Private messages at work can be read by EU employers

But, I see a lot of emphasis being placed on the fact that it was a company-owned machine and that it was ostensibly being used for company purposes. These two facts seem to underpin a lot of what everyone says.

But ownership and mode of use are not the only kinds of resources or properties to think of. For example, at least in the US we have the concept of "company time" which covers the time periods during which you are performing an action sanctioned by a company. Could this be used to demand the ability to monitor employees during time periods when they are on company time?

Likewise, there are a lot of gray areas going in the reverse direction -- from employee to employer. For example, it is true that HR records (say, for example, performance reviews written by my boss about solely me) are electronic files that are the property of the company, just like a computer workstation is property of the company.

But, just as a computer workstation could be misused for personal use, and thus needs to be inspectable for compliance, so also the HR files could be misused for personal use (making jokes, talking about non-professional aspects of me, conspiring to deny a promotion simply due to personal preference, etc.) -- so why aren't such files open for inspection?

Yet another interesting aspect of all of this is why we believe that not only must the workstation be made available for inspection, but further that it is the employer who gets to perform the inspection.

Why isn't such inspection required to be handled by a third-party arbiter, much the way that tax and official records are required to be kept by a certified firm specializing in it. We don't trust companies to say, "Yep, these are my taxes and records, I swear I didn't lie or hide any money." We at least require some third-party to attest to that and stake a reputation on it (subverted though it may be).

Yet with issues of inspection, we just sort of capitulate to this idea that the employer not only gets to raise the issue of suspicion about misuse, but also gets to be the authority on the investigation of whether or not misuse occurred, and to what extent employee privacy must be invaded to get all the relevant info.

I'm not sure this is a good example. Bear in mind that 'the company' is just other employees. I am not aware of any particular set of 'rights' limiting which employees have access to your information - just policy which is entirely decided by the power hierarchy.

I hear examples like this a lot but it simply hasn't been my experience, and I haven't always worked in developer-run (or even developer-friendly) industries or companies.

I 100% accept that I might just have been lucky in my previous and current employment, but any time I've had a doctor's appointment or had to run to the vet or anything like that, I've either made the time up that evening or the next day (one time for a long Wednesday AM appointment, over the next two days).

I say this not to discredit the very real fact that employers like this exist, but only to suggest that this is on the same level as poverty wages and forcing someone to buy their own office supplies. If you work in an environment like this, moving on (either simply by employment or geographically) should be among your top priorities.

That's the very definition of union meetings that happen in preparation to collective bargaining. Commonplace where the workplace is unionized.

Don't work for a company that monitors it's own IT equipment?

Monitoring the equipment is to ensure it's working properly, as well as to guard against employees misusing company equipment by installing toolbars and apps that have no business purpose (which ultimately leads to mis-performing equipment, and lost productivity).

I don't think I'd want to work for a company like that - the IT equipment would be in shambles, borderline unusable.

The suit is in the European Court of Human Rights. He was claiming that Romania violated his right to confidential correspondence by having civil law that allowed his company to read private messages. He lost, therefore Romania's laws are fine, and thus the employer is still in the right.

Eh, yeah, that is weird, now that you mention it. It's like they were interested in protecting the reputation of the company, but they wanted to throw the ex-employee to the wolves.

I don't know UK law but in several eu countries a employer can't monitor their own computers unless they have in writing informed the employees about it.

Of course, I'm Canadian and our privacy law is fairly strict. Violations are also a tort, even without proof of damage, so my case may be unique.

But regardless, firm, written guidelines applied equally across the organization are always a good defense.

Note that in this case he lost because his employer had the policy clearly in place. He might have won if they didn't have that.

But I think his argument would have been stronger if he had raised the issue after his initial warning. Why did they have to invade his privacy twice for it to become an issue for him? The answer: because he was sacked. This seems to change it from a privacy issue to a retaliation.

Not that I'm okay at all with employers being able to violate his privacy, regardless of his motives for claiming his civil rights.

Assault is probably against Romania's laws. As such, any policy or contract specifying assault is illegal.

Invasion of privacy in the workplace is allowed under law; this law was challenged in the ECHR - and the challenged failed, so the law stays. So it is legal to put this in any contracts in EU, since the judgement sets precedence across EU.

I've worked with several highly regulated industries, and while data preservation is a big deal, very frequently compliance officers have said "Just don't store personal-type or non-material information like calendar meeting requests for off-site dinners" because they're simply outside the purview of what's needed to satsify the rules.

On the other hand, it was quite clearly stated that if doing filing/archiving one comes across correspondence that reflects an error of judgment (intentional or not), say relating to giving a "personal" gift to somebody above/beyond the accepted corporate policy or legal mandates (ex: local government officials), then by all means, that's in the company's interest to review and address.

