Hi there, I am hoping that you may be able to help me with a question relating to GDPR in the workplace.
We currently have a situation at work where a colleague has provided us (a business) text messages with another colleague. These messages may be included as evidence within an upcoming grievance.
My question is, can the organisation simply take these messages and use them as evidence, or does this constitute 'processing' under GDPR as they have now been passed from an employee to the business (the employer). Will we need to gain consent from both individuals to use these messages?
I think it is also worth noting that these messages were sent on an encrypted messaging service similar to WhatsApp, on personal devices. We are concerned that the employee who did not provide the messages, may raise possible GDPR compliance issues around processing such data which is identifiable.
Any support on this matter would be greatly appreciated.