> "Compare that to our email, where I can go into anyone's messages immediately if need-be. This is all very standard corporate IT stuff that you need for HR and legal reasons."
Wow, THAT is highly illegal in Europe.
Wow, THAT is highly illegal in Europe.
In the US there is usually a form you sign at your hiring that says you understand the company may monitor your email. It is couched in terms like "to ensure compliance with laws and company policy" but the actionable part is that they assert the right to monitor it and you agree to that (or you don't work for them).
[1] https://www.nytimes.com/2017/09/05/business/european-court-e...
Companies must still be able to comply with eDiscovery and data preservation requests from various police agencies (such as Økokrim), and these may be performed without informing individuals that it is happening.
The only opening for reading employees' communications that I can find by some quick googling, are (1) if there is good reason to believe that information contained there is required to keep the concern going or (2) if there is suspicion of serious dereliction of duties. And even then, there is a significant checklist required in order to do it legally. (Obviously, legal police requests can be fulfilled without necessarily alerting the owner).
My point being, this is a far cry from legally being able to go into anyone's communications immediately if need-be.
Are you aware of further openings than this, apart from the obvious in the case of a court-ordered request? I am basing this on the statement from Datatilsynet at https://www.datatilsynet.no/rettigheter-og-plikter/personver.... General monitoring would seem like a big no-no.
The EU, on top of requiring COE/ECHR membership provides additional protections under the EU Charter of Fundamental Rights. The highest court for EU law is the European Court of Justice, not the ECHR.
Then on top of that, a number of EU/EEA countries have much stricter rules, some are outlined in the article.
So it's technically right in that it is legal in signatories to the ECHR provided they are not covered by other, stricter rules via one of the other routes, and many are.
Intercepting messages on a medium that is clearly meant to be private is usually illegal.
In financial services they monitor all kind of chat rooms, especially after the LIBOR scandal. Every chat I open gives me a disclaimer saying that chats will be monitored.
[0] https://www.citizensadvice.org.uk/work/rights-at-work/basic-...
I've seen a situation where this was invoked - employee was fired for an unrelated issue, only kept some documentation in their inbox for whatever reason. Without such a provision, our options would have been a) legally questionable, b) up shit creek sans paddle.
E.g. while employment contracts in the UK are often fairly long, employment contracts in Norway can be as short as a couple of paragraphs, as almost all the terms are regulated and are costly and/or difficult to deviate from for most roles and most additional terms you might add will be null and void.
Yes, this is a common trope on HN (and the Internet in general). People have selective memories, and it's easy for people - unintentionally - to remember the most favorable laws from individual countries, stitch the together in their minds, and then form perceptions on the composite image. It's generally not conscious, but it happens pretty frequently.
And in some cases - such as this one - people are just flat-out misinformed about the situation in Europe. (As pointed out in other comments, this is legal in the EU, subject to comparable restrictions as it is subject to in the US). It's not surprising that a feature Slack is marketing specifically to business users is, in fact, legal for businesses to use in one of their largest markets.
They even do it in the UK, which is weird "Here in Britain, we drive on the left, and in Europe they drive on the right"
No, it isn't. https://www.nytimes.com/2017/09/05/business/european-court-e...
To wit: “Today’s ruling is fairly clear in how it outlines the parameters of monitoring employees,” said Stephen Ravenscroft, a London-based partner specializing in employment law at White & Case, a law firm. “It won’t be sufficient for employers to have a general policy permitting monitoring — the policy will need to be much more detailed, outlining why, how and where employees may be monitored and explaining how any information gathered through monitoring may be used.”
> In an 11 to 6 ruling, [the ECHR] found that Mr. Barbulescu’s privacy rights had been violated [after he had been fired for sending personal messages using his corporate account].
and
> Furthermore, the chamber found, Romanian courts did not sufficiently examine the company’s need to read the entirety of Mr. Barbulescu’s messages, or the seriousness of the consequences of the monitoring, which resulted in dismissal.
and
> The chamber ruled that countries should ensure that companies’ efforts to monitor employees’ communications are “accompanied by adequate and sufficient safeguards against abuse.”
So at least it's a more nuanced view than "I can go into anyone's messages immediately if need-be".