55

As a background story, I am part of the IT personnel at the company.

The company wants to create a system to automate the invoicing and billing process using our internal system, because at the moment we're doing all of those manually by looking at the transaction history on our system and then copy/paste to an online accounting system service.

Obviously I need access to be able to request an API call to that accounting system online to create the invoice/billing from our internal system. Additionally I need full access to the system to do that (the accounting system we're using is not very good to be able to implement a minimum access policy for this, but it is good enough for us so far).

Consequently since we're using the same system and the same account both for our customer and internal accounting stuff (staff paycheck, bills, etc.), I could see literally everything (we're a small company with <20 staff in the office).

Is it ethically wrong to have a peek at staff paychecks?

|improve this question
  • 2
    Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Jan 6 '19 at 0:31
  • 32
    You are IT; you should implement a system that logs who does what queries. Then you will know whether anyone is using their admin privileges to access what information. Would the existence of such a system change whether or not you would use it to do a particular query? – Eric Lippert Jan 6 '19 at 1:19

14 Answers 14

299

Stop what you're doing and think things through.

You're developing APIs that interact with a live finance system. If things go wrong and you write instead of read or do something to corrupt the system, you could wreck people's lives (and the company for that matter).

Don't do that.

Create or request a separate test system to interface with and use that to develop and test against before attaching to the live system. If this is an online (third party) system, then they should be able to provide you with a test system/account to use for the purposes of development.

Even with a small company like yours, this is really really important.

And don't look at people's personal information - it's morally (and potentially legally) wrong - make sure that your test system has test values in it.

|improve this answer
  • 4
    The context here is the United Kingdom. The OP didn't specify whether their use of "wrong" in the question was technical/legal/moral, so I addressed all uses here. – user44108 Jan 4 '19 at 14:55
  • 47
    In the context of the United Kingdom GDPR is in force, OP should definitely not have access to live financial data. – Josh Jan 4 '19 at 15:55
  • 3
    Regardless of a test environment, somebody is going to have to examine/audit the system on live data. What if there's a slight discrepancy between dev and production? I know somebody who works at a bank and they do test on their own live accounts all the time: assuming staging exactly equals production is asking for disaster. – user71659 Jan 4 '19 at 17:46
  • 36
    @Josh GDPR concerns customer data that makes customers personally identifiable (PII). It doesn’t concern all financial data, nor all customer data, nor even necessarily all financial customer data. And lastly, it does not forbid access to customer PII data. It just regulates it. – Konrad Rudolph Jan 4 '19 at 19:07
  • 5
    @KonradRudolph GDPR doesn't only govern customer data, it covers PII on natural persons. See also my other comment. – Mark Rotteveel Jan 5 '19 at 11:04
82

Is it ethically wrong to have peek at staff paycheck?

Yes, and illegal in a lot of countries. Don't do this, and if you did hope no one will ever know or you risk your job and maybe more.

|improve this answer
  • 5
    Note, there are usually exceptions in the law (or company guidelines at least) for people who need to see this data, usually that means just HR. In a small company with blended roles I can see you falling under this exception but it will mean a big responsibility and probably some extra training. – Borgh Jan 4 '19 at 13:14
  • As OP said, he needs to create invoices not to look at other's paychecks. I don't think the exception will help him there. – LP154 Jan 4 '19 at 13:15
  • 1
    As I read it, he is the one responsible for their accounting software and in most companies you need someone who is able to confirm "yes we transferred (x money) to (y acocunt) on (z date)", ideally the company invoices and paychecks go through a seperate systems but in a smaller company with a single system that might not be realistic. I'd recommend building something where you get a "yes i want to see this" popup before any sensitive information is shown. – Borgh Jan 4 '19 at 13:22
24

I agree fully with the answer of @Snow. Besides that:

  • Never use administrative access to "peek" at things. In 99% of the cases there is no credible explanation that you actually need to look at a real live document as an IT person, unless you need to give support on a specific case.

  • If you happen to come across such information without being explicitly permitted and asked to by the administration of your company, keep it absolutely confidential and never ever talk about it - but inform your boss that some procedure is not OK (see next point).

