16 ms·

Private messages at work can be read by EU employers

224 points by antouank 11y ago

alistairSH 11y ago
tl;dr - European Court of Human Rights (ECHR) says employers can read private messages/mail sent (via non-corporate providers) on company time. While I understand the employer's desire to ensure employees are working, does this open up personal cell phone conversations to monitoring as well?
- amlgsmsn 11y ago
  The Yahoo IM account used was a work related account, so it's not clear whether the ruling would apply to a personal IM account.
  - brazzledazzle 11y ago
    He had both a personal and professional account and they made the case that they accidentally read the personal one.
- unfocused 11y ago
  My answer to your question is "No, it doesn't open up the personal cell phone conversations to monitoring". Because a personal cell phone is a personal device and there is an expectation of privacy once you start using the word "personal", regardless of who owns the device. I would actually add a bit more as the judges were trying to differentiate between work accounts and personal accounts: "He argued that his right to a private life had been breached when his employer had read a log of messages on a Yahoo Messenger account he had set up for work, as well as that from a second personal one." "Despite claims about the second, personal account, the judges only discussed the work account in their ruling." "The device used to send the messages was owned by the employer, and the judges did not elaborate on whether it would have made any difference if he had used a personal device." The missing piece of this article is what does the company policy say? In addition, it's clear the judges are saying that if you are using the work (corporate) network, you should not have any expectation of privacy, regardless of who owns the device. What is unclear thing is who defined/authorized the personal account he created while using the work network? If the company authorized it, then they cannot log it and there is indeed an expectation to privacy. If they didn't, and he is simply personal making accounts using the corporate network, then he would not have an expectation of privacy in my opinion. I'm also surprised only 1 judge said "One of the eight judges disagreed with the decision, saying that a blanket ban on personal internet use was unacceptable." There should always be some room for personal use e.g. calling your doctor, kids at school, etc. A blanket ban is not practical at all and can never be fully enforced.
  - vertex-four 11y ago
    > If they didn't, and he is simply personal making accounts using the corporate network, then he would not have an expectation of privacy in my opinion. Not quite right - this is one of the grey areas where the law defines something in between "has an expectation of privacy" and "doesn't have an expectation of privacy". Basically, the employer generally can't access personal information on work computers, even connected to work networks, unless they have a reasonable belief that e.g. there's evidence of the employee breaking policy in that personal information. Even then, they must access as little as possible - for example, if you believe that the employee has personal information on their computer and having personal information is against policy in itself, and that's the only thing you believe, all you can do is ascertain that it actually exists - you can't go digging through people's family photos or private communications unless you reasonably believe that there's further policy violation in there.
    - unfocused 11y ago
      I fully agree with you with the grey area sentiment. I eluded it it by saying "my opinion" as I'm not sure we have all the facts given that all policies are different. The policy the employee accepts, and to be honest not enough employers explain these policies, should be the starting point of determining what is allowed and what isn't to a certain extent. This is definitely a difficult problem.
      - vertex-four 11y ago
        > The policy the employee accepts, and to be honest not enough employers explain these policies, should be the starting point of determining what is allowed and what isn't to a certain extent. While true, we also have a "right to a private life" under Article 8 of the ECHR (where many rights protect you from employers as well as the State, including this one). When your spouse, or your doctor, calls you with an emergency on your company phone because they can't reach you on your mobile for whatever reason, should your employer have the right to know intimate details of your private life or health? The answer we came to is "no", whereas the US might come to "yes" as its constitution only covers a very narrow definition of privacy which doesn't take into account many modernities. So widespread, aimless listening on work communications, in the majority of cases, is probably against the law across the EU due to the above argument. Proportionate and limited listening is allowed - for example, if you wanted an alert every time someone accessed Facebook as using it for personal use is against policy, you could do that, but you couldn't go and read all their private chat messages and posts whatever your policy says (unless you have a reasonable belief the account was supposed to be work-specific - for example, you specifically authorized this specific account - and you accidentally stumble across something personal, or that the employee is e.g. sharing trade secrets through Facebook).
- bnegreve 11y ago
  > Because it believed it was accessing a work account, the judges said, the firm had not erred. I think this is relevant, at my workplace which is in EU, sysadmins are allowed to access anything that is not explicitly marked as personal. I've always assumed that this is some kind of EU regulation, but I don't know. Does anybody here knows?
  - m_t 11y ago
    This is the case in France, and you're even allowed to use work equipment for personal things as long as it is done in a reasonable amount. For instance, reading news articles on your work computer browser, browsing your personal facebook account, either during a break or for a few minutes a day, will be seen as reasonable. On the other hand, if you spend 6hrs out of 8 doing personal stuffs, the employer can use this against you. I also assumed this kind of usage would be protected by a court like the European Court of Human Rights, but I was wrong.
- sitkack 11y ago
  It is my understanding that in Germany, an employer cannot listen into an employee's phone conversation, even on employer equipment.
  - izacus 11y ago
    Or your personal GMail, IM or other private communication. They can fire you for doing it, but not read the contents.
RankingMember 11y ago
What kind of awful company would be expending resources doing this?
- mtgx 11y ago
  Companies like Sony, who want everyone's conversations in one place, so when they inevitably get hacked we can all read those conversations in public.
- unethical_ban 11y ago
  Every company with a competent information security department. Protip: Never, ever, use company resources (laptops and workstations, potentially even cell phones) for your personal communications. They likely are MITM with their own root CA and can see what you're doing. Reason: It's their device on their network, and it has access to company data. Get a cell phone with a good data plan.
  - alkonaut 11y ago
    If I get an email at work hours and see it on my smartphone, I'd probably rather go to gmail on my work computer to reply, than type in a reply on the phone.
    - finnn 11y ago
      That's fine, but don't get all surprised when your work sees it.
  - thieving_magpie 11y ago
