What Is A Fair Privacy Policy?

nlh asks: "I'm one of the founders of TruExchange, a small software company in the Boston area. We've just closed a major round of funding and are going through some VC-inspired (ok, VC-mandated) changes and maturations. One of these is the creation of a formal Employee Handbook, which will contain the all-important company Privacy Policy, among other things. The other founders and I are in the fortunate positions of being active Slashdot readers and of having a good deal of say in the creation of these policies. I wanted to get a feel from the Slashdot community about the best way to implement them (before it's too late)."

"From the employee's position, it's easy to scoff at the fascist-sounding stuff we read on here regularly ('We can and will see and hear everything you do when and if we want to.') but as a 'responsible' member of the management team, I have to take into consideration the legal ramifications of NOT reserving such rights. If we think someone is keeping a gun in his desk, we want to be able to check it. If someone is harassing people from our email system, we want to be able to verify it. What I don't want, however, is the creation of a police state (be it on paper or otherwise).

I'd like to come up with a healthy compromise -- We want to create a policy that shows our 'user friendliness', yet we must please the big VCs and protect ourselves as a corporation. We want to say 'We respect your privacy and will make every effort not to monitor you, but we reserve the right to do so.' Is such a compromise possible? What should a reasonable privacy policy say (and how should it be said?) Where does the line between 'employer covering its ass' and 'fascist bastards' get drawn?"

Comments

Be HONEST

[NMerriam]

Look, we understand as employees that what you're saying is true, that you have to cover your own ass. What bugs me is the terms of service kind of legalese that is so over the top that it is literally offensive.

Why not write an employee handbook like Borland used to do software licenses? They used plain language, and explained WHY they had limitations in place, not just a bunch of legal jargon. It is no less legal because it's written in plain English.

You say yourself, "we think someone is keeping a gun in his desk, we want to be able to check it. If someone is harassing people from our email system, we want to be able to verify it. What I don't want, however, is the creation of a police state (be it on paper or otherwise)". That sounds great -- why not just flesh that out as a policy statement?

You really don't have to say "The party in the first part abrogates all claims and reservations for privacy and security of his person, belongings, personal space, and equipment". That's how lawyers write, but you can actually have a legally binding agreement that says "We pay for office equipment and have liability for your actions at work, so you need to know that we do have the right to check your computer or desk. We don't want to do it, but you know as well as we that there's always some nutball with porn on his hard drive, and we don't want to lay you off because we've gone bankrupt from a sexual harassment lawsuit".

Sincerity like that can buy you a LOT of goodwill.

---------------------------------------------

Be Honest

[PapaZit]

It's actually pretty simple: make the handbook say pretty much what you're saying here. You want to preserve your rights, while providing some assurance that you won't routinely spy on your employees "just in case". Perhaps something like this:

The company reserves the right to monitor or search all company property and equipment if improper or illegal conduct is suspected. However, all such monitoring or searching will be performed with at least one witness or explicit written instruction from at least two managers.

I'm not a lawyer. Run the above past one before using it.

--