5 ms·

Fortunately in Europe what the said boss did is illegal and this can end with a criminal prosecution.

by kunley 3y ago

yau8edq12i 3y ago
What? First, Europe isn't a single country and there are large difference between legal systems. Second, what you said is just plain wrong in at least one. In France (which is known for strict worker protections) the employer can go through any employee's mailbox or files on their work computer/account provided 1. that the messages/files in question aren't clearly marked as personal 2. that the conditions for the access are laid down in advance with proper notice. When an employee is let go, they need to be given time to empty their mailboxes etc of private correspondence or files. https://www.cnil.fr/fr/lacces-la-messagerie-dun-salarie-en-son-absence https://www.cnil.fr/fr/lacces-la-messagerie-dun-salarie-en-s...
- sillysaurusx 3y ago
  I had some DM’s which were of personal nature that were rifled through after a contract ended. How do you "clearly mark a DM as personal"? It was creepy, and further illustrated that anything you say in Slack can and will be viewed by the whole company. If not literally, then that’s how you should treat it. You might be right that it’s not illegal, but it would be nice to have those kinds of protections. Trying to talk to anyone at work in the WFH era is a field of landmines, because you never know at any given time whether what you say will make it back to the person you’re discussing. Discussions like that are a normal and healthy part of socializing with coworkers, and it happens at every company. Except in the WFH era everything you’ve typed is a permanent record, whereas previously you’d be able to say something to a coworker without worrying that someone else will someday hear it. But, it’s a new era. It’s easy to adjust. Just don’t get personal at work. It sucks, but work is designed to suck, or else it wouldn’t be work.
  - Gabrys1 3y ago
    > anything you say in Slack can and will be viewed by the whole company. If not literally, then that’s how you should treat it. Anyone thought otherwise?
    - sillysaurusx 3y ago
      In private DMs?
      - TeMPOraL 3y ago
        In company Slack? Private != personal. At least I never ever imagined one could even assume DMs on work IM are personal private conversations. They're organizationally grouped as chat between to accounts, as opposed to group chat, but they're at work, for work, using work-provided tools... Or put another way: why would anyone consider work Slack to be different in this regard than company e-mail? Much like with e-mails, the difference between DMs and group chats is whether the number of participants is > 2.
        sillysaurusx 3y ago
        I guess the cognitive dissonance is that I used to be able to say things to a coworker in-person which wasn’t recorded and tracked, using my voice. This was always a normal part of work, and I didn’t give it a second thought until it was gone. Nowadays it feels like someone is constantly standing over your shoulder whenever you’re at work, and there’s never a private moment. This is especially strange during holidays, since personal conversations tend to spontaneously happen around those times. You’re right of course. I just wish we had something to fill the void that was left by in-person interactions vanishing. I think I’ll be doing WFH pretty much the rest of my life, and I absolutely hate going into an office in general, but there are definitely some aspects I miss. Being able to chat off the record with a coworker is one of them.
        bombcar 3y ago
        Call! Yes, most communication can be done with chats in slack or teams, but take the excuse to call and chit chat a bit before getting down to business. Unless all calls are transcribed and recorded, it’s pretty “watercoolerish”.
  - donalhunt 3y ago
    The way this was communicated to me in the past was "don't say/write anything using company resources that you don't want to see on the front of <insert major news publisher>". All communications on employer-operated platforms are subject to discovery. Senior leaders tend to skirt this by using the telephone or video calls predominantly. However the infiltration of machine learning and AI means transcripts of calls, etc are now possible too. In addition, the growing use of "disappearing" messages despite litigation holds has come up in more legal cases recently.
    - deleted 3y ago
      [deleted]
    - ghaff 3y ago
      A video call on a company account isn't ironclad but, unless you're discussing something actually illegal, it's probably good enough for most purposes. Maybe not as good as personal cell phones or in-person, but a lot better than anything written--especially on company systems.
    - DiggyJohnson 3y ago
      That seems like it would be a much larger constraint than you're making it out to be.
- theologe 3y ago
  I agree with you, Europe has different countries and some of them are not in E.U. so different rules may apply. However, since France is in E.U. what you describe should be illegal. The article you refer to is 15yrs old btw....
  - yau8edq12i 3y ago
    The "article" is published by the French data protection authority. They update them when regulations change. They didn't update this one. Make a deduction, now. > However, since France is in E.U. what you describe should be illegal. What's the regulation or directive you're talking about?
- laserlight 3y ago
  What the said boss did sounds to me like impersonation, which is not only illegal, but a crime. Accessing records kept on company assets is one thing, logging in to someone's account in a communication software is another.
- donkeyd 3y ago
  > Europe isn't a single country Correct, but it does have a single ECHR. Even though some countries still ignore them.
  - yau8edq12i 3y ago
    What ECHR principle are you referring to here?
fullspectrumdev 3y ago
The rules on this vary across Europe, though broadly speaking accessing an employees mailbox is “something you only do after speaking to legal”. The patchwork of national laws and national interpretations of EU regulations is quite interesting, and rather confusing especially if you do offensive security work or DFIR. As an example, when doing consultancy we would do the usual phishing as part of an assessment. Usually this is followed by dumping the users mailboxes to look for further credentials/access to corporate resources (eg: are they emailing passwords around?) - but in some countries such as Germany that’s often explicitly ruled out due to fear of breaching privacy regulations.
- donkeyd 3y ago
  > The rules on this vary across Europe Not really, ECHR has already ruled on this. It's pretty much only allowed if there's an important reason for it. For example, to recover something invaluable (contract, code, report) that isn't available somewhere else and cannot be replaced. In that case that's also the only thing that them employer can look for. They can't open obviously unrelated e-mails. So before talking to legal, make sure you have a valid reason.
  - lotsofpulp 3y ago
    What mechanism is there to prove who looked at what emails? And who would be there to enforce it, especially at a small business?
    - hef19898 3y ago
      Difficult, very difficult on deed. As with most corporate and whize collar crime, the investigation rate is extremely low. That being said, worker councils and unions. The former has to involved in these things, if the exist. The latter pushes for the former. That is valid for Germany.
    - donkeyd 3y ago
      There really is none. A smart company would work with the 4 eyes principle though (still no guarantee). However, if a company does find an unrelated e-mail they want to use against you (which is what most people fear), that makes them liable.
delfinom 3y ago
It's completely legal in the US and often mandated by regulation. In some US industries, even your phone calls are recorded by law.

