7 ms·

It will as useful as EU's cookie law. Every employee on joining any company will be notified that corporate emails are monitored, similar to 'CCTV in operation'

It will as useful as EU's cookie law. Every employee on joining any company will be notified that corporate emails are monitored, similar to 'CCTV in operation' signs. It will be another checkbox on the contract.

golergka 9y ago
> It will be another checkbox on the contract. In my experience, employee contracts are negotiable in practice. I negotiated limiting or removing 'non-compete' clauses several times in different companies. If email checks were important for me (they're not) I would negotiate this term as well.
- ghughes 9y ago
  I doubt you’d get very far trying to negotiate this with any employer that has a legal department.
  - cannonedhamster 9y ago
    I've gotten non-disparagement clauses removed from a company with a legal team. If you're going to work for a company and they aren't willing to negotiate when things are the best between you two, you're likely not going to enjoy working there.
  - _delirium 9y ago
    In some European countries the union does this kind of negotiating in a sector/framework agreement, which can make pushing back against those kinds of blanket terms more effective, at least to the extent of reducing how broad the rights waivers are.
  - fulafel 9y ago
    There's a range of company sizes and attitudes to lawyering between the extremes of "we don't have a lawyer" and "corporate lawyers run the place".
  - golergka 9y ago
    And yet, I did.
- kelnos 9y ago
  Having enough clout to negotiate that stuff away isn't universal. I suspect you could also have walked away from a job with terms you didn't like. Many people can't do that without risking financial ruin.
seszett 9y ago
> Although it does not generally prohibit such monitoring, it sets high thresholds for its justification The article doesn't give details as to which thresholds the ruling sets, though. I guess they might be an improvement over Romanian law for example, but below French law (and probably other EU countries as well) where what is sent or received on nominative work email addresses is private communication and can not be monitored.
- PeachPlum 9y ago
  It was on Yahoo Messenger.
cristiantincu 9y ago
Hm, no. Long story short: In order for a company to be allowed to monitor, they would need to pass some kind of audit, they would need to prove that they don’t store, for example, sensitive personal data, etc.
- PeachPlum 9y ago
  Why should an employee have the right to store sensitive personal data on my computer. Are you suggesting a framework where I could be prosecuted for running "cat /var/log/mail" on my own computer?
  - cristiantincu 9y ago
    I was referring to the company (the employer), not the employee. From the article: ”The company had presented him with printouts of his private messages to his brother and fiancée on Yahoo Messenger as evidence of his breach of a company ban on such personal use.“
  - kartan 9y ago
    > Why should an employee have the right to store sensitive personal data on my computer. Because your employees are human beings and not machines. They have a life, they have needs, etc. > Are you suggesting a framework where I could be prosecuted for running "cat /var/log/mail" on my own computer? Yes. That's exactly it. The court ruled that employees have an expectation of privacy, even that can be limited by the company when there are reasons to do so. When you give an employee a computer, it is the company property but it's the employee's computer. People have rights, even while working for an employer. They are employees, they are not slaves.
    - abiox 9y ago
      > Because your employees are human beings and not machines. They have a life, they have needs, etc. ...they also have access to gmail and a thousand other services, no? > People have rights, even while working for an employer. They are employees, they are not slaves. being asked to use gmail (etc) instead of company systems for your personal stuff doesn't 'make you a slave'.
marsRoverDev 9y ago
"Under the General Data Protection Regulation (GDPR), the requirements for valid consent have been made much stricter. Consent must be freely-given, specific, informed and revocable. The GDPR expressly states that, where there is an imbalance of power between the party giving consent and the party receiving it, consent will not be valid. In the employment context, it has long been acknowledged that there is such an imbalance between employer and employee. This means that it will be very difficult indeed for employers to rely on consent to process employees’ personal data under the GDPR." So no, this is not legal from 2018.
- secfirstmd 9y ago
  Not really. It all depends under what reason you have decided you are collecting the data in the first place in your Data Protection Impact Assessment (e.g your lawful basis). Consent is only one of them. Consent is problematic because it can be withdrawn.
- TazeTSchnitzel 9y ago
  Mind you that the GDPR is EU law, whereas the judgement here is an ECHR ruling, and these are separate institutions. All EU countries are in the ECHR, but not vice-versa.
  - magamind 9y ago
    GDPR applies globally to any company - there are no safe havens. If you keep data on an EU citizen then you must comply.
    - closeparen 9y ago
      This probably means the end of Europeans commenting on web forums, then. Can't imagine Hacker News, open source mailing lists, or any random guy with a phpBB/VBulletin interest group forum is going to appoint a compliance officer and fork over millions of dollars for consulting and legal services to become compliant.
dalbasal 9y ago
I completely agree. I'm not sure if these still exist but Iran (reportedly) had "halal" brothels at one point. They would marry the "couple," do the deed, then divorce. The cookie law was like that. Legislators started with a real world goal, protecting users privacy from certain violations. They looked through their legal lens to determine the specific rights bein violated. But, the fix never left the legal realm. The lawyers got to work making sure that users rights are not violated, but without actually giving them any more privacy. Somehow, this absurd interpretation of "informed consent" held water. Six or seven years ago, South Park made fun of Apple's 47 page terms, updated meticulously. Today, we probably "sign" a thousand pages of pseudo-contracts per week. The cookie law normalized it. Regulators of regulated industries demand more of it. This is so absurd! The legal profession (including legislators & regulators) just go on with their method of keeping society free of prostitution by making sure everyone gets married and divorced at the correct time.
