5 ms·

Do they even need a policy? If someone is on my computer and my network I assume I have the right to access any of the stuff on it.

msh 11y ago
The law might require it. I don't know UK law but in several eu countries a employer can't monitor their own computers unless they have in writing informed the employees about it.
hluska 11y ago
You're likely right, but if I was hiring someone, I'd make sure to have a strong rule (ie - work devices/networks are for work purposes only) and a strong disclosure (ie - we reserve the right to monitor, read or otherwise use any and all information on work devices or networks). Of course, I'm Canadian and our privacy law is fairly strict. Violations are also a tort, even without proof of damage, so my case may be unique. But regardless, firm, written guidelines applied equally across the organization are always a good defense.
DanBC 11y ago
The EU has said several times that any monitoring has to be proportionate and limited, and that you need to tell employees i) that you are monitoring, and ii) what you're monitoring. Note that in this case he lost because his employer had the policy clearly in place. He might have won if they didn't have that.
- Dylan16807 11y ago
  The 'limited' aspect seems rather toothless if a clear policy of "we monitor everything" is valid.
  - Xylakant 11y ago
    The limited aspect is important so that the employee knows what's monitored. Employees are not forced to store private data on work devices or engage in private conversations. All my employees are regularly reminded that work equipment is work equipment and that we have access to it and will in certain cases use that access. I'll try not to go through their private stuff, but if there's something I urgently need from their device (or account) and they're not able to provide it (1) I'll have to. If you send private conversation via a company account you know what you sign up for. (1) for any reason, ranging from extended holidays away from the internet to "this person is no longer among us".
  - DanBC 11y ago
    But "we monitor everything" is not valid. "We will monitor our work accounts on our equipment" is valid, and "we found some personal messages on this work account" becomes valid because it's not everything (which would violate his privacy) but because it's only the work account.
- walshemj 11y ago
  This doesn't sound proportionate though does it.
  - DanBC 11y ago
    "We checked the work account on your work computer"? That sounds pretty proportionate.
    - walshemj 11y ago
      The offence ie chatting to a some one - that's a verbal warning offence not gross misconduct aka instant dismissal.
voxic11 11y ago
Do you apply this to everything? If someone is using your bathroom do you believe you have a ethical and legal right to surreptitiously observe everything they do in there?
- Evolved 11y ago
  I believe what they meant was if someone were using your laptop on your network then you have the right to know what they're doing. Granted, if you're doing banking then I wouldn't expect that I'd have a right to know your bank account info but I'd expect to at least know if you're using my computer and my network to buy illegal drugs or something like that. This seems reasonable as far as "limited" means. I'd like to know what they found that made them terminate his employment though.
- Double_Cast 11y ago
  In the computer case, the reason surveillance is a good idea is so the owner can prevent misuse. Misuse is likely, as any computer with an internet browser may temp a user with a wide variety of possibilities for misuse. In the restroom case, an owner often can safely assume that the user's activities will be restricted to a quite limited range of behaviors. However, if I had reason to believe that the user might be performing some illicit activity in the restroom (e.g. arson), I might feel surveillance is warranted. The difference comes down to the disparate levels of suspicion.
  - lostlogin 11y ago
    The employer presumably didn't think he was using their computer for arson. Would you be more comfortable letting a stranger into to your premises to use your bathroom or letting them use your internet connection?
    - fixermark 11y ago
      The bathroom. I haven't put NEARLY enough effort into securing the accessible services on my LAN against unauthorized access. There's a practical upper limit on how much undetected damage someone could do in my bathroom (without a crowbar or a wrench) that is significantly exceeded by how much undetected damage they could do on my network.
s73v3r 11y ago
That's an extremely poor assumption. Any home user's computers would be on their ISP's network. Should they have the right to access any of the stuff on it?
- venomsnake 11y ago
  No because I am on their network.
rbehrends 11y ago
The person is your employee; you entered into a contract with that employee and the computer and your network is not just your property anymore, but tools provided to the employee to be used by said employee according to the contract. At this point, contract law, labor law, etc. can constrain what you can do pertaining to your employee's use of the computer and the network, especially when the constraints exist to safeguard fundamental rights.