    Of course they can, doesn't mean they should. For instance, if they're trying to attract talented employees that's a great way to put them off.
    - unethical_ban 11y ago
      Depends on the industry. If a bank doesn't do this, then it's much easier for an employee to send out PII dumps. If your "Github for farmers" startup isn't worried about code commits to the cloud, then no biggie.
mynewtb 11y ago
The employer thought they were reading the professional work account's messages.
panglott 11y ago
"His employer had discovered that he was using Yahoo Messenger for personal contacts, as well as professional ones. Because it believed it was accessing a work account, the judges said, the firm had not erred. The man, named Bogdan Barbulescu, ...argued that his right to a private life had been breached when his employer had read a log of messages on a Yahoo Messenger account he had set up for work, as well as that from a second personal one. Mr Barbulescu's employer had banned its staff from sending personal messages at work. To check his account, the judges said, it had been necessary for his employer to access his records." It sounds like a stupid policy, but all the company did was access a Yahoo account that he had set up as a work account and saw that he had also been using it for personal communications.
- brazzledazzle 11y ago
  It's possible the usernames were similar but the profile and log directories have a very clear separation between accounts that any IT person would be able to see. This sounds more like a justification after the fact.
  - debacle 11y ago
    If the file is on your work PC it belongs to your employer. It's a sticky situation but that's how it is.
    - Nadya 11y ago
      Which is why I use an external thumb drive with portable software and save any personal files to the thumb drive. It may hit their network but nothing is stored on their computers. Which gives plausible deniability - and I do not think they can legally search the thumb drive. Not that I'm paranoid about my current employer (extremely relaxed culture) but it is something I do out of habit.
      - totalgeek 11y ago
        They may have the right to search your thumb drive if they believe you are downloading company data that may help the competition or cost revenue.
mhurron 11y ago
Keep your personal information off your work devices.
- Someone1234 11y ago
  Or if you absolutely MUST then treat work like public WiFi. No doubt they will have an internal CA installed, but if you keep an eye on who authored the certificates on your favorite websites, you can reasonably be assured of some privacy. Additionally install HTTPS everywhere. Then all you need to be paranoid about is remote monitoring software.
- angdis 11y ago
  I hear this as "blanket advice" all the time, but very rarely is there a discussion about what is reasonable to expect from a "normal" employer who isn't draconian or looking to find an excuse to fire someone.
  - marcosdumay 11y ago
    If you work on a big company, that is any time, without your knowledge, or even any reason for your suspicion.
    - angdis 11y ago
      OK, that is what is "legally possible" in a worst-case scenario. But IN PRACTICE, what is normal? Your statement seems to indicate that IT staff can just browse personal communications, desktop displays, keypresses. I am sure that they can if necessary, but what kinds of scale and automation are we talking about? Doing such surveillance ad-hoc or without a very small number of targets seems like it would easily become intractable for any org with thousands of people. I am not in an IT department, so I have no idea what goes on. It seems the standard advice is always to take the most extreme precautions and to follow the corporate rules to the letter... but here I am typing this into a work computer on a chrome browser without a care in the world.
      - 11y ago
thomnottom 11y ago
Wait, he was using a work account on a company-owned device? I don't see how that can be called a "private message" at all.
- oblio 11y ago
  Judging from what many Romanian people I know do, he was probably using Yahoo Messenger to talk to his colleagues and his friends at the same time (some of which might have been friends and colleagues at the same time). Most likely from his personal YM! account. The real problem was using YM! for work conversations. But if the company involved did not have its own internal messaging setup... it's an easy mistake to make.
  - ddalex 11y ago
    This was a work account, set up at the request of the employer, and managed by such. Using a work account for private stuff should set some expectations regarding privacy rights.
vertex-four 11y ago
The trick here, as my understanding of the law goes, is that (a) the company had a policy that work computers are to be used for work only, AND (b) that the account in question was being used for both personal and professional contacts. In general, your workplace can (assuming that you have agreed to this in policy) ensure that you're using your computer for approved uses, and it can access all work-related information on the computer. You do have (limited) privacy over anything personal on the computer, but they're welcome to discipline or fire you just for its existence, and in some cases they may access it if they have reasonable belief that they have to. This ruling clarifies that if your personal information is mixed in with professional information, the company may access it, as little as necessary (the word you'll come across lots is "proportionate"), as part of an internal investigation or similar. This has been spelled out by at least the British Government for a while now, nothing has changed. EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer?
- x5n1 11y ago
  Better not to work for such companies.
  - Alupis 11y ago
    > Better not to work for such companies. Don't work for a company that monitors it's own IT equipment? Monitoring the equipment is to ensure it's working properly, as well as to guard against employees misusing company equipment by installing toolbars and apps that have no business purpose (which ultimately leads to mis-performing equipment, and lost productivity). I don't think I'd want to work for a company like that - the IT equipment would be in shambles, borderline unusable.
    - s73v3r 11y ago
      Why? Do you only work for companies that employ children?
      - Alupis 11y ago
JTon 11y ago
So I have a personal device (dual sim) with a personal sim and work sim inserted. I have subscribed to my IT security policies. Any idea what my exposure is? My gut says they'll treat my device like their own
- Spooky23 11y ago
  Where I have worked, if you're under investigation or subject to retention we'll seize your device. If you refuse, you'll get canned or sued.
zeveb 11y ago
The owner of a computing device has ultimate rights to the device. If your employer owns your computer, he has every right to inspect his device and ensure that you are not misusing it. He has every right not to permit you to connect a personal computing device to his network, and he has every right to inspect the packets you send on his network. This ought to be uncontroversial. It should be taught in school: Don't use your work accounts for personal stuff, and don't use your personal accounts for work stuff (I'd go even further and say don't have just one personal account for everything).
- forgotpwtomain 11y ago
