Engineer's bosses gave him printout of his Yahoo IMs. Euro court says it's OK In case anyone doubted that their work communications can be legally monitored by their bosses, the European Court of Human Rights has now ruled that employers can indeed spy on online chats. The continent-wide ruling came at the end of a case involving Romanian engineer Bogdan Mihai Bărbulescu, who was dismissed in 2007 for …
> "[T]he court finds that it is not unreasonable for an employer to want to verify that the employees are completing their professional tasks during working hours."
Reading between the lines, it seems he was taking the piss a little bit.... had he just had a few short IM exchanges a week with his fiancée, along the lines of "I'll working late tonight, so hold dinner. X", there probably wouldn't have been a problem. As portrayed in the article, it sounds like he wasn't doing his work.
[I tried to follow the link, but it doesn't lead to an article]
Had the company policy been in place through fear of confidential company information being sent to unknown 3rd parties, they would have taken pre-emptive safeguards against IM and the like.
This post has been deleted by its author
Anyone commenting on a Reg article who believes that they have any privacy expectations when using a work pc in work time needs to quit and get the hell out of IT as they are obviously too dumb to understand reality.
The fault here is the muppet who worked for a firm with such a draconian policy and then violated it.
As others have said I suspect they were looking for an excuse for other reasons.
I have had a great many colleagues who had absolutely no issues running their entire private life via work email. Funny cat video to share? Who broke up with whom? A heavy night on the tiles last night? Hate your manager? They had absolutely no issue using work email for personal matters. And if they moved company they just told everyone they had changed email address and presumably it went on...
I have never understood it. Work email is just that, work email. I have absolutely no issue with an employer reading my work email, they pay for it after all and provide it so I can work. They can expect it to be used for work. I'll use my personal email for my private life.
That said, I wonder how relevant a case such as this still is. I bet most people currently use a mobile phone for private comms, not their work desktop.
>I bet most people currently use a mobile phone for private comms, not their work desktop.
Exactly. This story begins in 2007, when smart-phones as we now know them weren't yet ubiquitous (and, more importantly perhaps, mobile data tariffs were still on the pricey side even for those with the handsets).
If he wanted to be really sly in this day and age, he could use a Bluethtooth keyboard equipped with a device-selection switch, so he can quickly change between typing into his desktop and into his phone.
Quite. An employer asking that you do your job doesn't seem unreasonable, and a reasonable employer would factor in the occasional email etc., for private issues arising.
A couple of years ago there was a TV documentary looking into the differences between German and UK productivity rates. Part of the process involved transplanting a worker from their home country to the corresponding German/UK counterpart. The observations I remember were from the UK guy "The Germans are very focussed" and from the German chap "They are always checking their Facebook and Tweeting".
Ahem.
"An employer asking that you do your job doesn't seem unreasonable, and a reasonable employer would factor in the occasional email etc."
Few people are so stupid as to not stop doing this sort of thing if they're warned (which makes me think he wasn't), let alone to actually appeal to a court if they _know_ they screwed up badly. This happening in my back yard I have a better-than-most idea about what _some_ employers around here are willing to do just to flick off someone they no longer have a need for and / or someone who might not bow to their potentially demented demands without some resistance. I have some horror stories to tell (the law says you can't hire anyone for a while if you fire someone without faulting him for something, so firms love to do that when they want to downsize) - only in this case my colleague actually won the case; but it sure wasn't pretty.
So yeah, the bloke might just have talked way too much - but my money is on him simply being disposed of unreasonably, using the first excuse they managed to find: it would also explain him getting pissed enough to sue.
Have an up vote... Having been both an employee (IT manager, in full control of all IT infrastructure) and an employer. I say... One is employed to do a job, not fuck around on the Internet.
A quick chat with the partner.. "Will you be home at usual time?", "What you fancy for eats?" is perfectly acceptable imho. But lengthy use of the employers facilities to talk trivia and post to social media is out of order.
And before any of you think I was nasty, I gave quite a few polite, off the record warnings to several staff that browsing porn and using the internal email system to share what many would call offensive imagery was a bad move. Never once did I have to report an employee to my superiors or dismiss anyone for abuse of business systems. I found a friendly smile and a warning was enough.
