6 ms·

The trick here, as my understanding of the law goes, is that (a) the company had a policy that work computers are to be used for work only, AND (b) that the acc

The trick here, as my understanding of the law goes, is that (a) the company had a policy that work computers are to be used for work only, AND (b) that the account in question was being used for both personal and professional contacts. In general, your workplace can (assuming that you have agreed to this in policy) ensure that you're using your computer for approved uses, and it can access all work-related information on the computer. You do have (limited) privacy over anything personal on the computer, but they're welcome to discipline or fire you just for its existence, and in some cases they may access it if they have reasonable belief that they have to. This ruling clarifies that if your personal information is mixed in with professional information, the company may access it, as little as necessary (the word you'll come across lots is "proportionate"), as part of an internal investigation or similar. This has been spelled out by at least the British Government for a while now, nothing has changed. EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer?

x5n1 11y ago
Better not to work for such companies.
- Alupis 11y ago
  > Better not to work for such companies. Don't work for a company that monitors it's own IT equipment? Monitoring the equipment is to ensure it's working properly, as well as to guard against employees misusing company equipment by installing toolbars and apps that have no business purpose (which ultimately leads to mis-performing equipment, and lost productivity). I don't think I'd want to work for a company like that - the IT equipment would be in shambles, borderline unusable.
  - s73v3r 11y ago
    Why? Do you only work for companies that employ children?
    - Alupis 11y ago
      Having worked in corporate IT for a long while, I can assure you that users will click "OK" on any popup, and install any program they think they need/want. This includes music player apps, torrent programs, toolbars, etc. None of which is allowed on a company computer (by most policies). It's not your property, don't abuse it. It's really, really simple.
      - tremon 11y ago
        It's not your property, don't abuse it. It's really, really simple. No, it is not. Where is the line between use and abuse? If I install Notepad++ because it allows me to work faster, am I using or abusing the computer? What if I install Firefox because some suppliers' site doesn't work in the company-provided IE8 anymore? What if I install Dell's ActiveX control to download their drivers? What if I disable the company-installed Flash Player because I feel safer without it? What if I install NoScript or Flashblock using a company-provided Firefox install? What if I look up my GP's phone number using a work computer because I need a consult for my back issues? Should I take sick leave just so I can call my GP? I've worked in IT support, and the general rule among those companies was this: if employees have local administrator rights, they are expected to manage their system themselves. So all of the above would fall under "use" where I've worked. If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place?
        Alupis 11y ago
        > If I install Notepad++ because it allows me to work faster, am I using or abusing the computer? This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really. > if employees have local administrator rights, they are expected to manage their system themselves This sort of thing really only occurs at small businesses with little-to-no internal IT support, or with very special cases (such as a developer, which would have special approvals by the company to do so). > If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place Well, they shouldn't, and they don't at most companies. In the end, you signed a usage agreement. If you deliberately break that agreement, don't be surprised by the consequences.
  - Dylan16807 11y ago
    What a ridiculous strawman. I should not need to explain that you can monitor installed applications without reading the contents of someone's gmail tab.
    - Alupis 11y ago
      > you can monitor installed applications without reading the contents of someone's gmail tab You should not be using gmail while being paid to do work on someone's equipment. A parallel would be if your company used GMail for business purposes. You log into your personal Gmail account instead, and stay logged in. The company needs to gain access to an email from a customer, so they open Gmail on your computer - but discover you are logged into your personal account and can clearly see you have spent your afternoon sending personal emails... not working. Another parallel would be if you were hired to drive a bus route, but decided to use the company owned bus to go shopping instead. You are misusing company equipment, and if they discover that via a typical investigation (such as checking your bus' GPS location), then they have done nothing wrong. I don't see how any reasonable person could argue that this man's case was a clear violation of his privacy. This is a typical case of a person misusing equipment/breaking the rules, then getting upset that he was caught.
      - lvs 11y ago
        >This is a typical case of a person misusing equipment/breaking the rules... ... in a completely benign way that you might expect of a real human being, not a slave or serf.
        Alupis 11y ago
        > in a completely benign way that you might expect of a real human being, not a slave or serf. No reasonable person can advocate in good faith that employees should actively ignore workplace policies and rules, because they're "real human beings"... and further, that there should be no consequences for these deliberate actions.
        11y ago
- tptacek 11y ago
  Good luck finding one. The clauses that enable this kind of monitoring are boilerplate employee contract and company manual stuff.
  - x5n1 11y ago