msh 11y ago

The law might require it. I don't know UK law but in several eu countries a employer can't monitor their own computers unless they have in writing informed the employees about it.

hluska 11y ago

You're likely right, but if I was hiring someone, I'd make sure to have a strong rule (ie - work devices/networks are for work purposes only) and a strong disclosure (ie - we reserve the right to monitor, read or otherwise use any and all information on work devices or networks). Of course, I'm Canadian and our privacy law is fairly strict. Violations are also a tort, even without proof of damage, so my case may be unique. But regardless, firm, written guidelines applied equally across the organization are always a good defense.

DanBC 11y ago

The EU has said several times that any monitoring has to be proportionate and limited, and that you need to tell employees i) that you are monitoring, and ii) what you're monitoring. Note that in this case he lost because his employer had the policy clearly in place. He might have won if they didn't have that.

Dylan16807 11y ago
The 'limited' aspect seems rather toothless if a clear policy of "we monitor everything" is valid.
- Xylakant 11y ago
  The limited aspect is important so that the employee knows what's monitored. Employees are not forced to store private data on work devices or engage in private conversations. All my employees are regularly reminded that work equipment is work equipment and that we have access to it and will in certain cases use that access. I'll try not to go through their private stuff, but if there's something I urgently need from their device (or account) and they're not able to provide it (1) I'll have to. If you send private conversation via a company account you know what you sign up for. (1) for any reason, ranging from extended holidays away from the internet to "this person is no longer among us".
- DanBC 11y ago
  But "we monitor everything" is not valid. "We will monitor our work accounts on our equipment" is valid, and "we found some personal messages on this work account" becomes valid because it's not everything (which would violate his privacy) but because it's only the work account.
walshemj 11y ago
This doesn't sound proportionate though does it.
- DanBC 11y ago
  "We checked the work account on your work computer"? That sounds pretty proportionate.
  - walshemj 11y ago
    The offence ie chatting to a some one - that's a verbal warning offence not gross misconduct aka instant dismissal.

voxic11 11y ago

Do you apply this to everything? If someone is using your bathroom do you believe you have a ethical and legal right to surreptitiously observe everything they do in there?

Evolved 11y ago
I believe what they meant was if someone were using your laptop on your network then you have the right to know what they're doing. Granted, if you're doing banking then I wouldn't expect that I'd have a right to know your bank account info but I'd expect to at least know if you're using my computer and my network to buy illegal drugs or something like that. This seems reasonable as far as "limited" means. I'd like to know what they found that made them terminate his employment though.
Double_Cast 11y ago
In the computer case, the reason surveillance is a good idea is so the owner can prevent misuse. Misuse is likely, as any computer with an internet browser may temp a user with a wide variety of possibilities for misuse. In the restroom case, an owner often can safely assume that the user's activities will be restricted to a quite limited range of behaviors. However, if I had reason to believe that the user might be performing some illicit activity in the restroom (e.g. arson), I might feel surveillance is warranted. The difference comes down to the disparate levels of suspicion.
- lostlogin 11y ago
  The employer presumably didn't think he was using their computer for arson. Would you be more comfortable letting a stranger into to your premises to use your bathroom or letting them use your internet connection?
  - fixermark 11y ago
    The bathroom. I haven't put NEARLY enough effort into securing the accessible services on my LAN against unauthorized access. There's a practical upper limit on how much undetected damage someone could do in my bathroom (without a crowbar or a wrench) that is significantly exceeded by how much undetected damage they could do on my network.

s73v3r 11y ago

That's an extremely poor assumption. Any home user's computers would be on their ISP's network. Should they have the right to access any of the stuff on it?

venomsnake 11y ago
No because I am on their network.

rbehrends 11y ago

The person is your employee; you entered into a contract with that employee and the computer and your network is not just your property anymore, but tools provided to the employee to be used by said employee according to the contract. At this point, contract law, labor law, etc. can constrain what you can do pertaining to your employee's use of the computer and the network, especially when the constraints exist to safeguard fundamental rights.