" off the record warnings to several staff that browsing porn and using the internal email system to share what many would call offensive imagery was a bad move. "
Yes, well here in NZ that would count as no warning at all - if you dismissed someone because they carried on doing whatever you objected to it would be you that ended up on the wrong side of the ensuing dispute.
An 'off the record' warning does not cut much ice with the employment tribunals here and you would end up being fined for unjustified dismissal, lost wages and emotional hurt because you didn't follow proper procedure - you could even be directed to take the person back into your employ.
"An 'off the record' warning does not cut much ice with the employment tribunals here and you would end up being fined for unjustified dismissal, lost wages and emotional hurt because you didn't follow proper procedure - you could even be directed to take the person back into your employ."
Every jurisdiction is different. In the US, porn at work creates legal risk of a sexual harassment claim because the claimant only needs to show a "hostile environment" and coworkers viewing porn would easily be seen by a jury as such. Therefore viewing porn at work could easily lead to immediate termination in the US and a written warning could even bolster a sexual harassment claim by documenting the hostile work environment. Organizations defend themselves by swiftly ending the actions that create a hostile environment. A written warning could be construed as swift corrective action, but if the claimant said that the hostile environment continued (either that worker continued to view porn or others did so) then the written warning could look like the company failed to take swift corrective action.
Now, IM'ing with someone, checking sports scores, or posting pictures of cats would not be as serious, because it creates no additional legal risk. However, many US employers refer to this as an employee theft issue (they call it "time theft") and US employers can usually terminate anyone for any reason (or without reason). The only way a terminated employee could bring legal action is to allege that the employer violated one's civil rights (e.g., "I was fired because I'm a woman." or "I was fired in retaliation for being a whistle-blower.").
I'm sure the US lack of protection against termination seems risky in jurisdictions with more protections, but the fact is that few people are terminated capriciously. The largest causes of unemployment are market/labor shifts (the US shed a net 230,000 manufacturing jobs over the past 7 years), technology (which may arguably eliminate a lot of jobs soon -- in a world of self-driving cars, how sure are you that your job cannot be partially or fully automated?), and business cycles.
Yes, but any employer in NZ - and in fact also in the UK and Australia - would take it to a formal warning if the behaviour wasn't modified.
Also, if your contract said that you were not allowed to browse porn at anytime and it would be grounds for instant dismissal if found, the "friendly warning" doesn't really matter in that instance.
Wow, NZ employment law must have changed some since I was last there :)
A verbal warning is a verbal warning. Usually only comes up when a written warning is made, in reference to the employee already being told about the infringement.
If what has happened goes over certain limits, you totally can fire someone on the spot and eject them from the premises. Usually only when there's a physical threat or the cops have been called.
However, most of the "firings" I've been party to one way or another in NZ almost always went out of there way to sidestep official procedures. Either people just had their hours cut, there was a "mutual agreement" for someone to leave, or the evidence against the employee is presented, and then they disappear. Actually going through the hoops to fire someone for cause is nearly impossible.
My friend ran a pizza franchise for a couple of years, and couldn't fire one little prick. This prick was a fairly useless employee, gave away/stole stock, harassed other employees, and was possibly dealing as well (mate found a couple of fifty bags left in the work fleece). But the prick's mum was an employment lawyer, so any attempt to negotiate or formalise these issues (about a $15ph position) resulted in $400 per hour lawyer goodness.
So you get shits who use the full weight of the system to defend themselves. On the other hand, NZ (esp hospo) is super mega shitty in employment matters. Not paying people holiday pay and short change shifts are far too common, and if you even think the word "union" then you suddenly end up short of hours.
<i>"But lengthy use of the employers facilities to talk trivia and post to social media is out of order."</i>
I'm with you on that ... which makes RBS's decision to roll out Facebook internally as a 'collaboration tool' utterly baffling, since that platforms purpose is to talk trivia.
So the evidence produced was evidence of not doing something (ie work). Surely there must be better methods of proving that than resorting to eavesdropping. For example, maybe the fact that he wasn't doing an work would be better evidence.
