Responding to exposed customer data on a shared channel: a worked situational judgement question

Worked solution

Correct answer: Download a copy of the file so there is a record of exactly what was exposed before it is removed

The principle

Effectiveness criterion: making an additional unauthorised copy of exposed personal data increases the exposure rather than addressing it, which is worse than any option that at least attempts to contain or report the issue.

Steps

1. Downloading a copy adds a second unauthorised holder of the personal data, compounding the exposure instead of reducing it.
2. Every other option at least attempts to contain, report, or limit the exposure, even if imperfectly.
3. The action that actively makes the underlying problem worse is the least effective, regardless of intent.

Heuristic to carry forward

When ranking responses to a live exposure, the least effective option is the one that actively worsens the exposure, not merely the one that under-reacts to it.

Why each other answer is wrong

Mention it to the colleague who posted the file so they can remove it when they get a moment

Reaches the person who can fix it, but with no urgency, and data protection is not told.

Report it promptly to whoever handles data protection, or your manager, so access can be restricted

The most effective response; not the least effective.

Delete the file from the channel yourself so no one else can open it

Limits exposure, but leaves no record or report, so the breach cannot be assessed.

Post on the channel asking people not to open or share the spreadsheet

Well meant, but draws more attention to the file and does not restrict access.