I live in Belgium and I'm working for a government institution as a contractor.
About two months ago I've had to reinstall my (own - but professionally used) laptop that is connected to the corporate "Bring Your Own Device" (BYOD) wifi throughout the day. I reinstalled my computer at home, on my own time. But, apparently, it seems that my laptop's Dropbox has been syncing over the company network (which doesn't seem to be blocked by it) while I was at work and has consumed about a 100 gigs of network-traffic-data in a few weeks time.
Today, I've received a very stern talking-to from the network department saying that this is unacceptable (which I do not deny) and that appropriate action will be taken against me. I've notified the network administrator that this is the first time this has happened and that I will take care not to let it happen any more in the future.
However, I seem to remember that directly identifying a person and monitoring his network activity without good cause (and management approval) is a breach of privacy regulations. Is this the case?
So my question is: Considering the new EU privacy regulations (GDPR and such), to what lengths can an employer go in terms of checking the traffic on the company wifi-BYOD-network?
Note that I'm not looking to harass the organisation, because I was at fault (even though I did not know it at the time) I just want to find out if their course of action is according to procedure.
This is the first time they have notified me and I've never had any of these issues before.
Notes:
- I have full authorization to connect to the network even with a personal device - this is a "bring your own device network", apart from downloading a lot for which the IT policy states no hard limit, I've not breached any official IT regulations.
- We are talking about network usage data (there are no personal files of mine stored on a company resource - I only use their network), I'm very well aware how back-up and sync systems work, I just happened to forget that Dropbox was on and syncing on my own laptop (which I use as part of my job professionally, so it holds meetings notes, my designs, models and such) while connected to the company BYOD-wifi-network.
- This is a government organisation, in a government owned building but the provide a corporate wifi. Their internet access is top tier in Belgium and bandwidth is generally not a problem.
- Things might be different in the UK, but in Belgium internal IT policies certainly do not overrule privacy concerns. Privacy is taken very seriously.
- Here, it is very common for an independent contractor to use their own equipment in addition to the equipment provided by the client. In this case, my laptop is my own professional equipment that I mostly use to take notes and create models. I do most of my "real" work on my client's infrastructure.