1

The computers at the company I work for recently show the message below during log on.

This computer system is the property of Company. It is for authorised use only. All activities conducted on and information accessed, processed, stored or sent using this system may be examined. By using this system, all users aknowledge notice of, and agree to comply with, the Company IT Acceptable Use standard. Unauthorised or improver use of this system may result in disciplinary action. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use. Log off immediately if you do not agree to the condictions stated in this warning.

Is the statement legal according to European regulations?

Besides, it is my work computer, it is not that I have an option not to log on.


Related question for Norway

migrated from security.stackexchange.com Sep 27 at 15:17

This question came from our site for information security professionals.

  • 3
    It is not your computer, it's your employer's computer. They dictate how you are allowed to use their computer, and they can check if you comply with this. This means, yes, theoretically your employer could see that you browse Facebook during work hours. – MechMK1 Sep 27 at 11:40
  • 1
    For them to be legally allowed to do that it's a lot more complicated than it seems. – Overmind Sep 27 at 12:37
  • 1
    @MechMK1 For what's worth I don't even have a fcbk account. At work, basically, I work. That's is not my concern, but rather the feel of lack of trust and invasion. It is not a good way to work imho. – Raf Sep 27 at 12:39
  • 1
    @MechMK1 Absolutely not. This line of reasoning "the employer can do whatever they like because it's their computer" is not just weird to me, it's also incorrect in any country following the European Convention on Human Rights. Please don't spread misinformation. Note that I'm not saying that an employer cannot monitor your computer, just that there is such a thing a privacy and this does not stop the moment you walk into the office. Any monitoring has to be proportional for its goal, limited in scope, and communicated to the employee. – Luc Sep 27 at 13:48
  • 1
    This question focuses on the legal aspect (privacy in particular) and is not within the scope of this site (which is about "protecting assets from threats"). This question should be migrated to the Law StackExchange site. – Luc Sep 27 at 13:51
4

The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities).

According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be:

  • for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"),
  • proportionate ("it was the only possible way available"), and
  • communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy).

In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).

0

No. That is not presented correctly. Generally, the employer must store and process the data that it actually needs for something in the employer-employee relationship. They are not generally allowed to store private information.

That content must be presented to all uses in writing and they must sign for taking notice of it. Also, they must be offered the option not to consent.

To make this 100% legal, the employer must formulate something like:

  • Employees are not allowed to use the computers for private purposes.
  • Limited exception to the above use: if you want to use it in limited manner for private matter (like checking private e-mail, etc) then you must agree to being monitored as specified (like it's specified in your text) and sign a consent.

Then the user must sign the consent which should contain among others:

"I am giving you this consent for the Limited Exception under IT&C Policy, which is for the personal use of the internet to the extent of access to the internet websites and internet search subject to the IT&C Policy and giving this consent for [CompanyNameHere] to process, record and store the data relating to such personal use under Limited Exception." "I hereby give my consent:" followed by Name, Date, Signature.

  • 1
    Such a statement could be on the employment contract. – MechMK1 Sep 27 at 11:59
  • Likely in the company's Acceptable Use Policy. – Justin Sep 27 at 12:08
  • I wonder why clueless about GDPR people down-vote such an answer. – Overmind Sep 27 at 12:38
  • @Overmind I still think in order to downvote a question you should be required to either write a comment or to upvote an existing comment. – MechMK1 Sep 27 at 12:46
  • 1
    GDPR doesn't require such wording. First, GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data. Also, as it's clearly told how the data will be processed and that there should not be personal use, the company is not responsible of any PII data that gets collected while using the system against the Acceptable Use Standard. – Esa Jokinen Sep 27 at 13:48
-1

As an employee everything you do on a company property, including laptop can be observed and monitored.

There is a thin line here although, because the company can get caught up in monitoring too much, like seeing your personal passwords, PII or some confidential data like your e-medical records. If the company gets caught storing this kind of information they will be in deep trouble legally, so they usually try to avoid this by obfuscating in logs sensitive data like passwords, PII, Health as much as possible.

Overall their statement is correct and you should try to avoid using your work laptop for personal stuff and the other way around. We live in 21st century, just use your smartphone to look at your personal stuff.

  • To the downvoter: not only do I find it rude to downvote without feedback, in this particular case I would also be interested to hear if there is anything incorrect about the answer. – Luc Sep 29 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.