- severine 9y ago
  "Halal brothels" are a hoax: https://www.aquila-style.com/focus-points/halal-prostitute-hoax/66855/ https://www.aquila-style.com/focus-points/halal-prostitute-h...
  - selimthegrim 9y ago
    Maybe but sigheh isn't - https://en.wikipedia.org/wiki/Prostitution_in_Iran#Nikah_mut.E2.80.98ah_or_Sigheh https://en.wikipedia.org/wiki/Prostitution_in_Iran#Nikah_mut...
    - severine 9y ago
      Interesting, thanks for the link.
wfo 9y ago
Yes that's correct, any right that you can waive essentially does not exist in a capitalist economic system -- if you can waive it, the poor will inevitably be forced to waive it. However it's encouraging when compared to the situation in the US. It's definitely better that people know than not know.
kartan 9y ago
No. It is not how law works: An employer “cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary,” the ECHR grand chamber judgment said.* "as necessary" is the important part. In fact, it is bad for a company to have a clause that says "we own all your email". Such a clause is invalid and it will be invalidated in court. A more reasonable and justified clause in the contract will hold in court. * https://www.theguardian.com/law/2017/sep/05/romanian-chat-messages-read-by-employer-had-privacy-breached-court-rules https://www.theguardian.com/law/2017/sep/05/romanian-chat-me...
- Shivetya 9y ago
  do they have to allow you access to the internet across the company's network? I can understand their not having access to my personal email but any mail using their address is not mine
crispyambulance 9y ago
Yeah, I find it impossible to believe that the person in question could have avoided being fired by NOT messaging his family using his employer's email/IM. They simply would have found another way to get rid him. Except in the most comically draconian workplaces does anyone _really_ care if an employee sends an email to his wife using a work email address (eg, "Forgot phone, do you want me to pick up pizza on the way home, honey?"). Aren't these rules just conveniences for HR departments so they can get rid of someone using the nearest available broken-rule that can be documented?
- Fifer82 9y ago
  Wow is that really what is being discussed? I don't use my work email for personal use, but what kind of company would fire me for "Alright love, you want a pizza when I am on my way back?". What is next? "Excuse me Sir, Excuse me Sir, Can I go to the toilet please?" Fuck working for a place like that. Leave your dignity at the door.
  - crispyambulance 9y ago
    > what kind of company would fire me for "Alright love, you want a pizza..." Virtually no company would do it just for that. Many companies use those kind of rules, however, to fire people that are already in their cross-hairs. If a server logs the message, and employee handbooks says, "personal email blah, blah, blah"... it is pretty cut-and-dried from an HR-drone point of view and much easier than firing someone for the things they _really_ did.
    - abandonliberty 9y ago
      >the things they _really_ did. Things they allegedly did. Easiest way to avoid paying severance is to have something clearly black and white, otherwise court fees can add up.
    - nisse72 9y ago
      The case in question was 10 years ago in Romania, which was only just becoming an EU member that year. I have no idea what sort of laws applied at that time in that country. But generally, employment in most european countries is not as tenuous as you suggest. You need valid reasons to get rid of someone, and usually you need to give the employee fair warning and a reasonable opportunity to improve or correct the issue that led to the warning. Nobody gets fired for sending a single email even if it's in violation of a clear company policy.
decentralised 9y ago
I disagree. Firstly, it will set a precedent for personal privacy over pure business interests and, secondly, CCTV can monitor physical locations where privacy is not to be expected but your private communications cannot be made public without your consent on a case by case basis. I'm quite convinced that you cannot sign away your legal rights on an employment contract and even if you were coerced to do so, the contract becomes illegal by definition. I'm not a lawyer though.
fulafel 9y ago
The evidence so far doesn't agree. In many EU countries the rules have been stricter than this for a long time, and this routine hasn't widely happened in the countries I know about.
cyphunk 9y ago
The cookie law didn't kill cookies but it did inform people about them. It's responsibility for bring the discussion about tracking and cookies into popular discourse was greater than zero. This law and the new checkbox may have a similar affect.
- kozhevnikov 9y ago
  Completely agree, despite the implementation of it being somewhat of a joke I believe it brought some needed awareness about the spread of user tracking or at least it existence to non-tech people.
  - walshemj 9y ago
    But at a huge cost
- ucaetano 9y ago
  > it did inform people about them Did it? I'm highly skeptical about that. Do you have any source showing that the general population is better informed about cookies after that law?
- kelnos 9y ago
  I don't see this as having been particularly effective, though. It just made a slew of websites add an annoying pop-up or info bar to their site that says "we use cookies", and the reason given is usually one of a few boilerplate, content-free reasons like "to improve your experience". It's just an annoyance to have to click through, and doesn't provide much in the way of useful information anyway.
- chris_7 9y ago
  Yes, it informed me about them to the extent that I've installed a uBlock list to specifically avoid being informed about them. I don't even live in the EU...