  What load of BS. I don't see how my agreement to their policy should provide them with immunity to what would otherwise be criminal. e.g. That it's criminal to steal from my employer should not mean that if they suspect an employee is stealing from them they can without repercussion steal-back. Likewise they may have certain legal rights if an employee violates their computer-usage policy -- but that shouldn't give them the right to violate the CFAA. Checking whether an employee "completing their professional tasks" and reading their private correspondence are very different things. How is this any different (aside from prefixing the word computer) then if you had personal letters on your desk and a manager confiscated them from you (and read them) - in order to "confirm" that you were using "completing their professional tasks".
  - jdmichal 11y ago
    The employee was using the same messenger session for both professional and personal actions. Part of the ruling was that it was reasonable for the employer to check the logs of the session, because it was ostensibly being used for professional actions. > His employer had discovered that he was using Yahoo Messenger for personal contacts, as well as professional ones. > Because it believed it was accessing a work account, the judges said, the firm had not erred. EDIT: Removed unnecessary remark.
  - brianbarker 11y ago
    I've worked at places where they set any pcs on the domain to accept their ssl cert. Then they mitm all your https traffic and scan everything. That would include banking, gmail, etc. Best not to do that stuff at work. You also have to wonder about the internal wifi people put their phones on.
6stringmerc 11y ago
>And they added that Mr Barbulescu had had prior warning that the company could check his messages. ...and there's the part where I'm not surprised this fellow lost his lawsuit. Honestly, if I come to a railroad crossing and the gate/arm is down and red lights are blinking, and I go onto the tracks anyway, I think I kind of sort of lose the ability to win a lawsuit against the railroad company for hitting my car.
- adam12 11y ago
  What if the company said that they were going to assault him if he was to use private messaging? Does that make it alright because they warned him?
  - blowski 11y ago
    No, because assault is obviously wrong, whereas his employer having access to his private messaging on his work machine in work time was more of a grey area.
    - AlexandrB 11y ago
      If it's a grey area why should he have expected to lose the lawsuit?
      - blowski 11y ago
        If it wasn't a grey area, why would the European Court of Human Rights be hearing it instead of a local employment tribunal? Lots of law is a grey area, with both sides putting their argument and a judge adjudicating. On the other hand, an employer physically assaulting an employee (with or without warning) wouldn't need to be heard by the ECHR because there is so much law and precedent to say that employers can't do that. This is a straw man argument, and it's really not worth debating.
  - gepoch 11y ago
    Right. What the company did was bad, regardless of the warning. But I think his argument would have been stronger if he had raised the issue after his initial warning. Why did they have to invade his privacy twice for it to become an issue for him? The answer: because he was sacked. This seems to change it from a privacy issue to a retaliation. Not that I'm okay at all with employers being able to violate his privacy, regardless of his motives for claiming his civil rights.
finid 11y ago
Work is not were you want to send private messages that are not work-related from. Keep that simple rule in mind and you'll save yourself a lot of heartache.
- antocv 11y ago
  Work is a sweatshop, where you slave away, dont ever forget that.
yAnonymous 11y ago
That's a very specific case and it seems the main problem was that he sent private messages from a monitored work account. If you send private messages over your company's Twitter account, you can expect to be fired, too.
stensonb 11y ago
"Not if you're doing it correctly", say mathematicians.
rogeryu 11y ago
All real personal stuff is done on my smartphone. I use 4G only at work, no work wifi. I do not open personal mail at the work computer. No Facebook, except sometimes on the phone. The only thing I do is reading and posting here and at several other websites. I have no idea if my employer knows about this, but I haven't had any remarks about it and I do this for years now. Reading articles on this website and elsewhere (like Slashdot) is a distraction I need on a regular basis. And we don't have a policy like this, so I guess this doesn't apply to me.
- pc86 11y ago
  Honestly a 4G-only, no-guest-wifi policy is the safest from a privacy perspective. The downside being that it's possible someone sees you three times in one day and you happen to be on your phone two or three of those times.
stensonb 11y ago
"Not if you do it correctly", say mathematicians.
josh_carterPDX 11y ago
At this point, if you don't understand that company equipment is to be used for company business only, then you're clearly not using your best judgement. Whether or not there's a policy, it should be implied that the equipment a company gives you belongs to them. You wouldn't take a company vehicle to a party or to the bar? Ok, maybe you would, but SMH. The point is that company equipment should be used to that purpose. If you use it for any other purpose you should expect that it's going to be scrutinized. If you don't want someone reading your emails or messages on a company computer, then use something else like a tablet or your phone to conduct personal business. I find the amount of conversation here about this so confusing.
- hamburglar 11y ago
  Exactly. My tendency is to try to keep my personal use of company computers to a reasonable level and conservative scope, because while I know my company is going to be reasonable about it and most likely leave me alone, I fully recognize that it's their computer and me using it for personal things exposes those things to their scrutiny if they have reason, or even if they suspect they have reason. Frankly, I'd be a little surprised if none of my employers have ever perused my browsing habits while investigating something (example: I once had an officemate get fired for sucking up all the office bandwidth by running a public porn server from his desktop -- that was a super dumb move, and I really wouldn't hold it against anyone investigating the problem to take a general survey of our web traffic habits in the course of chasing that down).
  - josh_carterPDX 11y ago
    Definitely. This is especially important for companies that are public or are planning to go public. Knuckleheads exist everywhere and they can be a liability if not kept in check.
mizchief2 11y ago
Encryption.
- kinghajj 11y ago
  Yep. Very first thing I do when setting up a work machine is enable full-disk encryption, both to protect company assets from theft, and protect any sensitive material from prying coworkers/management.
  - teddyh 11y ago
    Same here. It amazes me that this is not more common.
    - p4wnc6 11y ago
      I wonder if doing this, just the action of choosing to encrypt, would be held up as sufficient grounds for the company to investigate your activity, or even possibly regarded immediately as criminal or potentially criminal. I can see a lot of companies coming up with extremely irrational policies that say that any attempt to encrypt anything is inherently not allowed.
      - teddyh 11y ago
        What? I don’t just encrypt my desktop, I encrypt all the servers too, for the same reason.
ChrisRazzzz 11y ago
Question is Slack falls under this..., if people use Slack at the office on multiple channels than you could consider it a private message on a work computer.
Evolved 11y ago
Hasn't the safe advice been that whatever you do on company resources (except time) can be monitored/investigated by the company? Isn't it generally bad practice to handle personal business on a work phone/work laptop/work desktop anyway due to the assumption that your activities can be legally monitored by your company? Understandably, if you make a send a message/make a personal phone call on company time to your doctor or spouse regarding some issue then that shouldn't be grounds for the company to investigate just because you were on their time and my reasoning for this is that even when you're off the clock, you can still be disciplined for activities that may portray the company in a bad light (getting into a bar fight after work, for example) so its assumed that you're never really off work. Either way, if I were him I wouldn't have assumed I could have used company hardware to send personal messages yet still have an expectation of privacy.
djhworld 11y ago
The key in this case was the guy was using a Yahoo account that was designated for work purposes to message his brother. What the ruling DOESN'T mean is employers cannot say, demand access to your personal gmail account. However they can reprimand you for visiting gmail.com or whatever for periods of time more than what they deem acceptable.
iamleppert 11y ago
If there is that much distrust in your employee or employees, you should just fire them.
p4wnc6 11y ago
I know everyone is going to shoot this idea down with a million reasons why, but even so: why are these laws never symmetric? Why can't employees also access things possessed and used by the employer, like, say, HR personnel files, or executive emails, so that employees can verify the company is not committing fraud, engaging in discriminatory practices, etc.? There's such an emphasis on what the company has a right to do to protect itself that we almost don't even think about how company actions, which could be damaging to and unapproved by the employee, go on unchecked all the time. I assume the answer is just "might makes right" and the employer is the one with capital available for legal and political manipulation. But what's so surprising to me is that we rarely even talk about it even in an era with so much overt and publicly hated corporate corruption.
- dahart 11y ago
  This is actually an interesting question, IMO. But, I think you can quickly see the situation is not inherently symmetric, so the answer can't be either. Just one example - giving employees open access to company materials affects the privacy rights of other people, not just the company. So in order to protect the privacy rights you do have vs the company, they will have to restrict other people's access to your information. The title of this article is misleading in the sense that the decision was that companies may inspect employees' PMs that originate from company computers. They did not make a blanket decision that the company may monitor personal phones or personal computers. That highlights how the situation is not symmetric in the sense that you haven't loaned your computers to the company in order to produce their personnel files.
  - p4wnc6 11y ago
    I agree with you that it wouldn't be perfectly symmetric and a number of difficult follow-on issues would arise. But, I see a lot of emphasis being placed on the fact that it was a company-owned machine and that it was ostensibly being used for company purposes. These two facts seem to underpin a lot of what everyone says. But ownership and mode of use are not the only kinds of resources or properties to think of. For example, at least in the US we have the concept of "company time" which covers the time periods during which you are performing an action sanctioned by a company. Could this be used to demand the ability to monitor employees during time periods when they are on company time? Likewise, there are a lot of gray areas going in the reverse direction -- from employee to employer. For example, it is true that HR records (say, for example, performance reviews written by my boss about solely me) are electronic files that are the property of the company, just like a computer workstation is property of the company. But, just as a computer workstation could be misused for personal use, and thus needs to be inspectable for compliance, so also the HR files could be misused for personal use (making jokes, talking about non-professional aspects of me, conspiring to deny a promotion simply due to personal preference, etc.) -- so why aren't such files open for inspection? Yet another interesting aspect of all of this is why we believe that not only must the workstation be made available for inspection, but further that it is the employer who gets to perform the inspection. Why isn't such inspection required to be handled by a third-party arbiter, much the way that tax and official records are required to be kept by a certified firm specializing in it. We don't trust companies to say, "Yep, these are my taxes and records, I swear I didn't lie or hide any money." We at least require some third-party to attest to that and stake a reputation on it (subverted though it may be). Yet with issues of inspection, we just sort of capitulate to this idea that the employer not only gets to raise the issue of suspicion about misuse, but also gets to be the authority on the investigation of whether or not misuse occurred, and to what extent employee privacy must be invaded to get all the relevant info.
ivanhoe 11y ago
Maybe it's legal, but after learning all this would you still apply for a job there?
- antihero 11y ago
  If finding work is tough and you needed to pay rent and eat, like in the real world, then all this "you agree to their policy" stuff is frankly sinister. Basically unless you're lucky enough to be desirable enough to the diminishing amount of companies that don't treat their employees like cattle, you have to basically suck up having your privacy shat on.
  - ivanhoe 11y ago
    absolutely, but we don't talk about unskilled workforce, this guy is an engineer. And even if work is hard to find and you have to take it, you probably will be actively looking for a better job very quickly. So ultimately company that is enforcing such strict and hostile rules is going to loose all the best people very quickly (because they will be first to get a better job)... and that's bad for business and at the same time I doubt that it improves performance significantly, so it's pretty stupid strategy IMHO...
Zenst 11y ago
If it is upon employer equipment and time, then it is reasonable for the employer to expect it to be work related. In this case the chap blurred those lines and even using a personal account for work related stuff is going to violate and respectable data policies a company may have and indeed many a work contract alone. The headline does make it sound a bit oft when you read the article and not the best choice when you read it is not as clear cut as the headline portrays. Still never mix business with pleasure being the moral on this one and not a mass panic my private emails can be demanded by HR.
philippeback 11y ago
I am my own boss, yeah
gerty 11y ago
The title is subtly misleading. This ruling applies not only in the EU countries but also in in member countries of Council of Europe. That is EU, EEA, Balkans, Russia, Turkey and a few more.
walshemj 11y ago
This is a dangerous precedent to set normaly invasive monitoring or workers is only used for investigating serious offenses.
deleted 11y ago
[deleted]
czl 11y ago
Can employer capture your passwords and use them to access your cloud accounts? Gmail? Facebook? Etc?
known 11y ago
ECHR should have considered https://en.wikipedia.org/wiki/Information_asymmetry https://en.wikipedia.org/wiki/Information_asymmetry

224 points by antouank 11y ago

tl;dr - European Court of Human Rights (ECHR) says employers can read private messages/mail sent (via non-corporate providers) on company time. While I understand the employer's desire to ensure employees are working, does this open up personal cell phone conversations to monitoring as well?

amlgsmsn 11y ago
The Yahoo IM account used was a work related account, so it's not clear whether the ruling would apply to a personal IM account.
- brazzledazzle 11y ago
  He had both a personal and professional account and they made the case that they accidentally read the personal one.
unfocused 11y ago
My answer to your question is "No, it doesn't open up the personal cell phone conversations to monitoring". Because a personal cell phone is a personal device and there is an expectation of privacy once you start using the word "personal", regardless of who owns the device. I would actually add a bit more as the judges were trying to differentiate between work accounts and personal accounts: "He argued that his right to a private life had been breached when his employer had read a log of messages on a Yahoo Messenger account he had set up for work, as well as that from a second personal one." "Despite claims about the second, personal account, the judges only discussed the work account in their ruling." "The device used to send the messages was owned by the employer, and the judges did not elaborate on whether it would have made any difference if he had used a personal device." The missing piece of this article is what does the company policy say? In addition, it's clear the judges are saying that if you are using the work (corporate) network, you should not have any expectation of privacy, regardless of who owns the device. What is unclear thing is who defined/authorized the personal account he created while using the work network? If the company authorized it, then they cannot log it and there is indeed an expectation to privacy. If they didn't, and he is simply personal making accounts using the corporate network, then he would not have an expectation of privacy in my opinion. I'm also surprised only 1 judge said "One of the eight judges disagreed with the decision, saying that a blanket ban on personal internet use was unacceptable." There should always be some room for personal use e.g. calling your doctor, kids at school, etc. A blanket ban is not practical at all and can never be fully enforced.
- vertex-four 11y ago
  > If they didn't, and he is simply personal making accounts using the corporate network, then he would not have an expectation of privacy in my opinion. Not quite right - this is one of the grey areas where the law defines something in between "has an expectation of privacy" and "doesn't have an expectation of privacy". Basically, the employer generally can't access personal information on work computers, even connected to work networks, unless they have a reasonable belief that e.g. there's evidence of the employee breaking policy in that personal information. Even then, they must access as little as possible - for example, if you believe that the employee has personal information on their computer and having personal information is against policy in itself, and that's the only thing you believe, all you can do is ascertain that it actually exists - you can't go digging through people's family photos or private communications unless you reasonably believe that there's further policy violation in there.
  - unfocused 11y ago
    I fully agree with you with the grey area sentiment. I eluded it it by saying "my opinion" as I'm not sure we have all the facts given that all policies are different. The policy the employee accepts, and to be honest not enough employers explain these policies, should be the starting point of determining what is allowed and what isn't to a certain extent. This is definitely a difficult problem.
    - vertex-four 11y ago
      > The policy the employee accepts, and to be honest not enough employers explain these policies, should be the starting point of determining what is allowed and what isn't to a certain extent. While true, we also have a "right to a private life" under Article 8 of the ECHR (where many rights protect you from employers as well as the State, including this one). When your spouse, or your doctor, calls you with an emergency on your company phone because they can't reach you on your mobile for whatever reason, should your employer have the right to know intimate details of your private life or health? The answer we came to is "no", whereas the US might come to "yes" as its constitution only covers a very narrow definition of privacy which doesn't take into account many modernities. So widespread, aimless listening on work communications, in the majority of cases, is probably against the law across the EU due to the above argument. Proportionate and limited listening is allowed - for example, if you wanted an alert every time someone accessed Facebook as using it for personal use is against policy, you could do that, but you couldn't go and read all their private chat messages and posts whatever your policy says (unless you have a reasonable belief the account was supposed to be work-specific - for example, you specifically authorized this specific account - and you accidentally stumble across something personal, or that the employee is e.g. sharing trade secrets through Facebook).
bnegreve 11y ago
> Because it believed it was accessing a work account, the judges said, the firm had not erred. I think this is relevant, at my workplace which is in EU, sysadmins are allowed to access anything that is not explicitly marked as personal. I've always assumed that this is some kind of EU regulation, but I don't know. Does anybody here knows?
- m_t 11y ago
  This is the case in France, and you're even allowed to use work equipment for personal things as long as it is done in a reasonable amount. For instance, reading news articles on your work computer browser, browsing your personal facebook account, either during a break or for a few minutes a day, will be seen as reasonable. On the other hand, if you spend 6hrs out of 8 doing personal stuffs, the employer can use this against you. I also assumed this kind of usage would be protected by a court like the European Court of Human Rights, but I was wrong.
sitkack 11y ago
It is my understanding that in Germany, an employer cannot listen into an employee's phone conversation, even on employer equipment.
- izacus 11y ago
  Or your personal GMail, IM or other private communication. They can fire you for doing it, but not read the contents.

RankingMember 11y ago

What kind of awful company would be expending resources doing this?

mtgx 11y ago
Companies like Sony, who want everyone's conversations in one place, so when they inevitably get hacked we can all read those conversations in public.
unethical_ban 11y ago
Every company with a competent information security department. Protip: Never, ever, use company resources (laptops and workstations, potentially even cell phones) for your personal communications. They likely are MITM with their own root CA and can see what you're doing. Reason: It's their device on their network, and it has access to company data. Get a cell phone with a good data plan.
- alkonaut 11y ago
  If I get an email at work hours and see it on my smartphone, I'd probably rather go to gmail on my work computer to reply, than type in a reply on the phone.
  - finnn 11y ago
    That's fine, but don't get all surprised when your work sees it.
- thieving_magpie 11y ago
  Of course they can, doesn't mean they should. For instance, if they're trying to attract talented employees that's a great way to put them off.
  - unethical_ban 11y ago
    Depends on the industry. If a bank doesn't do this, then it's much easier for an employee to send out PII dumps. If your "Github for farmers" startup isn't worried about code commits to the cloud, then no biggie.

