2

I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's activity while working from home (VPN).

I'm aware the employer can't ask to audit a user activity without him being notified (I do not know the legal process/laws for this).

We've got tools such as Netwrix Auditor that could even get us a video of user's activity if enabled (currently disabled because we are unaware of the legal aspects, plus it takes a lot of storage).

My question is : what can my employer ask me to audit/monitor ? What is the legal process if the employer want to know details about a user's activity (European/Belgian laws)? What should I sign or ask prior to begin the investigation, so I'm somewhat protected as employee ?

In the meantime, can I simply give them Active Directory logons events, from the VPN IP pool, for that user ? Or is that already too much from a legal point of view ?

Thanks for your help !

Improve this question
1
  • 1
    Do you have a computer use policy that all employees must agree to before using the equipment?
    – Smock
    Oct 16, 2019 at 8:38

3 Answers 3

Reset to default
3

Belgium enacted an implementing law, the Act of 30th July 2018 on the protection of natural persons with regard to the processing of personal data. This, along with the GDPR, are the key legislative references that relate to your question.

On 5th September 2017 the ECHR judged that it "considers that States should ensure that, when an employer takes measures to monitor employees' communications, these measures are accompanied by adequate and sufficient safeguards against abuse". This case set a precedent relevant to employee monitoring in Belgium.

This is most definitely a data protection or privacy law matter and the DPO should be consulted. If they have to do research, that shouldn't be your concern as that is their job. The company must support the DPO in what they need to do that job, as such is literally written into the GDPR. Furthermore, in this case it would, by my evaluation, be necessary to conduct a Data Protection Impact Assessment (DPIA) for the monitoring activity, and if one has been done, it should document the recommendations and requirements or what is already in place.

You as an individual may also ask a question of the Data Protection Authority:

You might ask them about your position and liability as an employee, but I would be more concerned, if I were you, with verifying that your actions are above board rather than trying to cover your ass just in case they aren't. Do the right thing, even if that means questioning the direction you've been given.

AD logons still identify the person logging on, and may include source IP, which is specifically listed in the GDPR as within the scope of 'personal data'. So while there may be a legitimate need to process such data, it needs to be gone about in the right way.

Actions taken by an employee are taken by the organisation in terms of processing personal data, so whatever you are asked or ordered to do, will be done by the company. If you are being offered no legal justification for doing so, you might document the direction you are given and question it respectfully, pointing out that if found to be unlawful, it is the company that would be in trouble, all while knowing that should there be for example an unfair dismissal, you have a record of who asked you to do what, how you challenged or questioned it, and what was the outcome.

Improve this answer
2

Ideally, an employer should have a code of conduct or policy that covers workplace monitoring. If a code or policy has been agreed, it will usually form part of your contract of employment. This means that where an employer is allowed to monitor your activities, these activities could be the subject of disciplinary action if you are using workplace equipment in ways that are not permitted in your contract of employment.

Improve this answer
3
  • Thanks for your answer. I understand there should be a clear Acceptable Use Policy, and I believe that's the case here. However, I'm more interrested into the legal aspects of monitoring and investigating users activity. How far can an employer go ? As an IT, what can I be asked to look at ? And specifically, what should I do to ensure my actions are legal in case of request for investigation ?
    – Ob1lan
    Oct 15, 2019 at 13:55
  • 1
    @Ob1lan - as Victor says, that may depend on what the employee has agreed to. Acceptable use policies usually describe what is monitored, whether the company owns the email and can look at any employees emails etc.
    – Smock
    Oct 16, 2019 at 8:40
  • @Smock thanks for your comment. I'll reread the policies we may have. However, I'm still concern about my legal implications if I'm asked to perform an investigation. Are there legal precedents about that ? What should I ask the HR prior to conduct the investigation on the user (document, signed copy, authorization,...) ? I want to be 100% sure I won't break the law, even if the HR or lets say the CEO oblige me to audit the activity of another employee.
    – Ob1lan
    Oct 16, 2019 at 21:24
2

The GDPR is no blanket prohibition of data use, it requires a legal basis and/or the consent of the data subject for data processing.

Is your company large enough to require a data protection officer? If so, consult this officer. If not, talk to the legal department. Document that, and you should be legally on the safe side if they tell you to go ahead. An IT specialist is not required to second-guess the lawyers.

Improve this answer
2
  • Thanks for your comment. We indeed have a DPO, but I'm pretty sure he will have to perform a lot of research to be able to answer my question. I'll consider getting in touch with him and the legal advisor in parallel. The more advise I have the better. I need to be 100% sure I've got the law with me if the top management ask me to conduct an investigation of another employee's activity.
    – Ob1lan
    Oct 16, 2019 at 21:26
  • @Ob1lan, if you have a DPO and he tells you (in writing) you are clear, shouldn't that be enough? That's what the DPO is for.
    – o.m.
    Oct 17, 2019 at 4:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .