Slashdot Mirror
European Court Rules Companies Must Tell Employees of Email Checks (reuters.com)
Companies must tell employees in advance if their work email accounts are being monitored and such checks must not unduly infringe workers' privacy, the European Court of Human Rights ruled on Tuesday. From a report: In a judgment in the case of a man fired 10 years ago for using a work messaging account to communicate with his family, the judges found that Romanian courts failed to protect Bogdan Barbulescu's private correspondence because his employer had not given him prior notice it was monitoring his communications. Email privacy has become a hotly contested issue as more people use work addresses for personal correspondence even as employers demand the right to monitor email and computer usage to ensure staff use work email appropriately. Courts in general have sided with employers on this issue.
So I'm going to assume they can and will read anything I do at work and act accordingly.
... in a Technology Administrator Policy and designate an administrator.
I'm retired now, and when I hired on at a law firm 20 years ago, I wrote that policy and amended it as things changed.
I blocked shit like match.com, Facebook, Twitter, etc.
I listed taboos like using business email for non-business purposes and I stated clearly that, at the direction of the partners, I would be monitoring emails, browser history, etc.
For each and every new hire, I read the Policy to them in the kitchen area and invited them to ask question then, and at any other time during their employment.
The last page had a place for two signatures/dates:
- Theirs, acknowledging that they participated in the counseling
- Mine, acknowledging same.
I got a few calls regarding wrongful termination during the years and, in one matter, the fired employee said, "Well, everyone else was doing it."
I told the work comp lady to add, "Line item 6.1.a, 'Report any violations or suspected violations of this policy to the Technology Administrator."
It little behooves the best of us to comment on the rest of us.
As soon as it becomes impossible for an organization to maintain complete control of the communications on it's own networks, connections to other networks, and data transfers to and from those external networks, you have given carte blance to those who would steal company secrets, data, and technology.
This is insane. Folks have cell phones that they don't have to put on corporate/company networks. Use that for personal.
Check your premises.
And that's the reason why this company lost: they didn't tell the employee about the monitoring.
So there'll be a single line added in an obscure place to the pile of paper you're required to sign upon being hired, without even an opportunity to actually read what you're signing.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
No, because the EU laws don't allow for that douchebaggery to exist.
I work in the EU and there are big signs at entry doors warning that the place is being monitored through CCTV,
We have signed a separate document which details what exactly is being monitored, how and for how long, with a list of cases where monitoring would happen, etc.
I do know that all files on my company-issued laptop are scanned and their file names (NOT the contents) are saved for later scrutiny if need be, but in order for that scrutiny to occur, there needs to be a good, legally-established reason.
Files and their contents are backed into the cloud, but I get to choose which ones should be backed up, it's my responsibility to select them (and the privilege to not select the ones I don't want backed up).
There is an expectation for reasonable use of company assets for personal reasons, with top 5% overall users of, say, mobile data being informed they are in top 5% and still not monitored in detail, only told "hey, during the last X months you've been using a lot of mobile data, please try to reduce usage".
This helps employees be less paranoid and focus on work rather than avoiding employer scrutiny.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Yeah, shouldn't that be the base assumption?
No. It might be the cautious assumption but that does not mean that someone who expects some level of privacy has unreasonable expectations. There are many different levels of private email correspondence. For example, if I email my wife to let her know that I will be home late because of work I would not expect my employer to fire me for personal use of work email. However, if you tried to run a small business of eBay selling things through your work email then yes I would expect any employer would likely fire you for that!
This means that there is a certain grey area between what an employer wants to let you do and what a reasonable person might assume that they can do. Hence this ruling seems to make a lot of sense: employers can do what they want with an employee's email account, they just have to say exactly what they will do and what they will allow beforehand. This way everyone's different assumptions about what is ok do not matter because the rules are spelled out.
From the summary, I had assumed that this was a standard case of a company accessing a person's email that was sent through that company's own mail server. I was pretty much ready to side with the employer. If you send an email through your company's mail server, you should expect that someone might view that email. Even if the employer isn't snooping, there are any number of reasons why someone at the company may need to review your work emails. However, the article states:
The company had presented Barbulescu with printouts of his private messages to his brother and fiancée on Yahoo Messenger as evidence of his breach of a company ban on such personal use.
So that makes it sound like this guy was using a personal Yahoo Messenger account. So that kind of takes me in the other direction, in favor of the employee's right to privacy. As a general rule, I don't think that your company should have the right to access your personal email/IM accounts, even if you happen to access them on work devices.
However, that doesn't really explain how they got access to his chats, unless they were stored on his work computer. I don't feel comfortable saying that a company shouldn't be allowed to review the contents of a company-owned computer. And this is further complicated by the fact that the employee stated, in writing, that the account was being used solely for work purposes. In that case, I could see an argument that the account is a work account, not a personal account, and so the employer should be allowed to access it.
In any case, I think there's some space between "what an employer should be legally allowed to do" and "what an employer should do". Even if employers can spy on employees and review private email, they should try to avoid reading anything that's not business related.