mynewtb 11y ago

The employer thought they were reading the professional work account's messages.

panglott 11y ago

"His employer had discovered that he was using Yahoo Messenger for personal contacts, as well as professional ones. Because it believed it was accessing a work account, the judges said, the firm had not erred. The man, named Bogdan Barbulescu, ...argued that his right to a private life had been breached when his employer had read a log of messages on a Yahoo Messenger account he had set up for work, as well as that from a second personal one. Mr Barbulescu's employer had banned its staff from sending personal messages at work. To check his account, the judges said, it had been necessary for his employer to access his records." It sounds like a stupid policy, but all the company did was access a Yahoo account that he had set up as a work account and saw that he had also been using it for personal communications.

brazzledazzle 11y ago
It's possible the usernames were similar but the profile and log directories have a very clear separation between accounts that any IT person would be able to see. This sounds more like a justification after the fact.
- debacle 11y ago
  If the file is on your work PC it belongs to your employer. It's a sticky situation but that's how it is.
  - Nadya 11y ago
    Which is why I use an external thumb drive with portable software and save any personal files to the thumb drive. It may hit their network but nothing is stored on their computers. Which gives plausible deniability - and I do not think they can legally search the thumb drive. Not that I'm paranoid about my current employer (extremely relaxed culture) but it is something I do out of habit.
    - totalgeek 11y ago
      They may have the right to search your thumb drive if they believe you are downloading company data that may help the competition or cost revenue.

mhurron 11y ago

Keep your personal information off your work devices.

Someone1234 11y ago
Or if you absolutely MUST then treat work like public WiFi. No doubt they will have an internal CA installed, but if you keep an eye on who authored the certificates on your favorite websites, you can reasonably be assured of some privacy. Additionally install HTTPS everywhere. Then all you need to be paranoid about is remote monitoring software.
angdis 11y ago
I hear this as "blanket advice" all the time, but very rarely is there a discussion about what is reasonable to expect from a "normal" employer who isn't draconian or looking to find an excuse to fire someone.
- marcosdumay 11y ago
  If you work on a big company, that is any time, without your knowledge, or even any reason for your suspicion.
  - angdis 11y ago
    OK, that is what is "legally possible" in a worst-case scenario. But IN PRACTICE, what is normal? Your statement seems to indicate that IT staff can just browse personal communications, desktop displays, keypresses. I am sure that they can if necessary, but what kinds of scale and automation are we talking about? Doing such surveillance ad-hoc or without a very small number of targets seems like it would easily become intractable for any org with thousands of people. I am not in an IT department, so I have no idea what goes on. It seems the standard advice is always to take the most extreme precautions and to follow the corporate rules to the letter... but here I am typing this into a work computer on a chrome browser without a care in the world.
    - 11y ago

thomnottom 11y ago

Wait, he was using a work account on a company-owned device? I don't see how that can be called a "private message" at all.

oblio 11y ago
Judging from what many Romanian people I know do, he was probably using Yahoo Messenger to talk to his colleagues and his friends at the same time (some of which might have been friends and colleagues at the same time). Most likely from his personal YM! account. The real problem was using YM! for work conversations. But if the company involved did not have its own internal messaging setup... it's an easy mistake to make.
- ddalex 11y ago
  This was a work account, set up at the request of the employer, and managed by such. Using a work account for private stuff should set some expectations regarding privacy rights.

vertex-four 11y ago

The trick here, as my understanding of the law goes, is that (a) the company had a policy that work computers are to be used for work only, AND (b) that the account in question was being used for both personal and professional contacts. In general, your workplace can (assuming that you have agreed to this in policy) ensure that you're using your computer for approved uses, and it can access all work-related information on the computer. You do have (limited) privacy over anything personal on the computer, but they're welcome to discipline or fire you just for its existence, and in some cases they may access it if they have reasonable belief that they have to. This ruling clarifies that if your personal information is mixed in with professional information, the company may access it, as little as necessary (the word you'll come across lots is "proportionate"), as part of an internal investigation or similar. This has been spelled out by at least the British Government for a while now, nothing has changed. EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer?

x5n1 11y ago
Better not to work for such companies.
- Alupis 11y ago
  > Better not to work for such companies. Don't work for a company that monitors it's own IT equipment? Monitoring the equipment is to ensure it's working properly, as well as to guard against employees misusing company equipment by installing toolbars and apps that have no business purpose (which ultimately leads to mis-performing equipment, and lost productivity). I don't think I'd want to work for a company like that - the IT equipment would be in shambles, borderline unusable.
  - s73v3r 11y ago
    Why? Do you only work for companies that employ children?
    - Alupis 11y ago

JTon 11y ago

So I have a personal device (dual sim) with a personal sim and work sim inserted. I have subscribed to my IT security policies. Any idea what my exposure is? My gut says they'll treat my device like their own

Spooky23 11y ago
Where I have worked, if you're under investigation or subject to retention we'll seize your device. If you refuse, you'll get canned or sued.

zeveb 11y ago

The owner of a computing device has ultimate rights to the device. If your employer owns your computer, he has every right to inspect his device and ensure that you are not misusing it. He has every right not to permit you to connect a personal computing device to his network, and he has every right to inspect the packets you send on his network. This ought to be uncontroversial. It should be taught in school: Don't use your work accounts for personal stuff, and don't use your personal accounts for work stuff (I'd go even further and say don't have just one personal account for everything).

