-1

It's well known that you should never reveal your password to anyone -- including your boss, your sysadmin, etc. My friend's former boss has sued her, demanding (among other things) the password to her account on the company's Mac laptop she used for work. (They have the laptop but claim they cannot use it w/out the password.)

I am asking for an authoritive reference to a regulation, law, best practice or whatever for a case like this, where "authoritive" means something more authoritive for a judge than a SE answer -- e.g. a law, a textbook, an Apple manual, a sysadmin rulebook or something along the lines. Ideally, the reference should also state the prescribed practice as "absolutely universal" (or maybe even better) Mac- or EU-specific (the company is in EU).

A related question: are passwords covered by data protection regulations (e.g. GDPR)?

Improve this question
13
  • I doubt there is any such law. You can get a lot of opinions at workplace.stackexchange.com/questions/23388/…, but there's no legal backing up of those opinions there. There are still country-specific laws in the EU, and there are country differences in the obligation to reveal encryption keys to law enforcement.
    – user6726
    Jul 5, 2020 at 23:52
  • GDPR almost certainly wouldn't come into play here, because of the employer-employee relationship and the matter being related to company equipment. Why is your friend against handing her password over? They shouldn't be reusing passwords and if the presence of the password is preventing the company from retrieving valuable information (ie because the user accounts home directory is encrypted using the account password) then there may very well be a case to answer by your friend.
    – user28517
    Jul 5, 2020 at 23:52
  • 1
    @jaam if they want access to the account, thats their right - the account and everything in it is company property - they or a court gets to make the judgement about whats important and what isnt, not the employee and they certainly don't have to trust the employees word on this matter. Again, I ask the question why is your friend against handing her password over?
    – user28517
    Jul 6, 2020 at 0:46
  • 1
    @jaam if the account is encrypted, admins cant override that unless the device management system was in place beforehand. And I dont get the point of you saying "deliberately fooled the court" - its both sides job to disprove the other sides case, the court is never "fooled" because the court shouldnt have inherent knowledge of what is and is not possible in complex situations - its up to the opposing sides to supply that information.
    – user28517
    Jul 6, 2020 at 1:04
  • 1
    @richardb what about law.com/thelegalintelligencer/2019/11/25/…
    – schroeder
    Jul 8, 2020 at 14:44

2 Answers 2

Reset to default
2

You have the right to keep your password secret. But if this causes damages, you can be held responsible for the damages.

Simple example: Your company provided iPhone, worth £1,000, is protected with your passcode. Without that passcode it is literally unusable. You refuse to provide the passcode. If you refuse to provide the passcode, AND refuse to reset the phone using your passcode, you can be held responsible for the damages.

Another example: Your computer, containing your work product that is owned by the company, is protected with your password. If you refuse to hand over the password AND refuse to change the password to 1234 for example, you can be held responsible for damages.

You don’t have to provide your password, but you have to prevent damages caused by this.

Improve this answer
1
  • The main question probably is, what counts as an evidence that a damage has been caused. They said "they cannot use the computer and had to buy a new one". Does just saying this (plus, hypothetically, a plausibly dated bill for a new computer) suffice for an evidence of the damage caused, let's say, in the price of the new computer + 1000$ for whatever work they say they might have done w/ the old one in the meantime? (All the work results, as I understood, are in the cloud so it seems difficult to argue for results that should be only in the computer)
    – jaam
    Jul 17, 2020 at 21:10
1

The GDPR requires the processing entity to apply "Appropriate Technical and Organisational Measures" to ensure compliance. Article 32 says

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, [...]

Article 40 (2) says

Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation
[...]
(h) the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32;

These articles do not spell out directly that revealing passwords is against proper TOM, but in my judgement revealing a personalized password is not in accordance with the state of the art. When there is a technical requirement to share secrets between several individuals, they should be kept in a secure system where each user has an individual, non-shared access that can be logged.

But involving the GDPR that was might not be the most reasonable or constructive solution to the problem. This isn't really a question for Law SE, it is one for The Workplace SE or Information Security SE.

If the laptop contains only business/professional data, help them to recover that data. Meet in a cafe or somewhere like that. Log in. Copy all data files onto a stick. If your friend is the only one with an admin account, have her create another admin user for the company.

If the situation is tense, bring a witness and have the company sign a protocol of what was done and precisely when. This should have been done during out-processing.

Improve this answer
8
  • You aren't addressing the legal question of legal basis for compelling a person to provide a password. OP confused the matter by irrelevantly asking about "best practices" and "Apple mnuals", which aren't legally enforceable.
    – user6726
    Jul 6, 2020 at 16:34
  • @user6726, the GDPR Art. 32 says "Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, [...]" This could be considered a legal reason for not compelling the surrender of a password, since that is clearly not the state of the art in security policies.
    – o.m.
    Jul 6, 2020 at 17:10
  • Doe that mean you plan on editing your answer to be law-based?
    – user6726
    Jul 6, 2020 at 17:15
  • 1
    @jaam, re admin account, depends on the size of the company and their professionalism. A small company might tell an employee to create accounts on factory-fresh computer. Re controller, if there is any customer or employee data on the machine, the company would be the controller/processor and required to apply TOM. An order to hand over passwords may be unprofessional and hence not "good TOM." But I explained in the second part of my answer that going the GDPR route is not helpful.
    – o.m.
    Jul 7, 2020 at 4:55
  • 1
    @jaam the company's claim that they cannot use the computer without the password might be mistaken rather than deceptive. In other words, they might actually believe that they cannot use the computer without the password, in which case they're not lying, they're just incompetent (or, more charitably, ignorant). I used to work for someone who required us to give all our passwords because of similar ignorance.
    – phoog
    Jul 16, 2020 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.