2

I have posted a question over at academia.stackexchange.com (see [1]) which involves a legal question that may better fit here.

Context: I am a PhD student of a german university. Due to illness a coworker was absent for a longer period of time. Therefore the accessibility of employee data was discussed. Most of my colleges including myself encrypt their data, and are therefore asked to hand out the private encryption keys for the case of "emergencies". I am having problems with this, since this would (at the current state of my setup) give access to a lot of private data (emails, some music, etc.) but also enable to "speak in my name", i.e., e.g. send emails from my professional email account, sign documents, etc. So, for a privacy concerned person this is a no-go.

Am I required to hand out my private encryption key to my employer (i.e., certain members of the institute) by german law in this situation?

[1] https://academia.stackexchange.com/questions/142617/am-i-required-to-hand-out-private-encryption-key-to-head-of-institute

  • Are there clauses in your contracts stating that data created under employment is the property of the company? As stated in academia, shared data servers could be used. Are they in use or has this been discussed? – Chris Rogers Jan 9 at 14:56
  • Well, at least I was free to install and configure my computer and have never heard/read/signed that I had to hand out my private encryption key while encryption is something that (almost) all colleges would do. I mean, sharing certain data is a very different topic and something I could live with. It is just the private data that is mostly very hard to separate from the professional data which I am having trouble with. – emma Jan 9 at 15:05
  • You can find a lot of material online regarding the question "is an employer allowed to access an employee's email account?" although pre-2018 advice has limited applicability due to GDPR (DSGVO) changes. The general attitude is that such access would only be clearly appropriate if the employer had forbidden private use. This seems generalisable to your situation. Please disregard comments on the Academia post that fail to account for German cultural and legal context. – amon Jan 10 at 6:59
  • 1
    Note that the problem you encounter that someone may be able to "speak in your name" by using your private key to sign messages is the reason why it is recommended to use different keys for encrypting and signing. That way it is possible to pass the encryption key to someone else (like your employer) to give them access to the message contents, yet still not enable them to "speak in your name" because there is no need at all to give them your signing key. – not2savvy Jan 10 at 10:48
  • @Chris Rogers, I don't think there needs to be a clause in the employment contract (though it may make things clearer). In Germany, a company is required to keep all written business communication archived and accessible. If there is no way to distinguish each email if it has to be considered business communication or not, this means that all email needs to be archived and accessible - which means it must be possible to read all emails. – not2savvy Jan 10 at 10:52
2

This is a very difficult matter, as it touches different parts of laws. IANAL, but I have been trained on several parts of labour law so I can point out some aspects.

What can you do with the computer at work?

If not declared by some agreement otherwise, a computer at work can only be used for work purposes. Your employer supplies you with tools (in this case a computer, in other cases an electric drill or a torque wrench) to perform certain task connected with your job. So, frankly speaking, you may have abused your work tool for private purposes and your employer may have injunctive relief "Unterlassungsanspruch" against you.

There are, of course exceptions.

  • Employers may permit fair use of work tools like telephones or internet access for private purposes. Fair use often has to be discussed for each case, but if you find something in your contract or related documents, it will often be "solange es die Erbringung der Arbeit und den Betriebsablauf nicht beeinträchtigt". Which means, you can call your relatives in urgent cases, but keep it concise, and keep an eye not to hinder your or your colleagues from working.

  • Employers may have signed an explicit agreement "Betriebsvereinbarung" with the worker's council in your case the "Personalrat" concerning fair use of computer, internet and telephone. Ask your "Personalrat" if there are any "Betriebsvereinbarungen" on this topic.

  • Very urgent private issues. E.g. mom is dying, you have to call your brother or you have to respond immediately to an inquiry of the Finanzamt concerning your tax declaration etc. In these cases you probably have to notify your boss concerning this issue.

What can your employer do with your computer?

Employers can do a lot, but not without limitations. The limitations come from "GDPR", "BetrVG" and a lot of other laws. This matter is even more complicated and in most cases involves the "Personalrat".

  • Employers can assume, that only work related things on your computer are stored. Hence he has a right to access and read everything to keep business going. Again here are some limitations. If viewing your files could be used to assess and evaluate your efficiency in doing your work, it has to be agreed with the Personalrat. Ususally there is a Betriebsvereinbarung on the use of IT-equipment and work surveillance. Even more, if viewing your files is done without your knowledge.

  • If you have keys that can be used to impose your identity, the employer has to take care that they can't be abused. Therefor it makes a lot of sense to have keys for signage and file encryption separated.

  • For encryption of work data, the employer can demand from you to grant access to keys. If the keys are escrowed, usually some regulation should exist with the Personalrat (another Betriebsvereinbarung) how they can be used in case of severe sickness or other cases. In most cases this involves the attendance of members of the Personalrat as witnesses when your data is decrypted or read.

Things are mixed up

So, you have used your work tools for private purposes, there's only one common key for encrypting work related data and signing emails etc. This is, while very common at many work places, a real mess.

Let's say, you broke your neck and your employer needs your work results. In most cases, with or without Betriebsvereinbarung and whatever has happened before. If the employer has some reason to believe, that there are private things around your work place (physical or digital) he has to consult the Personalrat and needs independend witnesses when accessing it.

Even more if there was a Betriebsvereinbarung or a permit for you to use the computer for private purposes.

What can you do?

Best thing is to prevent uncertain situations from the beginning. If you have a good connection to your colleagues and bosses, you don't want to put them in a lot of questions of conscience when the need to access work data arises.

  • Find out, if there are regulations in or attached to your contract
  • Find out, if there are Betriebsvereinbarungen
  • Don't do private things with work equipment without explicit permit
  • Separate access to work related data and signage keys where possible (e.g. by sharing all work data on drives with group access)
  • Ask your Personalrat if in doubt
  • Ask a lawyer if in doubt
  • Ask a lawyer if not in doubt
  • Ask a lawyer

Side note In normal companies there's usually a "Betriebsrat" instead of a "Personalrat". If there's no such "XYZ-rat" at all, it might usually wise not to store anything private at the work place, as there is no supervision to monitor the compliance with working laws.

In general, conflicting laws like BGB, BetrVG, GDRP cannot be broken down easily to some sort of priority in many cases, so if the recommendations above do not fit to your situation, ask a lawyer, which may or may not be able to predict what's going to happen when the shit hits the fan.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.