    Maybe big corporations, there are tons of small companies, which constitutes half the economy that don't do this.
    - tptacek 11y ago
      The issue isn't whether they do it routinely, but whether they're entitled to do it. Most small companies hire people using boilerplate employment contracts and employee handbooks, too. My point is that they don't have to intend to make monitoring possible for it to be possible; it's practically the default. Also: pay close attention to what 'Spook23 is saying downthread about discovery. Your employer doesn't even have to want to monitor your stuff; all that needs to happen is they get sued, and if you've been mixing business and personal comms, it can all end up in scope.
  - arethuza 11y ago
    Might be boilerplate in the US but it'll vary from country to country in the EU. Certainly Germany had very tight rules on this kind of stuff. Also at a previous employer (multinational, 30+ countries) the CIO took an explicit decision not to employee any kind of technology that could "spy" within SSL traffic to avoid potential liabilities around company IT staff having visibility of personal banking details etc. Also, just because something is in an employment contract or handbook doesn't mean it's enforceable.
    - weinzierl 11y ago
      I have researched the situation for Germany and the usual recommendation for the employer is to put something like the following in the contract: 1. Private use is forbidden. 2. Employer can't be held responsible for storing or processing private data if employee didn't follow 1. Not exactly but quite similar to the ruling described in the original post.
DanBC 11y ago
I think this is the judgement: http://www.clujust.ro/wp-content/uploads/2016/01/CASE-OF-BARBULESCU-v.-ROMANIA.pdf http://www.clujust.ro/wp-content/uploads/2016/01/CASE-OF-BAR... > EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer? That's weird. This particular court case is him vs Romania, not him vs his employer. The earlier cases, in Romania, would have been him vs the employer. There are many reports of this case, and most of them do the same thing: http://www.bloomberg.com/news/articles/2016-01-12/companies-can-snoop-on-you-during-working-hours-court-decides http://www.bloomberg.com/news/articles/2016-01-12/companies-... https://www.rt.com/news/328755-echr-employee-messages-snooping/ https://www.rt.com/news/328755-echr-employee-messages-snoopi... http://sputniknews.com/europe/20160113/1033075519/eu-court-private-messages-employer-snooping.html http://sputniknews.com/europe/20160113/1033075519/eu-court-p... > The case dates back to 2007 when Bărbulescu was informed by his employer that his Yahoo Messenger communications had been monitored from 5 to 13 July 2007 and that the records showed he had used the Internet for personal purposes. > Barbulescu replied in writing that he had only used the service for professional purposes. He was presented with a transcript of his communication including transcripts of messages he had exchanged with his brother and his fiancee relating to personal matters such as his health and sex life. http://www.express.co.uk/life-style/science-technology/634269/WhatsApp-Facebook-Employer-Romania-European-Court-of-Human-Rights http://www.express.co.uk/life-style/science-technology/63426...
- pflats 11y ago
  >That's weird. This particular court case is him vs Romania, not him vs his employer. The earlier cases, in Romania, would have been him vs the employer. The suit is in the European Court of Human Rights. He was claiming that Romania violated his right to confidential correspondence by having civil law that allowed his company to read private messages. He lost, therefore Romania's laws are fine, and thus the employer is still in the right.
- sarciszewski 11y ago
  > EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer? Eh, yeah, that is weird, now that you mention it. It's like they were interested in protecting the reputation of the company, but they wanted to throw the ex-employee to the wolves.
jasonkostempski 11y ago
Do they even need a policy? If someone is on my computer and my network I assume I have the right to access any of the stuff on it.
- msh 11y ago
  The law might require it. I don't know UK law but in several eu countries a employer can't monitor their own computers unless they have in writing informed the employees about it.
- hluska 11y ago
  You're likely right, but if I was hiring someone, I'd make sure to have a strong rule (ie - work devices/networks are for work purposes only) and a strong disclosure (ie - we reserve the right to monitor, read or otherwise use any and all information on work devices or networks). Of course, I'm Canadian and our privacy law is fairly strict. Violations are also a tort, even without proof of damage, so my case may be unique. But regardless, firm, written guidelines applied equally across the organization are always a good defense.
- DanBC 11y ago
  The EU has said several times that any monitoring has to be proportionate and limited, and that you need to tell employees i) that you are monitoring, and ii) what you're monitoring. Note that in this case he lost because his employer had the policy clearly in place. He might have won if they didn't have that.
  - Dylan16807 11y ago
    The 'limited' aspect seems rather toothless if a clear policy of "we monitor everything" is valid.
    - Xylakant 11y ago
      The limited aspect is important so that the employee knows what's monitored. Employees are not forced to store private data on work devices or engage in private conversations. All my employees are regularly reminded that work equipment is work equipment and that we have access to it and will in certain cases use that access. I'll try not to go through their private stuff, but if there's something I urgently need from their device (or account) and they're not able to provide it (1) I'll have to. If you send private conversation via a company account you know what you sign up for. (1) for any reason, ranging from extended holidays away from the internet to "this person is no longer among us".

x5n1 11y ago

Better not to work for such companies.

