5 ms·

Most companies will have a "reasonable personal use" clause (e.g., shopping Amazon on your lunch break, etc) with regards to company PCs. I never assumed that

by mrbill 11y ago

Most companies will have a "reasonable personal use" clause (e.g., shopping Amazon on your lunch break, etc) with regards to company PCs. I never assumed that they weren't logging EVERYTHING, especially once everyone was forced to switch to MS Lync for internal IM. The last BigCo I worked for had a hard-coded login screen on the Windows machines that stated the company use policy in large text and that user activity on company equipment could be monitored at any time and no expectation of privacy was to be assumed. Being in IT, I was told by the security and proxy guys (who I worked closely with) that they only usually had to pull up logs when it was necessary to fire someone - stuff like oilfield workers browsing kiddie porn from drill sites and such. It happened a lot more than you'd expect.

vidarh 11y ago
A clause to the effect that "no expectation of privacy" is to assumed, would be null and void most places in Europe. That does not mean monitoring it not allowed, but there are substantial carve-outs. E.g. in Norway (which does have some of the more extensive privacy protections), the general rule is that surveillance of employees personal e-mail etc. is outright illegal, there are substantial restrictions on monitoring web usage, and that employers right to access an employees address on the employers mail server is also limited, and can easily violate privacy laws. Generally, for an employer to access employee e-mail addresses, there needs to be a compelling need (this could be as simple as needing access during an employees vacation, so it's not like it's safe to assume employer will never have reason to access it), or suspicion of serious violations of employment terms or laws (e.g. your child porn example would certainly qualify, as long as there'd be some evidence to support the suspicion; as would e.g. collecting evidence following claim of harassment of co-workers or similar). In terms of web access, since most of these rules are based on privacy laws, you can typically do generic monitoring e.g. of sites being accessed, but run into problems if you tie them back to individuals. One place I worked they dealt with extensive access of porn sites in working hours by publicly posting a list, with a warning that it needed to stop on grounds of concerns over harassment etc., without collecting any data on who accessed what, and access dropped drastically, and that was that.

by mrbill 11y ago

vidarh 11y ago

A clause to the effect that "no expectation of privacy" is to assumed, would be null and void most places in Europe. That does not mean monitoring it not allowed, but there are substantial carve-outs. E.g. in Norway (which does have some of the more extensive privacy protections), the general rule is that surveillance of employees personal e-mail etc. is outright illegal, there are substantial restrictions on monitoring web usage, and that employers right to access an employees address on the employers mail server is also limited, and can easily violate privacy laws. Generally, for an employer to access employee e-mail addresses, there needs to be a compelling need (this could be as simple as needing access during an employees vacation, so it's not like it's safe to assume employer will never have reason to access it), or suspicion of serious violations of employment terms or laws (e.g. your child porn example would certainly qualify, as long as there'd be some evidence to support the suspicion; as would e.g. collecting evidence following claim of harassment of co-workers or similar). In terms of web access, since most of these rules are based on privacy laws, you can typically do generic monitoring e.g. of sites being accessed, but run into problems if you tie them back to individuals. One place I worked they dealt with extensive access of porn sites in working hours by publicly posting a list, with a warning that it needed to stop on grounds of concerns over harassment etc., without collecting any data on who accessed what, and access dropped drastically, and that was that.