Does sharing information about an employee's pregnancy among other employees of the controller constitute a personal data breach?

ANSWER

Information about an employee's pregnancy is special category personal data under Article 9(1) GDPR. Disclosure of such information to unauthorized persons constitutes a personal data breach as defined in Article 4(12) GDPR (unauthorized disclosure of personal data, including special category data concerning health). Such disclosure by an employee should not occur.

The controller's employee should be appropriately instructed on confidentiality rules regarding personal data processed on behalf of the controller. They should not disclose it to other colleagues. In this situation, the right to lodge a complaint with the supervisory authority (President of the Personal Data Protection Office) against the controller under Article 77(1) GDPR applies. The situation should be reported to the employer, who should take consequences against that employee under the Labour Code.