golergka 9y ago

> It will be another checkbox on the contract. In my experience, employee contracts are negotiable in practice. I negotiated limiting or removing 'non-compete' clauses several times in different companies. If email checks were important for me (they're not) I would negotiate this term as well.

ghughes 9y ago
I doubt you’d get very far trying to negotiate this with any employer that has a legal department.
- cannonedhamster 9y ago
  I've gotten non-disparagement clauses removed from a company with a legal team. If you're going to work for a company and they aren't willing to negotiate when things are the best between you two, you're likely not going to enjoy working there.
- _delirium 9y ago
  In some European countries the union does this kind of negotiating in a sector/framework agreement, which can make pushing back against those kinds of blanket terms more effective, at least to the extent of reducing how broad the rights waivers are.
- fulafel 9y ago
  There's a range of company sizes and attitudes to lawyering between the extremes of "we don't have a lawyer" and "corporate lawyers run the place".
- golergka 9y ago
  And yet, I did.
kelnos 9y ago
Having enough clout to negotiate that stuff away isn't universal. I suspect you could also have walked away from a job with terms you didn't like. Many people can't do that without risking financial ruin.

seszett 9y ago

> Although it does not generally prohibit such monitoring, it sets high thresholds for its justification The article doesn't give details as to which thresholds the ruling sets, though. I guess they might be an improvement over Romanian law for example, but below French law (and probably other EU countries as well) where what is sent or received on nominative work email addresses is private communication and can not be monitored.

PeachPlum 9y ago
It was on Yahoo Messenger.

cristiantincu 9y ago

Hm, no. Long story short: In order for a company to be allowed to monitor, they would need to pass some kind of audit, they would need to prove that they don’t store, for example, sensitive personal data, etc.