forgotpwtomain 11y ago
What load of BS. I don't see how my agreement to their policy should provide them with immunity to what would otherwise be criminal. e.g. That it's criminal to steal from my employer should not mean that if they suspect an employee is stealing from them they can without repercussion steal-back. Likewise they may have certain legal rights if an employee violates their computer-usage policy -- but that shouldn't give them the right to violate the CFAA. Checking whether an employee "completing their professional tasks" and reading their private correspondence are very different things. How is this any different (aside from prefixing the word computer) then if you had personal letters on your desk and a manager confiscated them from you (and read them) - in order to "confirm" that you were using "completing their professional tasks".
- jdmichal 11y ago
  The employee was using the same messenger session for both professional and personal actions. Part of the ruling was that it was reasonable for the employer to check the logs of the session, because it was ostensibly being used for professional actions. > His employer had discovered that he was using Yahoo Messenger for personal contacts, as well as professional ones. > Because it believed it was accessing a work account, the judges said, the firm had not erred. EDIT: Removed unnecessary remark.
- brianbarker 11y ago
  I've worked at places where they set any pcs on the domain to accept their ssl cert. Then they mitm all your https traffic and scan everything. That would include banking, gmail, etc. Best not to do that stuff at work. You also have to wonder about the internal wifi people put their phones on.

6stringmerc 11y ago

>And they added that Mr Barbulescu had had prior warning that the company could check his messages. ...and there's the part where I'm not surprised this fellow lost his lawsuit. Honestly, if I come to a railroad crossing and the gate/arm is down and red lights are blinking, and I go onto the tracks anyway, I think I kind of sort of lose the ability to win a lawsuit against the railroad company for hitting my car.

adam12 11y ago
What if the company said that they were going to assault him if he was to use private messaging? Does that make it alright because they warned him?
- blowski 11y ago
  No, because assault is obviously wrong, whereas his employer having access to his private messaging on his work machine in work time was more of a grey area.
  - AlexandrB 11y ago
    If it's a grey area why should he have expected to lose the lawsuit?
    - blowski 11y ago
      If it wasn't a grey area, why would the European Court of Human Rights be hearing it instead of a local employment tribunal? Lots of law is a grey area, with both sides putting their argument and a judge adjudicating. On the other hand, an employer physically assaulting an employee (with or without warning) wouldn't need to be heard by the ECHR because there is so much law and precedent to say that employers can't do that. This is a straw man argument, and it's really not worth debating.
- gepoch 11y ago
  Right. What the company did was bad, regardless of the warning. But I think his argument would have been stronger if he had raised the issue after his initial warning. Why did they have to invade his privacy twice for it to become an issue for him? The answer: because he was sacked. This seems to change it from a privacy issue to a retaliation. Not that I'm okay at all with employers being able to violate his privacy, regardless of his motives for claiming his civil rights.

finid 11y ago

Work is not were you want to send private messages that are not work-related from. Keep that simple rule in mind and you'll save yourself a lot of heartache.

antocv 11y ago
Work is a sweatshop, where you slave away, dont ever forget that.

yAnonymous 11y ago

That's a very specific case and it seems the main problem was that he sent private messages from a monitored work account. If you send private messages over your company's Twitter account, you can expect to be fired, too.

stensonb 11y ago

"Not if you're doing it correctly", say mathematicians.

rogeryu 11y ago

All real personal stuff is done on my smartphone. I use 4G only at work, no work wifi. I do not open personal mail at the work computer. No Facebook, except sometimes on the phone. The only thing I do is reading and posting here and at several other websites. I have no idea if my employer knows about this, but I haven't had any remarks about it and I do this for years now. Reading articles on this website and elsewhere (like Slashdot) is a distraction I need on a regular basis. And we don't have a policy like this, so I guess this doesn't apply to me.

pc86 11y ago
Honestly a 4G-only, no-guest-wifi policy is the safest from a privacy perspective. The downside being that it's possible someone sees you three times in one day and you happen to be on your phone two or three of those times.

stensonb 11y ago

"Not if you do it correctly", say mathematicians.

josh_carterPDX 11y ago

At this point, if you don't understand that company equipment is to be used for company business only, then you're clearly not using your best judgement. Whether or not there's a policy, it should be implied that the equipment a company gives you belongs to them. You wouldn't take a company vehicle to a party or to the bar? Ok, maybe you would, but SMH. The point is that company equipment should be used to that purpose. If you use it for any other purpose you should expect that it's going to be scrutinized. If you don't want someone reading your emails or messages on a company computer, then use something else like a tablet or your phone to conduct personal business. I find the amount of conversation here about this so confusing.

hamburglar 11y ago
Exactly. My tendency is to try to keep my personal use of company computers to a reasonable level and conservative scope, because while I know my company is going to be reasonable about it and most likely leave me alone, I fully recognize that it's their computer and me using it for personal things exposes those things to their scrutiny if they have reason, or even if they suspect they have reason. Frankly, I'd be a little surprised if none of my employers have ever perused my browsing habits while investigating something (example: I once had an officemate get fired for sucking up all the office bandwidth by running a public porn server from his desktop -- that was a super dumb move, and I really wouldn't hold it against anyone investigating the problem to take a general survey of our web traffic habits in the course of chasing that down).
- josh_carterPDX 11y ago
  Definitely. This is especially important for companies that are public or are planning to go public. Knuckleheads exist everywhere and they can be a liability if not kept in check.

mizchief2 11y ago

Encryption.

kinghajj 11y ago
Yep. Very first thing I do when setting up a work machine is enable full-disk encryption, both to protect company assets from theft, and protect any sensitive material from prying coworkers/management.
- teddyh 11y ago
  Same here. It amazes me that this is not more common.
  - p4wnc6 11y ago
    I wonder if doing this, just the action of choosing to encrypt, would be held up as sufficient grounds for the company to investigate your activity, or even possibly regarded immediately as criminal or potentially criminal. I can see a lot of companies coming up with extremely irrational policies that say that any attempt to encrypt anything is inherently not allowed.
    - teddyh 11y ago
      What? I don’t just encrypt my desktop, I encrypt all the servers too, for the same reason.

ChrisRazzzz 11y ago

Question is Slack falls under this..., if people use Slack at the office on multiple channels than you could consider it a private message on a work computer.