Alupis 11y ago
> Better not to work for such companies. Don't work for a company that monitors it's own IT equipment? Monitoring the equipment is to ensure it's working properly, as well as to guard against employees misusing company equipment by installing toolbars and apps that have no business purpose (which ultimately leads to mis-performing equipment, and lost productivity). I don't think I'd want to work for a company like that - the IT equipment would be in shambles, borderline unusable.
- s73v3r 11y ago
  Why? Do you only work for companies that employ children?
  - Alupis 11y ago
    Having worked in corporate IT for a long while, I can assure you that users will click "OK" on any popup, and install any program they think they need/want. This includes music player apps, torrent programs, toolbars, etc. None of which is allowed on a company computer (by most policies). It's not your property, don't abuse it. It's really, really simple.
    - tremon 11y ago
      It's not your property, don't abuse it. It's really, really simple. No, it is not. Where is the line between use and abuse? If I install Notepad++ because it allows me to work faster, am I using or abusing the computer? What if I install Firefox because some suppliers' site doesn't work in the company-provided IE8 anymore? What if I install Dell's ActiveX control to download their drivers? What if I disable the company-installed Flash Player because I feel safer without it? What if I install NoScript or Flashblock using a company-provided Firefox install? What if I look up my GP's phone number using a work computer because I need a consult for my back issues? Should I take sick leave just so I can call my GP? I've worked in IT support, and the general rule among those companies was this: if employees have local administrator rights, they are expected to manage their system themselves. So all of the above would fall under "use" where I've worked. If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place?
      - Alupis 11y ago
        > If I install Notepad++ because it allows me to work faster, am I using or abusing the computer? This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really. > if employees have local administrator rights, they are expected to manage their system themselves This sort of thing really only occurs at small businesses with little-to-no internal IT support, or with very special cases (such as a developer, which would have special approvals by the company to do so). > If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place Well, they shouldn't, and they don't at most companies. In the end, you signed a usage agreement. If you deliberately break that agreement, don't be surprised by the consequences.
- Dylan16807 11y ago
  What a ridiculous strawman. I should not need to explain that you can monitor installed applications without reading the contents of someone's gmail tab.
  - Alupis 11y ago
    > you can monitor installed applications without reading the contents of someone's gmail tab You should not be using gmail while being paid to do work on someone's equipment. A parallel would be if your company used GMail for business purposes. You log into your personal Gmail account instead, and stay logged in. The company needs to gain access to an email from a customer, so they open Gmail on your computer - but discover you are logged into your personal account and can clearly see you have spent your afternoon sending personal emails... not working. Another parallel would be if you were hired to drive a bus route, but decided to use the company owned bus to go shopping instead. You are misusing company equipment, and if they discover that via a typical investigation (such as checking your bus' GPS location), then they have done nothing wrong. I don't see how any reasonable person could argue that this man's case was a clear violation of his privacy. This is a typical case of a person misusing equipment/breaking the rules, then getting upset that he was caught.
    - lvs 11y ago
      >This is a typical case of a person misusing equipment/breaking the rules... ... in a completely benign way that you might expect of a real human being, not a slave or serf.
      - Alupis 11y ago
        > in a completely benign way that you might expect of a real human being, not a slave or serf. No reasonable person can advocate in good faith that employees should actively ignore workplace policies and rules, because they're "real human beings"... and further, that there should be no consequences for these deliberate actions.
        11y ago
tptacek 11y ago
Good luck finding one. The clauses that enable this kind of monitoring are boilerplate employee contract and company manual stuff.
- x5n1 11y ago
  Maybe big corporations, there are tons of small companies, which constitutes half the economy that don't do this.
  - tptacek 11y ago
    The issue isn't whether they do it routinely, but whether they're entitled to do it. Most small companies hire people using boilerplate employment contracts and employee handbooks, too. My point is that they don't have to intend to make monitoring possible for it to be possible; it's practically the default. Also: pay close attention to what 'Spook23 is saying downthread about discovery. Your employer doesn't even have to want to monitor your stuff; all that needs to happen is they get sued, and if you've been mixing business and personal comms, it can all end up in scope.
- arethuza 11y ago
  Might be boilerplate in the US but it'll vary from country to country in the EU. Certainly Germany had very tight rules on this kind of stuff. Also at a previous employer (multinational, 30+ countries) the CIO took an explicit decision not to employee any kind of technology that could "spy" within SSL traffic to avoid potential liabilities around company IT staff having visibility of personal banking details etc. Also, just because something is in an employment contract or handbook doesn't mean it's enforceable.
  - weinzierl 11y ago
    I have researched the situation for Germany and the usual recommendation for the employer is to put something like the following in the contract: 1. Private use is forbidden. 2. Employer can't be held responsible for storing or processing private data if employee didn't follow 1. Not exactly but quite similar to the ruling described in the original post.

