Hacker News Reader

Comment by drinchev | Hacker News Reader

Looking at all positive comments here, this is generally a bad news.

Not sure how much compliant this is with the law, but in this case the law should be more protective towards employees.

I imagine the following situation

I write on a company-owned piece of paper - "My boss is an idiot". Then take this piece of paper put it in an envelope ( owned by the company as well ), write the name of my colleague and seal the envelope. Then put the envelope on the recipient's desk.

I bet it would be illegal for my boss to take that letter, open it and read it.

P.S.

Looks like with e-mails the law is more protective towards employees :

[1] : https://www.reuters.com/article/us-privacy-emails-echr/europ...

[2] : http://www.internationallawoffice.com/Newsletters/Employment...

[3] : https://www.womblebonddickinson.com/uk/insights/articles-and...

View on HN

Your boss is absolutely allowed to open an envelope on your desk if it's clearly a business-related piece of mail, and your employee handbook almost certainly says that your corporate Slack account is only to be used for business purposes.

In fact, your boss is allowed to open any mail sent to your work address.

https://www.azcentral.com/story/money/business/abg/2015/07/1...

http://www.askamanager.org/2010/08/is-it-legal-for-my-boss-t...

http://employment.findlaw.com/workplace-privacy/privacy-at-w...

Ah, Europe might be different. In the US, if your employer owns the platform, they have the right to all the messages for compliance. We view this as "if you have something private, don't do it on corp channels." This is usually fine unless you're harassing someone or engaging in something against corp ethics.

https://www.privacyrights.org/consumer-guides/workplace-priv...

It really depends on national legislation, as well as individual contracts with unions or work councils. At least here, as a rule of thumb, as long as private internet use is permitted, the employer can't legally monitor traffic outside of very specific circumstances. AFAIK you can't get around that by prohibiting personal internet usage without generally enforcing that prohibition.

> At least here, as a rule of thumb, as long as private internet use is permitted, the employer can't legally monitor traffic outside of very specific circumstances. AFAIK you can't get around that by prohibiting personal internet usage without generally enforcing that prohibition.

This isn't relevant here. ECHR has ruled that employers do have the right to read emails, as long as employees are notified in advance (which can include blanket notification as part of their employment agreement). ECHR has jurisdiction over all ECHR countries, which is a superset of EU countries and includes several non-EU countries, like Norway. Other European countries, like Germany, Switzerland, and the UK have also affirmed this right.

Email being roughly analogous to Slack, in the eyes of the law, there's little room for doubt that employers in Europe have the right to read Slack messages on the company's Slack account.

The ECHR has ruled that it is not a violation of human rights, that does not override national law that limits employers if it exists.

> The ECHR has ruled that it is not a violation of the convention on human rights, that does not override national law that limits employers if it exists.

It doesn't override national law, but national law is pretty consistently clear that employers have this right as well - that's why the case was before the ECHR in the first place.

Again, it depends on individual agreements. If the employee is not allowed to use his work company mail for private stuff, he has no reasonable expectation of privacy that goes beyond obvious cases. Like, for example, if your wife sends you a mail with the subject "here are my nudes!", your employer isn't allowed to access the content.

You claimed that specific rules the poster you replied to mentioned aren't relevant due to the ECHR decision, and that's just not true. E.g. here in Germany, an employer needs to explicitly forbid private e-mail to be allowed simple access to employee mail, which is why basically everyone does that, often allowing private internet use to access webmail instead. (I've also seen employee agreements where there's different rules for specific folders: a private archive folder is never accessed, work-related folders can be easily accessed and e.g. looking at new mail in the inbox is allowed if it's done under supervision and e-mail that's clearly recognizable as private isn't opened, since private mail was hard to avoid in the specific case)

This is something were you likely can not make useful blanket "in Europe" statements.

> Not sure how much compliant this is with the law, but in this case the law should be more protective towards employees.

This change is precisely because of regulations like GDPR, among others.

The ECHR said that the employer has no right to access any private employee communication, even if it happened at work.

That contradicts what you’re saying quite a bit.

It doesn't contradict what I'm saying. If you mean the Romanian case, the ultimate resolution was that 1) an employee has an expectation of privacy for personal communication on personal channels on a corporate machine, and 2) if an employee's personal internet usage is going to be monitored on a corporate machine, they must know before the monitoring begins. The ECHR didn't have any problem with the monitoring in general; what they ruled against was the legality of personal internet usage monitoring before the employee knew about it and agreed.

In the ECHR case, the employee's personal communications over an instant messenger were being monitored just because they were happening on the employer's machine, and without the employee knowing ahead of time. That's the no-no. But Slack is not a personal communications medium; it's maintained and administrated directly by an employer for the explicit purpose of work-related communication. In the context of the ECHR case, Slack doesn't qualify.

Circling back to Slack and the GDPR: as a direct result of the GDPR, Slack now needs to align their desire for full employee auditability with full data transparency. There's a tension between competing regulations, but there's no contradiction here.

Slack can be used for e.g. union organizing, which an employer may not read either, and "they must know before the monitoring begins" is obviously not given here.

This doesn’t look good for Slack.

That's 100% incorrect.

https://www.echr.coe.int/Documents/Press_Q_A_Barbulescu_ENG....

They don't have free access however they want, but they do have the right to access under certain conditions.

Communication over an employer-provided tool is not private communication.

In broker-dealer finance, it is illegal to not log and audit all business communications. Additionally, you have to contract with a government-approved agency to save the logs in a manner that cannot be tampered with. I think we even have to save it in a format that is easy for government agencies to review and search if necessary.

I'm lost on the employees needing protection concept here.

If you're going to call your boss an idiot, don't do it with the company tools. That seems like a pretty reasonable boundary to maintain.

I've never thought of much of anything that was my employer's as mine. If I wanted a private email conversation, I'd use my email, same with chatting and etc... that's just smart no matter what the local legal traditions are.

The volume of negativity surprises me if only because there are all sorts of ways to obtain some private channel communication.

Do people need to talk shit about their boss THAT often, but they feel they should use a work provided tool to do it?

It's funny how much hedging and how many implausible hypothetical scenarios there are in some of these comments.

Reply on news.ycombinator.com