10

If a company sets up computers in a break area for employees to access their timecard, payroll, bank accounts, etc., can the company get in trouble if an employee leaves their private accounts logged in?

5
  • 6
    I think there is a general assumption in the answers here that if someone leaves login credentials on a shared PC they have used, then that person has been careless. But browsers can be configured to save passwords without asking, so one of the shared users might enable such a setting, then the victim could log in to their bank and log out again, but their password would still be saved on the computer. In that circumstance, the victim has not been careless. (There's also the possibility of keyloggers, but a browser could plausibly be misconfigured without malicious intent.)
    – kaya3
    Mar 22, 2023 at 23:35
  • 1
    @kaya3 Most IT professionals would strongly advise against using a shared or public PC to access your bank account or other personal accounts. So there is an argument there that supports the user was being careless. Mar 23, 2023 at 14:29
  • @kaya3 Leaving aside the issue of someone leaving a computer actually logged in to their bank account, keyloggers or browsers saving passwords is not usually an insurmountable issue with online banking since banks (at least all banks I’ve dealt with) require more than just a username/password combo to log in. 2FA has been the rule with banking for over a decade (mine had it nearly 20 years ago), and if the user leaves behind not only their credentials but also their "FA authenticator, then they are definitely being careless. Mar 23, 2023 at 16:30
  • 2
    What are you supposing happens with those accounts logged in to make it so there are any damages? Mar 23, 2023 at 17:14
  • It depends upon what happens next. Why make us imagine every possible outcome?
    – ohwilleke
    Mar 24, 2023 at 22:12

4 Answers 4

14

The party providing the computer, ISp connecting the computer to the internet, or manufacturer of the computer would not be liable. A person wishing to sue for damages would have to establish that the defendant was negligent in their action. The underlying premise is that all parties have some obligation to all other parties to care, to some extent. The inquiry ask haw a reasonable prudent person would behave in this context when pursuing their goals to avoid harming others. A reasonably prudent person would not provide a rack of sharp carving knives on the floor of a daycare center. A reasonably prudent person would provide a rack of sharp carving knives on a work-table at a fish-cleaning business. In both cases, it is possible that a person might cut themselves. In the daycare center, the toddlers on the floor are not assumed to share any of the burden of care, in the fish-store, the employees are assumed to share some of the burden of care.

The ISP knows that it is possible that a person will harm themselves when they surf the web, but that does not make them liable for damages when an irresponsible party deliberately and knowingly connects to a nest of viruses, likewise the computer maker. The alternative is that providing an internet connection always makes you liable, or building a computer: that would be the end of SE. Two parties can significantly and reasonably mitigate the risk: the bank, and the customer. The customer can either decline to use this unsafe computer, or they can take precautions, in particular remembering to log out. The bank can also do certain things without harming their interest: providing ample warnings (which they do), or automatically logging a customer out after a period of inactivity (a metric of the fact that the customer just up and left). Banks do that too.

The only control that could be reasonably be expected from the company, short of simply not providing a computer in the break room, would be filtering to prevent any access to certain kinds of web sites, such as porn sites, banks, or SE. Filtering for the first type of site is overall consistent with reasonable company objectives (which is to accommodate reasonable employee interests in accessing or transmitting information during the work day). Given the reasonable goals of the company, the jury would not likely find that the company had breached their duty to the employee. The jury balances these interests of the parties, and would determine that the company could not be expected to filter out connection requests to banks, and that they can reasonably rely on prudent actions by the employee and bank to prevent whatever happened.

4
  • Does the last paragraph imply that companies are expected to filter porn?
    – user253751
    Mar 22, 2023 at 23:30
  • I've seen too many incredibly stupid jury awards to believe that the Reasonable Man doctrine exists, or has existed, for decades.
    – RonJohn
    Mar 23, 2023 at 1:04
  • 1
    Since you are assuming the existence of a "Jury", you may want to tag it with a specific legal system/juristiction that has "Jury"s.
    – nvoigt
    Mar 23, 2023 at 5:49
  • How are you even answering this without a location?
    – Davor
    Mar 23, 2023 at 13:16
5

The usual question for questions like this, "what legislation?"

When a company sets up IT infrastructure for use by their employees, it may have to take steps to assure that no personal data is stored there outside established procedures (which would go against the purpose of a break room computer). It may be sufficient if they post a sign, "do not leave personal data," or make the employees read and sign a policy to that effect.

But all this will not excuse the employee from taking care with bank credentials.

2

As far as I know, providing a computer for people to use does not make one liable for subsequent theft due to people using that computer carelessly. If the computer stores passwords so that a subsequent user can easily access an account there might be liability. There are ways to safeguard against this.

Similarly, if I let someone borrow my car, I am not liable if they take it to the mall and leave their wallet in it and the wallet is stolen in the parking lot. If the locks don't work and I didn't tell them I might have liability.

1
  • For negligence there had to be duty of care.
    – Trish
    Mar 23, 2023 at 17:53
-1

It probably depends on the details of how this public computer is set up. As someone mentioned in a comment, browsers will often save credentials, so even after you logout of the bank account, those saved credentials might be used.

Modern computers and browsers can be configured to a "kiosk" mode -- this is commonly seen in public computers found in hotels, for instance. The user first has to login to the public computer before using its features, and log out when they're done (there's also an idle timer that automatically logs out in case you forget).

It's also possible to configure the browser not to save credentials and auto-fill data. That will suffice for login forms, but you generally can't disable saving credentials used in HTTP authentication (this has to be sent in every request, so requiring the user to re-enter it would make the website unusable).

IANAL, but I think if the company failed to implement such basic, industry-standard safeguards, they could share some liability.

3
  • The company setting up the computer is a third party. You need to establish a duty of care to have negligence, this does not.
    – Trish
    Mar 23, 2023 at 17:52
  • @Trish isn't there a duty (at least arguably) on the part of someone providing tools for others to use to maintain the tools so they can be used safely? Why do you think that someone providing a computer to their employees, in part for the purpose of accessing bank accounts, has no such duty to the employees? What is needed to establish a duty of care?
    – phoog
    Mar 24, 2023 at 10:47
  • @phoog can be used safely for the intended purpose. There is no duty of care to make sure that a screwdriver works as a sledgehammer. The bar of Duty of Care is high and the answer should elaborate on where it comes from. It does not.
    – Trish
    Mar 24, 2023 at 11:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .