How do I prevent my manager from abusing a contract specification that breaches my privacy?

Question

I'm employed as a software developer. In my country the employer is not allowed to monitor your activities due to privacy laws. However, due to the nature of some of our clients, our company is allowed to do this due to security reasons. It's specifically stated in my contract that the company can monitor our network activity for security reasons. I accepted this when I applied for the job as I can see why this could be important.

However, my manager has a lot of trouble managing the employees and tends to cause more problems. Our boss seems to like him so there's not much we can do about that. This makes addressing this problem to a position above my manager less likely to have an impact.

My manager often does not know what to do so he tries to make sure we're always working hard on our jobs. This in itself is not a problem. But the methods he uses are unethical. He uses software to forcefully take over our computers from a distance and browses through what we're doing, what browser tabs we have open etc.

While the contract says the employer is allowed to breach a certain degree of privacy due to security reasons, I feel like he's abusing this to an extreme extent and for the wrong reasons.

How can I prevent my manager from abusing this exception in the work environment?

Answer 1

Monitoring Internet access and employee acitivity on security breakpoints for security reasons is prudent and necessary, and thats why it's allowed.

Another thing you mention, which is not only not necessary, but also highly unethical and I'd hazard also illegal (IANAL, consult a lawyer specialising in employment law for this) is that he has remote access to your computer. This means that he can do stuff under YOUR identity - stuff that YOU would get blamed for in audits or criminal investigations.

You need to bring this specific concern (the taking over your computer) to your boss asap. If he doesn't cooperate, bring it to your boss's boss. If he doesn't cooperate either, get a lawyer, and go looking for a new job.

There are also much better and less intrusive ways of finding out internet traffic and/or history without taking over the computer.

Answer 2

If security is such a concern that your company has special contract terms related to it, there should be a network security group to look after it. Because security is a major concern, they may have more organizational power and influence than you do.

It might be worth discussing your concerns with them.

They have an interest in people not accessing computers they do not need to access to do their job. The more people with access to information the greater the risk of leaks and the harder it is to track them down. Your manager's ability to "take over" a lot of other computers is a security risk. Breaking in to your manager's account would be a doorway to many computers.

They also have an interest in the security-related contract provision not being misused, because misuse might make it harder to preserve and enforce the provision.

Answer 3

He's not abusing it, he has the capability which you have expressly given permission for, and he's using it. I can see how this would be annoying, but it's something you could learn to live with and will probably have to.

Using it just to keep employees on their toes isn't the best use of the capability. It could for instance be very disruptive when people are deep in working on something complex. So unless it's mandated by company policy it appears your manager has too much time on his hands. I have seen some pretty strict company policies in my time though, in which the manager is held responsible for any breaches, where monitoring of activity is done on multiple levels, mostly without the employee noticing.

But there's nothing you can do about it that won't make you seem guilty of trying to conceal something. Even arguing that it is interfering with your work isn't a great idea. Because even a mediocre manager is well aware of that fact.

Possibly your only realistic recourse without trying to organise a mutiny is to ask people who have been there longer and presumably have more knowledge whether it's a company policy or not. At least that way you might get some information without rocking the boat with your manager.

Answer 4

He uses software to forcefully take over our computers from a distance and browses through what we're doing, what browser tabs we have open etc,.

Who watches the watchman?

Your manager can do whatever he wants on your computer, in your current session, with your digital identity. How safe is that? Is the manager's computer provably secured against malware? Is the manager provably competent to not do anything harmful, for which you would be blamed because the audit shows your account responsible?

Answer 5

In my view, companies have a right to know what employees are doing. They are, after all, paying the employees to do certain things, and it is reasonable to want the ability to verify whether the employees are actually doing these things. There is nothing inherently unethical about using tools to monitor what employees are doing on company time.

Aggressive monitoring is not necessarily a great idea, as it communicates a lack of trust in employees and may interfere with their work. Certainly what the boss is doing in this case doesn't seem advisable. It seems disruptive, while also harming employee morale. But I would argue that he is only guilty of being an ineffective manager, not unethical (the question of legality in this jurisdiction aside).

Whether they are illegal in your specific jurisdiction is a much narrower question (which we can't answer, not being lawyers and not even knowing what country's laws apply). I personally find it mind-boggling that a company monitoring employee use of its own resources can be illegal due to "privacy", but there you go.

So, what to do?

• I would not object on the basis of my privacy rights being invaded. Since I don't think that I have such a privacy right in the workplace (whatever the law says). Plus, "How dare you intrude on my rights by checking whether I am working!" just doesn't sound great, even if you have a legal basis for saying that.
• A business argument against the monitoring would be the strongest basis for objecting. You have a much stronger case if you can argue that the monitoring is harming the company in some way.
  • If it is interrupting your work, raise the reduction in productivity as an issue. "This is costing us money" is usually the best argument you can make, particularly if you can back it up with evidence.
  • You could also raise the morale issue, but it is trickier. You could tell your boss "This monitoring is making employees unhappy, because we want to feel that we are valued and trusted", or some such argument. However, with this argument your motives are likely to come across as self-interested, even if you are stating it is for the good of the company. "Give us what we want so that morale will be good" will often be heard simply as "Give us what we want."

Answer 6

IANAL but to me take over your PC is a stretch from "monitor your network activity for security reasons". It has gone beyond monitor, security, and network in my opinion.

Remotely take over a PC to the level you are locked out is clearly beyond monitor by any reasonable interpretation of the word in my opinion.

It indicates we can have a coffee break. As we can't use our pc's for that moment.

Shutting you down is beyond monitor and is just plain not productive.

If a principal comes to classroom to monitor a teacher and takes the chalk from the teachers hand and goes through the desk that is beyond monitor.

Can you do much? Maybe not. Is it really worth the battle of trying to get it shut down? He will still be an ineffective manager, with a boss that supports him, and you are the one that took away his favorite tool. The path of least resistance is to just accept it.