently revealed it - this is an important distinction. There may well be a breach of policy with regards to password security, but that breach is not password sharing. The employer would have been better to give her an informal telling off rather than waste their time with this sort of investigation. So there's no case to answer in terms of sharing passwords, its more a data security issue, and the fact that the password was expired is largely a mitigating factor.

My advice to your fiance would be to go to the meeting, acknowledge that she accidentally sent the password and that she will take care not to do this again going forward, but to make the following clear:

i) She didn't share the password - it was sent accidentally.

ii) The password was expired, so no confidential data was accessed.

The employer can't reasonably uphold an allegation of sharing passwords in your fiancee's circumstances.

Why is the sharing of a username and/or password warrant for gross misconduct?

What is her role and in what kind of industry is she working in?

Also, it's a good idea to remove her name or replace it with another, if you have not done so.

Why is the sharing of a username and/or password warrant for gross misconduct?

 

What is her role and in what kind of industry is she working in?

 

Also, it's a good idea to remove her name or replace it with another, if you have not done so.

Presumably because its in relation to credit referencing - highly confidential information!

OP, you've been given good advice - presumably she has a clean disciplinary record? How long has she worked there?

Could they state that they sent it in the knowledge they had confirmed the account was decommissioned and in the knowledge that no data could be accessed?

Only if they knew that statement to be true....