PeachPlum 9y ago
Why should an employee have the right to store sensitive personal data on my computer. Are you suggesting a framework where I could be prosecuted for running "cat /var/log/mail" on my own computer?
- cristiantincu 9y ago
  I was referring to the company (the employer), not the employee. From the article: ”The company had presented him with printouts of his private messages to his brother and fiancée on Yahoo Messenger as evidence of his breach of a company ban on such personal use.“
- kartan 9y ago
  > Why should an employee have the right to store sensitive personal data on my computer. Because your employees are human beings and not machines. They have a life, they have needs, etc. > Are you suggesting a framework where I could be prosecuted for running "cat /var/log/mail" on my own computer? Yes. That's exactly it. The court ruled that employees have an expectation of privacy, even that can be limited by the company when there are reasons to do so. When you give an employee a computer, it is the company property but it's the employee's computer. People have rights, even while working for an employer. They are employees, they are not slaves.
  - abiox 9y ago
    > Because your employees are human beings and not machines. They have a life, they have needs, etc. ...they also have access to gmail and a thousand other services, no? > People have rights, even while working for an employer. They are employees, they are not slaves. being asked to use gmail (etc) instead of company systems for your personal stuff doesn't 'make you a slave'.

marsRoverDev 9y ago

"Under the General Data Protection Regulation (GDPR), the requirements for valid consent have been made much stricter. Consent must be freely-given, specific, informed and revocable. The GDPR expressly states that, where there is an imbalance of power between the party giving consent and the party receiving it, consent will not be valid. In the employment context, it has long been acknowledged that there is such an imbalance between employer and employee. This means that it will be very difficult indeed for employers to rely on consent to process employees’ personal data under the GDPR." So no, this is not legal from 2018.

secfirstmd 9y ago
Not really. It all depends under what reason you have decided you are collecting the data in the first place in your Data Protection Impact Assessment (e.g your lawful basis). Consent is only one of them. Consent is problematic because it can be withdrawn.
TazeTSchnitzel 9y ago
Mind you that the GDPR is EU law, whereas the judgement here is an ECHR ruling, and these are separate institutions. All EU countries are in the ECHR, but not vice-versa.
- magamind 9y ago
  GDPR applies globally to any company - there are no safe havens. If you keep data on an EU citizen then you must comply.
  - closeparen 9y ago
    This probably means the end of Europeans commenting on web forums, then. Can't imagine Hacker News, open source mailing lists, or any random guy with a phpBB/VBulletin interest group forum is going to appoint a compliance officer and fork over millions of dollars for consulting and legal services to become compliant.

dalbasal 9y ago

I completely agree. I'm not sure if these still exist but Iran (reportedly) had "halal" brothels at one point. They would marry the "couple," do the deed, then divorce. The cookie law was like that. Legislators started with a real world goal, protecting users privacy from certain violations. They looked through their legal lens to determine the specific rights bein violated. But, the fix never left the legal realm. The lawyers got to work making sure that users rights are not violated, but without actually giving them any more privacy. Somehow, this absurd interpretation of "informed consent" held water. Six or seven years ago, South Park made fun of Apple's 47 page terms, updated meticulously. Today, we probably "sign" a thousand pages of pseudo-contracts per week. The cookie law normalized it. Regulators of regulated industries demand more of it. This is so absurd! The legal profession (including legislators & regulators) just go on with their method of keeping society free of prostitution by making sure everyone gets married and divorced at the correct time.

severine 9y ago
"Halal brothels" are a hoax: https://www.aquila-style.com/focus-points/halal-prostitute-hoax/66855/ https://www.aquila-style.com/focus-points/halal-prostitute-h...
- selimthegrim 9y ago
  Maybe but sigheh isn't - https://en.wikipedia.org/wiki/Prostitution_in_Iran#Nikah_mut.E2.80.98ah_or_Sigheh https://en.wikipedia.org/wiki/Prostitution_in_Iran#Nikah_mut...
  - severine 9y ago
    Interesting, thanks for the link.

wfo 9y ago

Yes that's correct, any right that you can waive essentially does not exist in a capitalist economic system -- if you can waive it, the poor will inevitably be forced to waive it. However it's encouraging when compared to the situation in the US. It's definitely better that people know than not know.

kartan 9y ago

No. It is not how law works: An employer “cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary,” the ECHR grand chamber judgment said.* "as necessary" is the important part. In fact, it is bad for a company to have a clause that says "we own all your email". Such a clause is invalid and it will be invalidated in court. A more reasonable and justified clause in the contract will hold in court. * https://www.theguardian.com/law/2017/sep/05/romanian-chat-messages-read-by-employer-had-privacy-breached-court-rules https://www.theguardian.com/law/2017/sep/05/romanian-chat-me...