There's a perfectly fine reason some sensitive conversations should take place over the phone instead of in writing (most notably "OUR IT SAYS WE'VE HAD A BREACH OMG OMG OMG"), just like there's ample reason talking about something sketchy is frequently performed over the phone. Funny creatures, us humans.

Just curious, are you in the US? My employer's policy is essentially "Your work-provided laptop is for work. However, we recognize that you'll access personal websites and content from time to time. Don't miss deadlines because you're on Facebook or the NY Times all day." However, they explicitly retain their right (but not responsibility!) to monitor, log, and retain all traffic and activity on not only the work machines, but the work wifi (including guest wifi).

I asked about the US because I know privacy protections are much strong in the EU and I had never heard that allowing private messages bars an employer from reading them.

When you're on the employer's dime, using the employer's equipment, and using the employer's internet connection, you don't get to send personal messages. This guy did, and then found out the consequences. It's pretty simple.

The company used MSN Messenger for business purposes. This guy took it upon himself to setup a separate account from which he privately messaged people during business hours.

This guy would not have been able to send those private messages had the employer not fully paid for all the equipment and necessary components to facilitate messaging for business purposes.

Imagine the parallel. I hire you to telemarket for me (make sales phone calls). I tell you all calls are recorded. Sometime later, I'm digging through the recordings to find a customer's call, and discover you have been making many personal non-business-related phone calls. Instead of using my equipment to conduct business, you have decided to make personal calls to your friends. Of course you would be terminated, and of course I listened to the calls, because I own them.

The court has been clear (in this case, and cases in the past) that employees do have a right to privacy at work, and that an employer cannot just trawl everything all the time, even if there are policies in place.

That's not true and I guess you haven't really read what the ruling is about. It's about this one exact case where the court ruled that the employer reasonably expected that the account they were looking at wasn't personal.

If the employer would knowingly look into employees personal correspondence the ruling would be different.

> His employer had discovered that he was using Yahoo Messenger for personal contacts, as well as professional ones.

> Because it believed it was accessing a work account, the judges said, the firm had not erred.

EDIT: Removed unnecessary remark.

Best not to do that stuff at work. You also have to wonder about the internal wifi people put their phones on.

The key issue here is the definition of authorized access. If you create a contract with your employer whereby they give you money and you authorize them to access your digital communications (via an explicit policy) then their access is not unauthorized.

But it wouldn't be. It's their computer. If I use your computer, you have every right to examine every file I created while using it; you have every right to install a keylogger; it's your computer (whether it would be decent to do those things is a different subject).

It's not private correspondence if you conduct it in public; it's not private computing if you do it on someone else's computer. If you want privacy, use your own device.

But, in general, never do X advice can be actively harmful because it advises people against doing things that very many do without repercussions and causes people to ignore advice that it's important to follow.

They can read your emails, and chat logs and whatever else is sitting on your work machine. The only way of dealing with that is never have personal information on them in the first place.

Even if your employer is fine with personal use, courts will rule that it's all in scope during a discovery phase. I've been involved in litigation scenarios where people's personal email ended up being sifted through by the other litigant because opposing counsel convinced the judge that business was being conducted there, and there was evidence of frequent access on a corporate device.

All of your protections from a legal point of view are really defined by custody and scope of control. Data stored on your device in your home is the most protected. Data stored on your employer's PC or file server on your employer premises is the least protected.

Client gets upset about some deal, they sue your employer. They claim you leaked some information to a competitor. Client and employer both want access to your device, to look for evidence of the information leak. You conducted work, on behalf of the employer, on your own personal device. They have to have the legal right to search that device for evidence..

Now.. if you had two devices. One for work, one for personal. You never used your personal device for work.. then to me, personal device is off limits, unless they found compelling evidence ELSEWHERE that you had disclosed information via your personal device. However, that would need to come out and be backed by evidence. They can't just look at your device without being compelled. I am no lawyer though, and my knowledge of civil/criminal evidence handling is shallow..

Not quite right - this is one of the grey areas where the law defines something in between "has an expectation of privacy" and "doesn't have an expectation of privacy". Basically, the employer generally can't access personal information on work computers, even connected to work networks, unless they have a reasonable belief that e.g. there's evidence of the employee breaking policy in that personal information.

Even then, they must access as little as possible - for example, if you believe that the employee has personal information on their computer and having personal information is against policy in itself, and that's the only thing you believe, all you can do is ascertain that it actually exists - you can't go digging through people's family photos or private communications unless you reasonably believe that there's further policy violation in there.

For instance, reading news articles on your work computer browser, browsing your personal facebook account, either during a break or for a few minutes a day, will be seen as reasonable. On the other hand, if you spend 6hrs out of 8 doing personal stuffs, the employer can use this against you.

I also assumed this kind of usage would be protected by a court like the European Court of Human Rights, but I was wrong.