Feeds

Employee privacy versus employer policy

US court rulings cast doubt on privacy policy

Mobile application security vulnerability report

Your organisation has a computer and internet use policy. Fine. It's been reviewed by corporate counsel, approved by senior management, and implemented over the years. The policy is comprehensive - it includes policies on expectations of privacy, employee monitoring, and the ownership of corporate electronic assets.

Now, during the course of an internal investigation, you want to read an employee's email, examine the contents of his company-supplied computer, and review his telephone calls made on the company-owned cell phone. You are all set, right? Umm...not so fast.

A pair of recent cases in the United States raise the fundamental question, "do you have a reasonable expectation of privacy at the workplace?" In the United States at least, most people confronted with this question would answer a resounding no, right? I mean, the company policy makes it clear that the computer and network are company property, and that we shouldn't expect any privacy there.

However, there is a genuine divergence between what companies say and what they do. There is also a divergence between what employees regurgitate about their expectations of privacy (corporate mantra) and how they actually act. My own answer to the question, "do I have a reasonable expectation of privacy in the workplace?" – of course! What we really need to do is better define the scope of that reasonable expectation of privacy.

Policy policy policy

In the course of an average day at work, an employee leaves a great deal of "digital detritus" – a trail of activities. The ownership of these digital records, as well as an employee's privacy rights with respect to them is not entirely clear under the law. Employers provide employees with a number of tools that leave a digital trail. This may include their computers, email accounts, internet access, VPN access, regular phone, VOIP service, cellphone, alphanumeric pager, RSA SecurID token, not to mention the video surveillance, and records of badge entry and exit.

Complicating these issues are the questions of ownership, access and rights. For example, an employer may purchase a cell phone for an employee and retain ownership of the phone. Or it may allow the employee to buy the phone, but register it on a corporate plan for service. It may reimburse the employee for all telephone calls made or require the employee to demonstrate the business nature of calls reimbursed. Employees may telecommute from home using either employer or employee supplied equipment. The internet connection to the office may be paid for by the employee or the employer. When logging on remotely, does the ISP have any right to monitor content? When a VPN connection is made, who may monitor what happens on the VPN? May your employer burst into your home, seize your personal computer (that you own, but store some of their files on) and take it?

Privacy in the workplace extends beyond the electronic workplace. For example, can your employer read your personal mail, sent to your office address – even if it is marked "personal and confidential – addressee only?" Can your employer videotape you in the office? Audiotape you? What about in the restrooms, lounges, parking lots, or in your car?

It's easy to say that employees have no expectation of privacy, and even to post corporate policies and notices to that effect. But do you really mean it? And do you really enforce it? The answer to both questions is probably no.

The Power of One Brief: Top reasons to choose HP BladeSystem

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Stick a 4K in them: Super high-res TVs are DONE
4,000 pixels is niche now... Don't say we didn't warn you
Amazon Reveals One Weird Trick: A Loss On Almost $20bn In Sales
Investors really hate it: Share price plunge as growth SLOWS in key AWS division
Bose says today is F*** With Dre Day: Beats sued in patent battle
Music gear giant seeks some of that sweet, sweet Apple pie
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
Too many IT conferences to cover? MICROSOFT to the RESCUE!
Yet more word of cuts emerges from Redmond
Chips are down at Broadcom: Thousands of workers laid off
Cellphone baseband device biz shuttered
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.