Shivetya 9y ago
do they have to allow you access to the internet across the company's network? I can understand their not having access to my personal email but any mail using their address is not mine

crispyambulance 9y ago

Yeah, I find it impossible to believe that the person in question could have avoided being fired by NOT messaging his family using his employer's email/IM. They simply would have found another way to get rid him. Except in the most comically draconian workplaces does anyone _really_ care if an employee sends an email to his wife using a work email address (eg, "Forgot phone, do you want me to pick up pizza on the way home, honey?"). Aren't these rules just conveniences for HR departments so they can get rid of someone using the nearest available broken-rule that can be documented?

Fifer82 9y ago
Wow is that really what is being discussed? I don't use my work email for personal use, but what kind of company would fire me for "Alright love, you want a pizza when I am on my way back?". What is next? "Excuse me Sir, Excuse me Sir, Can I go to the toilet please?" Fuck working for a place like that. Leave your dignity at the door.
- crispyambulance 9y ago
  > what kind of company would fire me for "Alright love, you want a pizza..." Virtually no company would do it just for that. Many companies use those kind of rules, however, to fire people that are already in their cross-hairs. If a server logs the message, and employee handbooks says, "personal email blah, blah, blah"... it is pretty cut-and-dried from an HR-drone point of view and much easier than firing someone for the things they _really_ did.
  - abandonliberty 9y ago
    >the things they _really_ did. Things they allegedly did. Easiest way to avoid paying severance is to have something clearly black and white, otherwise court fees can add up.
  - nisse72 9y ago
    The case in question was 10 years ago in Romania, which was only just becoming an EU member that year. I have no idea what sort of laws applied at that time in that country. But generally, employment in most european countries is not as tenuous as you suggest. You need valid reasons to get rid of someone, and usually you need to give the employee fair warning and a reasonable opportunity to improve or correct the issue that led to the warning. Nobody gets fired for sending a single email even if it's in violation of a clear company policy.

decentralised 9y ago

I disagree. Firstly, it will set a precedent for personal privacy over pure business interests and, secondly, CCTV can monitor physical locations where privacy is not to be expected but your private communications cannot be made public without your consent on a case by case basis. I'm quite convinced that you cannot sign away your legal rights on an employment contract and even if you were coerced to do so, the contract becomes illegal by definition. I'm not a lawyer though.

fulafel 9y ago

The evidence so far doesn't agree. In many EU countries the rules have been stricter than this for a long time, and this routine hasn't widely happened in the countries I know about.

cyphunk 9y ago

The cookie law didn't kill cookies but it did inform people about them. It's responsibility for bring the discussion about tracking and cookies into popular discourse was greater than zero. This law and the new checkbox may have a similar affect.

kozhevnikov 9y ago
Completely agree, despite the implementation of it being somewhat of a joke I believe it brought some needed awareness about the spread of user tracking or at least it existence to non-tech people.
- walshemj 9y ago
  But at a huge cost
ucaetano 9y ago
> it did inform people about them Did it? I'm highly skeptical about that. Do you have any source showing that the general population is better informed about cookies after that law?
kelnos 9y ago
I don't see this as having been particularly effective, though. It just made a slew of websites add an annoying pop-up or info bar to their site that says "we use cookies", and the reason given is usually one of a few boilerplate, content-free reasons like "to improve your experience". It's just an annoyance to have to click through, and doesn't provide much in the way of useful information anyway.
chris_7 9y ago
Yes, it informed me about them to the extent that I've installed a uBlock list to specifically avoid being informed about them. I don't even live in the EU...