DanBC 11y ago

I think this is the judgement: http://www.clujust.ro/wp-content/uploads/2016/01/CASE-OF-BARBULESCU-v.-ROMANIA.pdf http://www.clujust.ro/wp-content/uploads/2016/01/CASE-OF-BAR... > EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer? That's weird. This particular court case is him vs Romania, not him vs his employer. The earlier cases, in Romania, would have been him vs the employer. There are many reports of this case, and most of them do the same thing: http://www.bloomberg.com/news/articles/2016-01-12/companies-can-snoop-on-you-during-working-hours-court-decides http://www.bloomberg.com/news/articles/2016-01-12/companies-... https://www.rt.com/news/328755-echr-employee-messages-snooping/ https://www.rt.com/news/328755-echr-employee-messages-snoopi... http://sputniknews.com/europe/20160113/1033075519/eu-court-private-messages-employer-snooping.html http://sputniknews.com/europe/20160113/1033075519/eu-court-p... > The case dates back to 2007 when Bărbulescu was informed by his employer that his Yahoo Messenger communications had been monitored from 5 to 13 July 2007 and that the records showed he had used the Internet for personal purposes. > Barbulescu replied in writing that he had only used the service for professional purposes. He was presented with a transcript of his communication including transcripts of messages he had exchanged with his brother and his fiancee relating to personal matters such as his health and sex life. http://www.express.co.uk/life-style/science-technology/634269/WhatsApp-Facebook-Employer-Romania-European-Court-of-Human-Rights http://www.express.co.uk/life-style/science-technology/63426...

pflats 11y ago
>That's weird. This particular court case is him vs Romania, not him vs his employer. The earlier cases, in Romania, would have been him vs the employer. The suit is in the European Court of Human Rights. He was claiming that Romania violated his right to confidential correspondence by having civil law that allowed his company to read private messages. He lost, therefore Romania's laws are fine, and thus the employer is still in the right.
sarciszewski 11y ago
> EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer? Eh, yeah, that is weird, now that you mention it. It's like they were interested in protecting the reputation of the company, but they wanted to throw the ex-employee to the wolves.

jasonkostempski 11y ago

Do they even need a policy? If someone is on my computer and my network I assume I have the right to access any of the stuff on it.

msh 11y ago
The law might require it. I don't know UK law but in several eu countries a employer can't monitor their own computers unless they have in writing informed the employees about it.
hluska 11y ago
You're likely right, but if I was hiring someone, I'd make sure to have a strong rule (ie - work devices/networks are for work purposes only) and a strong disclosure (ie - we reserve the right to monitor, read or otherwise use any and all information on work devices or networks). Of course, I'm Canadian and our privacy law is fairly strict. Violations are also a tort, even without proof of damage, so my case may be unique. But regardless, firm, written guidelines applied equally across the organization are always a good defense.
DanBC 11y ago
The EU has said several times that any monitoring has to be proportionate and limited, and that you need to tell employees i) that you are monitoring, and ii) what you're monitoring. Note that in this case he lost because his employer had the policy clearly in place. He might have won if they didn't have that.
- Dylan16807 11y ago
  The 'limited' aspect seems rather toothless if a clear policy of "we monitor everything" is valid.
  - Xylakant 11y ago
    The limited aspect is important so that the employee knows what's monitored. Employees are not forced to store private data on work devices or engage in private conversations. All my employees are regularly reminded that work equipment is work equipment and that we have access to it and will in certain cases use that access. I'll try not to go through their private stuff, but if there's something I urgently need from their device (or account) and they're not able to provide it (1) I'll have to. If you send private conversation via a company account you know what you sign up for. (1) for any reason, ranging from extended holidays away from the internet to "this person is no longer among us".