Evolved 11y ago

Hasn't the safe advice been that whatever you do on company resources (except time) can be monitored/investigated by the company? Isn't it generally bad practice to handle personal business on a work phone/work laptop/work desktop anyway due to the assumption that your activities can be legally monitored by your company? Understandably, if you make a send a message/make a personal phone call on company time to your doctor or spouse regarding some issue then that shouldn't be grounds for the company to investigate just because you were on their time and my reasoning for this is that even when you're off the clock, you can still be disciplined for activities that may portray the company in a bad light (getting into a bar fight after work, for example) so its assumed that you're never really off work. Either way, if I were him I wouldn't have assumed I could have used company hardware to send personal messages yet still have an expectation of privacy.

djhworld 11y ago

The key in this case was the guy was using a Yahoo account that was designated for work purposes to message his brother. What the ruling DOESN'T mean is employers cannot say, demand access to your personal gmail account. However they can reprimand you for visiting gmail.com or whatever for periods of time more than what they deem acceptable.

iamleppert 11y ago

If there is that much distrust in your employee or employees, you should just fire them.

p4wnc6 11y ago

I know everyone is going to shoot this idea down with a million reasons why, but even so: why are these laws never symmetric? Why can't employees also access things possessed and used by the employer, like, say, HR personnel files, or executive emails, so that employees can verify the company is not committing fraud, engaging in discriminatory practices, etc.? There's such an emphasis on what the company has a right to do to protect itself that we almost don't even think about how company actions, which could be damaging to and unapproved by the employee, go on unchecked all the time. I assume the answer is just "might makes right" and the employer is the one with capital available for legal and political manipulation. But what's so surprising to me is that we rarely even talk about it even in an era with so much overt and publicly hated corporate corruption.

dahart 11y ago
This is actually an interesting question, IMO. But, I think you can quickly see the situation is not inherently symmetric, so the answer can't be either. Just one example - giving employees open access to company materials affects the privacy rights of other people, not just the company. So in order to protect the privacy rights you do have vs the company, they will have to restrict other people's access to your information. The title of this article is misleading in the sense that the decision was that companies may inspect employees' PMs that originate from company computers. They did not make a blanket decision that the company may monitor personal phones or personal computers. That highlights how the situation is not symmetric in the sense that you haven't loaned your computers to the company in order to produce their personnel files.
- p4wnc6 11y ago
  I agree with you that it wouldn't be perfectly symmetric and a number of difficult follow-on issues would arise. But, I see a lot of emphasis being placed on the fact that it was a company-owned machine and that it was ostensibly being used for company purposes. These two facts seem to underpin a lot of what everyone says. But ownership and mode of use are not the only kinds of resources or properties to think of. For example, at least in the US we have the concept of "company time" which covers the time periods during which you are performing an action sanctioned by a company. Could this be used to demand the ability to monitor employees during time periods when they are on company time? Likewise, there are a lot of gray areas going in the reverse direction -- from employee to employer. For example, it is true that HR records (say, for example, performance reviews written by my boss about solely me) are electronic files that are the property of the company, just like a computer workstation is property of the company. But, just as a computer workstation could be misused for personal use, and thus needs to be inspectable for compliance, so also the HR files could be misused for personal use (making jokes, talking about non-professional aspects of me, conspiring to deny a promotion simply due to personal preference, etc.) -- so why aren't such files open for inspection? Yet another interesting aspect of all of this is why we believe that not only must the workstation be made available for inspection, but further that it is the employer who gets to perform the inspection. Why isn't such inspection required to be handled by a third-party arbiter, much the way that tax and official records are required to be kept by a certified firm specializing in it. We don't trust companies to say, "Yep, these are my taxes and records, I swear I didn't lie or hide any money." We at least require some third-party to attest to that and stake a reputation on it (subverted though it may be). Yet with issues of inspection, we just sort of capitulate to this idea that the employer not only gets to raise the issue of suspicion about misuse, but also gets to be the authority on the investigation of whether or not misuse occurred, and to what extent employee privacy must be invaded to get all the relevant info.

ivanhoe 11y ago

Maybe it's legal, but after learning all this would you still apply for a job there?

antihero 11y ago
If finding work is tough and you needed to pay rent and eat, like in the real world, then all this "you agree to their policy" stuff is frankly sinister. Basically unless you're lucky enough to be desirable enough to the diminishing amount of companies that don't treat their employees like cattle, you have to basically suck up having your privacy shat on.
- ivanhoe 11y ago
  absolutely, but we don't talk about unskilled workforce, this guy is an engineer. And even if work is hard to find and you have to take it, you probably will be actively looking for a better job very quickly. So ultimately company that is enforcing such strict and hostile rules is going to loose all the best people very quickly (because they will be first to get a better job)... and that's bad for business and at the same time I doubt that it improves performance significantly, so it's pretty stupid strategy IMHO...

Zenst 11y ago

If it is upon employer equipment and time, then it is reasonable for the employer to expect it to be work related. In this case the chap blurred those lines and even using a personal account for work related stuff is going to violate and respectable data policies a company may have and indeed many a work contract alone. The headline does make it sound a bit oft when you read the article and not the best choice when you read it is not as clear cut as the headline portrays. Still never mix business with pleasure being the moral on this one and not a mass panic my private emails can be demanded by HR.

philippeback 11y ago

I am my own boss, yeah

gerty 11y ago

The title is subtly misleading. This ruling applies not only in the EU countries but also in in member countries of Council of Europe. That is EU, EEA, Balkans, Russia, Turkey and a few more.

walshemj 11y ago

This is a dangerous precedent to set normaly invasive monitoring or workers is only used for investigating serious offenses.

deleted 11y ago

[deleted]

czl 11y ago

Can employer capture your passwords and use them to access your cloud accounts? Gmail? Facebook? Etc?

known 11y ago

ECHR should have considered https://en.wikipedia.org/wiki/Information_asymmetry https://en.wikipedia.org/wiki/Information_asymmetry