Hacker News Reader

> Then they started calling my wife as she was listed as my next of kin.

Minor tangent, but that got me to wonder: would that be legal under the GDPR, which only allows you to use data for the (legitimate) purpose it was collected for?

In this case, they gathered next-of-kin info for (I assume) disbursal of benefits when the employee is dead or incapacitated. “To find the employee after he quits” would be out of that scope, then, right?

View on HN

This was in 2013, pre-GDPR but in 1998 DPA territory. Yes, I do feel it was probably a DPA violation even back then.

In Ireland next of kin is purely for cases where the person has been incapacitated/hurt and someone needs to be told. Nothing to do with dispersal of benefits etc. There's a separate process for all that.

Sorry, yes, I forgot to include informing them of a workplace injury. And I assume GDPR wasn't in force there and then, just thinking of it as a hypothetical.

The 1998 DPA was still pretty strict. I have no doubt the DPA was violated when they called my wife.

I blame the manager who came from a sales background. His response to every problem was to "call someone", rather than have the team work out what was wrong.

Reply on news.ycombinator.com