Fortunately in Europe what the said boss did is illegal and this can end with a criminal prosecution.

by kunley 3y ago

Fortunately in Europe what the said boss did is illegal and this can end with a criminal prosecution.

What? First, Europe isn't a single country and there are large difference between legal systems. Second, what you said is just plain wrong in at least one. In France (which is known for strict worker protections) the employer can go through any employee's mailbox or files on their work computer/account provided 1. that the messages/files in question aren't clearly marked as personal 2. that the conditions for the access are laid down in advance with proper notice. When an employee is let go, they need to be given time to empty their mailboxes etc of private correspondence or files. https://www.cnil.fr/fr/lacces-la-messagerie-dun-salarie-en-son-absence https://www.cnil.fr/fr/lacces-la-messagerie-dun-salarie-en-s...

sillysaurusx 3y ago
I had some DM’s which were of personal nature that were rifled through after a contract ended. How do you "clearly mark a DM as personal"? It was creepy, and further illustrated that anything you say in Slack can and will be viewed by the whole company. If not literally, then that’s how you should treat it. You might be right that it’s not illegal, but it would be nice to have those kinds of protections. Trying to talk to anyone at work in the WFH era is a field of landmines, because you never know at any given time whether what you say will make it back to the person you’re discussing. Discussions like that are a normal and healthy part of socializing with coworkers, and it happens at every company. Except in the WFH era everything you’ve typed is a permanent record, whereas previously you’d be able to say something to a coworker without worrying that someone else will someday hear it. But, it’s a new era. It’s easy to adjust. Just don’t get personal at work. It sucks, but work is designed to suck, or else it wouldn’t be work.
- Gabrys1 3y ago
  > anything you say in Slack can and will be viewed by the whole company. If not literally, then that’s how you should treat it. Anyone thought otherwise?
  - sillysaurusx 3y ago
    In private DMs?
    - TeMPOraL 3y ago
      In company Slack? Private != personal. At least I never ever imagined one could even assume DMs on work IM are personal private conversations. They're organizationally grouped as chat between to accounts, as opposed to group chat, but they're at work, for work, using work-provided tools... Or put another way: why would anyone consider work Slack to be different in this regard than company e-mail? Much like with e-mails, the difference between DMs and group chats is whether the number of participants is > 2.
      - sillysaurusx 3y ago
        I guess the cognitive dissonance is that I used to be able to say things to a coworker in-person which wasn’t recorded and tracked, using my voice. This was always a normal part of work, and I didn’t give it a second thought until it was gone. Nowadays it feels like someone is constantly standing over your shoulder whenever you’re at work, and there’s never a private moment. This is especially strange during holidays, since personal conversations tend to spontaneously happen around those times. You’re right of course. I just wish we had something to fill the void that was left by in-person interactions vanishing. I think I’ll be doing WFH pretty much the rest of my life, and I absolutely hate going into an office in general, but there are definitely some aspects I miss. Being able to chat off the record with a coworker is one of them.
        bombcar 3y ago
        Call! Yes, most communication can be done with chats in slack or teams, but take the excuse to call and chit chat a bit before getting down to business. Unless all calls are transcribed and recorded, it’s pretty “watercoolerish”.
- donalhunt 3y ago
  The way this was communicated to me in the past was "don't say/write anything using company resources that you don't want to see on the front of <insert major news publisher>". All communications on employer-operated platforms are subject to discovery. Senior leaders tend to skirt this by using the telephone or video calls predominantly. However the infiltration of machine learning and AI means transcripts of calls, etc are now possible too. In addition, the growing use of "disappearing" messages despite litigation holds has come up in more legal cases recently.
  - deleted 3y ago
    [deleted]
  - ghaff 3y ago
    A video call on a company account isn't ironclad but, unless you're discussing something actually illegal, it's probably good enough for most purposes. Maybe not as good as personal cell phones or in-person, but a lot better than anything written--especially on company systems.
  - DiggyJohnson 3y ago
    That seems like it would be a much larger constraint than you're making it out to be.
theologe 3y ago
I agree with you, Europe has different countries and some of them are not in E.U. so different rules may apply. However, since France is in E.U. what you describe should be illegal. The article you refer to is 15yrs old btw....
- yau8edq12i 3y ago
  The "article" is published by the French data protection authority. They update them when regulations change. They didn't update this one. Make a deduction, now. > However, since France is in E.U. what you describe should be illegal. What's the regulation or directive you're talking about?
laserlight 3y ago
What the said boss did sounds to me like impersonation, which is not only illegal, but a crime. Accessing records kept on company assets is one thing, logging in to someone's account in a communication software is another.
donkeyd 3y ago
> Europe isn't a single country Correct, but it does have a single ECHR. Even though some countries still ignore them.
- yau8edq12i 3y ago
  What ECHR principle are you referring to here?

fullspectrumdev 3y ago

The rules on this vary across Europe, though broadly speaking accessing an employees mailbox is “something you only do after speaking to legal”. The patchwork of national laws and national interpretations of EU regulations is quite interesting, and rather confusing especially if you do offensive security work or DFIR. As an example, when doing consultancy we would do the usual phishing as part of an assessment. Usually this is followed by dumping the users mailboxes to look for further credentials/access to corporate resources (eg: are they emailing passwords around?) - but in some countries such as Germany that’s often explicitly ruled out due to fear of breaching privacy regulations.

donkeyd 3y ago
> The rules on this vary across Europe Not really, ECHR has already ruled on this. It's pretty much only allowed if there's an important reason for it. For example, to recover something invaluable (contract, code, report) that isn't available somewhere else and cannot be replaced. In that case that's also the only thing that them employer can look for. They can't open obviously unrelated e-mails. So before talking to legal, make sure you have a valid reason.
- lotsofpulp 3y ago
  What mechanism is there to prove who looked at what emails? And who would be there to enforce it, especially at a small business?
  - hef19898 3y ago
    Difficult, very difficult on deed. As with most corporate and whize collar crime, the investigation rate is extremely low. That being said, worker councils and unions. The former has to involved in these things, if the exist. The latter pushes for the former. That is valid for Germany.
  - donkeyd 3y ago
    There really is none. A smart company would work with the 4 eyes principle though (still no guarantee). However, if a company does find an unrelated e-mail they want to use against you (which is what most people fear), that makes them liable.

delfinom 3y ago

It's completely legal in the US and often mandated by regulation. In some US industries, even your phone calls are recorded by law.