Looks like a slippery slope to me.
Sacking someone for using corporate devices for personal use seems a little harsh, unless he had been repeatedly warned for previous policy breaches or was divulging sensitive information. Was this a convenient excuse to be rid of someone who's face "didn't fit"?
On the other hand, the fact that he took his former employer to court for breaching his right to privacy rather than unfair dismissal would suggest he was bang to rights...
Thinking about this, will this mean the death of BYOD?
Not that I have ever been in favor of this anyway, but it does bring up the possibility of some legal issues with regards to employee devices being used for work purposes.
For example some unscrupulous employer, could demand access to a personal device under the guise of "Just checking on your work".
Just a thought.
Actually it might hasten BYOD adoption.
Done right, with sandboxed apps (e.g. Good) then your devices personal uses have no connection at all to your employers. Which is (for an employer) a much better position than supplying a device, and then having to trawl through the inevitable tangle (I'm as guilty as the next) when employees find it more convenient to use a work device personally (because no one likes carrying two phones).
@kwhitefoot: Absolutely. I can't understand why people are apparently okay, or even ecstatic with BYOD where the 'YO' literally stands for "your own," as in "what you personally bought and use." I could imagine a smartphone vendor implement a BYOD strategy where they demand all prospective employees buy a specific ($2000+) model that is then enrolled into BYOD, and with that, you lose all rights to it and relinquish it at time of termination. Loss, theft, failure, etc., are all covered by employee. They could run a very profitable scam for quite a while (7 billion people to go through), and it would probably be legal in a lot of places.
FWIW, BYOD is okay(-ish) if the employer allows you to choose the device, but only if they are the ones who actually foot the bill.
Am surprised this did not get rejected by the ECHR...what a waste of time and money.
When you join a company you sign a contract. The vast amount (if not all) of these contracts state the digital policy in terms of disciplinary action. Most will state that company kit is for company use as well as what would be deemed appropriate kinds of communication.
Unless the contract is illegal there is nothing for the company to answer to.
On the ICO's site, they used to have a decision tree for employers examining correspondence. Essentially it amounted to "once you determine it's personal, you stop looking at it" (so you're supposed to be able to tell it's personal, but not actually what it's about). Typically can't find it now, but I think it was related to either RIPA or PERC, so I guess it depends on where you are ...
Are you thinking about this?
https://ico.org.uk/for-the-public/employment/ which now only leads to https://ico.org.uk/media/for-organisations/documents/1128/quick_guide_to_the_employment_practices_code.pdf ?
Also
http://findlaw.co.uk/law/employment/other_employment_law_topics/employer-look-at-my-emails.html
The Court has repeatey ruled that employees private communications are just that, private. This seems to be the Court undoing some case law, or at least drawing the line to say that comms are only private when clearly personal and permitted.
It's certainly not a waste of time, it's a significant clarification of the right to a family life.
Completely reasonable IMHO that the company can look at traffic going through its own technology if there is suspicion of illegal content, or other suspicion of malign activity. Many bar or have policy agaist personal messages from work in case they become percieved as company policy or put the organisation or brand at risk of disrepute.
If he has IM for professional purposes he should expect it to be monitored anyway regardless of his use for private conversations. no different from phones that are always recording conversations etc.
I also suspect there is more to it, but the defence option here seems laughably weak if he does not expect his comms monitored through a solution provided to facilitate his work regardless of who he is conversing with.
I assume the usage was excessive but usually you would expect a couple of warnings before dismissal, at least in the UK (unless he was leaking corporate/trade information for example)
I'd guess a global/root certificate in the base image on the machine used to decrypt or something similar? Honestly, I've never looked into this sort of thing that hard, but this is what riled people over the Lenovo (and was it Dell?) spyware shenanigans.
Anyone else got a better solution? I suppose it's not impossible that this was long enough ago where Yahoo IM wasn't HTTPS'd, which might not have been that long ago.
Forgive me if I'm reading that wrong, I've been up for over 24 hours, arf.
Steven R
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