  • If you have a support role where you get in touch with personal information and your company has not given you a dedicated training/explanation on it, including introducing the person actually responsible for this, then something is severely wrong in the administration. In a well organized company, there is no way that somebody gets in contact with salary information without that being addressed explicitly, including precise limitations and procedure how to handle things, and a form which you have to sign that you understood what was said.

|improve this answer
  • 4
    Regarding your last bullet, I agree that something like that should be the case, but in a small company - especially if also a young one - lots of things that "should" - and in a larger business almost certainly will - have formal policies/procedures/training associated with them don't because there's never been enough time/money to create them. – Dan is Fiddling by Firelight Jan 5 '19 at 0:48
  • Even at a small company, I would expect that the responsible for HR is aware of the situation; it could happen in a less formal way, but I still would expect an explicit handover. – Sascha Jan 5 '19 at 11:01
13

People get fired for this. I even know someone who got fired for not immediately firing someone who was caught doing what you suggested.

Accessing records which you're not authorized to access is trouble. And before you ask, having the ability to access data is not at all the same as having the authority. Forget "ethically", your problem is "contractually" and "legally", either of which carry significantly harsher consequences than "ethically".

|improve this answer
8

Yes. You should only be accessing the data you need to access to do your job, especially when it comes to financial data.

|improve this answer
8

Most companies, looking at someone else's paycheck without having a valid business reason is a reason for immediate termination. Also, many companies log such read access, and there are audits about it.
Because you are in a small company, it seems this isn't tracked or formalized, but there is a good chance that the owner would terminate you anyway if he found out.

|improve this answer
7

Is it ethically wrong to have peek at staff paycheck?

Of course it's wrong.

I'm guessing you already know that. But in case you aren't sure, ask your boss first.

Never use Production. Use a test system with simulated data.

|improve this answer
  • Do not recommend asking the boss. That is very risky advice. – Stig Hemmer Jan 7 '19 at 9:32
  • @JoeStrazzere I would guess the concern is that the boss would say "Sure, it's fine" when it's not necessarily. That answer could be either on purpose or because they don't know better. Whatever the case. However, I think it's still a good idea to ask. Chances are the boss would say "No, don't do it". If they don't, then OP has enough advice here to point that this is not the expected answer, can do more research and then go back and say "Actually, I looked into it and it's a problem because X and Y, but we can do A and B" educates and is helpful. Or maybe it's indeed fine for another reason. – VLAZ Jan 8 '19 at 7:08
  • @vlaz I was thinking more along the lines of the boss saying "Are you out of your mind?" and then transferring the OP to a position where they wouldn't have access to any sensitive data again. – Stig Hemmer Jan 9 '19 at 8:14
  • @StigHemmer I can see that as being a concern. However, I still don't see it as an automatic "don't do that" - first of all, it is probably an unreasonable boss who would do it and second, you have to make the question a bit unreasonable first. If you formulate the question to the boss like "Hey, it's fine to just peek at the sensitive data, right?" then you might elicit an (unreasonable) "NO!" as response. But if you say "Hey boss, while working on X, how do I handle sensitive data?" I very much doubt they go "You're banned from working with sensitive data again!" even if unreasonable. – VLAZ Jan 9 '19 at 8:19
7

Rule #1 of interacting with sensitive data: Mind your own business.

That being said, the central question you should ask yourself before accessing any sensitive data:

What's your business purpose for needing to know this?

Based on your question, it sounds like the answer is "none whatsoever" - it sounds more like you're tempted to look because you can, not because you have an actual need to know about that.

Satisfying your personal curiosity is not a legitimate business purpose.

Even if you are in a position where you have an actual business need to access sensitive data like that, you should do so in the least invasive way possible.

For example, I have access to our company's recruiting platform (and, consequently, the application data for many of the company's current employees, myself included). I could literally look up how the people who interviewed me rated me in my interviews. Guess what? I've never done it - nor will I. In fact, I've never looked up anyone I know personally - in every single case, looking at data on people I don't know has been sufficient.

So yes, it's wrong. Don't do that.

|improve this answer
5

Is it ethically wrong to have peek at staff paycheck?

Yes, and legally.

I would stop and go to your boss immediately with the following:

  1. You're accessing LIVE data and there's a risk you can break it.
  2. You're able to see pay information. Are you able to see PII information as well? If so, I would immediately stop.

You risk not only your job but also legal problems. Maybe jail or a heavy fine. It only takes one person to understand what you're doing and they go to the proper authorities or lawyer in your country and begin the process. You need to email this to your boss and save that email with the following:

Boss, I am accessing an API that shows our staff's PII and pay information. I am able to access this without restriction and modify the data. I need a test bed and not be able to see this data as it is a violation of [insert country's privacy law]

|improve this answer
5

Other than what all the other answers have said about your question, what do you hope to gain by knowing what a colleague's salary is? Do you hope to feel good because you are paid more? What if he earns more than you? You can't use that information as grounds for requesting/negotiating an increase anyway. That information might very well cause all sorts of problems for you on all sorts of levels. Just be let it be.

|improve this answer
  • 4
    This. Ethics and probably law say it's wrong, but even if you don't get directly blamed for looking at your colleague's salary, I can't imagine any positive outcome from this. Most chances are that this would just lead to demotivation, misunderstandings, regrets, judgmental attitude, etc... Some things are better let unknown, for the benefit of everybody. – dim lost faith in SE Jan 5 '19 at 14:44
4

While most answers address the legal and personal ethics, there is also the code of ethics that is established by the relevant professional body/ies in your country or that you may be a member of (personally, I use these despite not being a member).

In Australia, the relevant body is the Information Technology Professionals Association which is the successor of the System Administrator's Guild of Australia (SAGE-AU). The code of ethics produced by this organisation has been adopted by many professional bodies around the world.

There is a difference between coming across confidential information in the course of your duties and deliberately accessing confidential information.

In my opinion, it is unethical to deliberately access information that you haven't been given explicit authority to access. If you are a member of a professional body and they were to find out, then you would have your membership revoked (which could hamper future job applications); if you are not a member then you run the risk of being refused membership if they discover that you have done this (employer or another employee may report you to the body).

As IT professionals, we are entrusted with confidential information (our privilege) and we must protect that information (our responsibility) from all, including ourselves.

|improve this answer
4

I am in this exact situation. I automate the invoicing/payroll for a consultancy firm. I have access to the whole accounting software and API's. This means I am practically in control of all the finances of the company I work for. As an example; I can increase my own paycheck if I wanted to.

First things first. Although you have the possibility to check everything you want. Don't do it when it is not needed. It is not ethical and you gain nothing from it. Only read, access and modify what you got asked to do or what you think you will need. If in the slightest doubt, ask for permission. (Written, always leave a paper trail) My contract, and probably yours will state that disclosing or modifying any of the data will bring in a lot of trouble for me. I cannot recall the exact consequences a.t.m. but I will be fired, fined and a lawsuit may follow.

Second. Do not disclose any information that you find while developing this tool to anyone. Not to your colleagues, family, best friend,... And only report something you have seen to your boss when asked, without an opinion.

Third, not workplace related. As pointed out before. When working on a system like this, you have to work with a second development platform that is identically set up as the system you use in production. But, use dummy data. Especially if you host it locally on your own laptop/pc. In case of theft, hacking,... the company's data is not at risk. You don't want to be the one responsible for a data breach in a company.

Remember, with great power, comes great responsibility.

If you have any more questions about developing such software and about good practices around this, feel free to ask. I've been in this situation for about 8 months now.

|improve this answer
2

Being an IT worker at your company gives you access to data that is confidential, but that does not entitle you to read it. You should treat it no differently than it being a physical file in a cabinet. Just because the filing cabinet is in the same room as you and you have the key, does not mean you should be perusing through it at your leisure. It is morally and ethically wrong, and it may also have legal consequences. Not only would you put your job at risk, but you may be subjecting yourself to prosecution.

You should only be accessing data that pertains to your job. If you do happen to come across confidential information during your routine duties, you must never disclose this information to others, or use it for personal gain. There may also be controls on this system that you are not aware of. You should treat your access as if someone is always looking over your shoulder. You may never know that someone is watching over you until you are being marched out of the building by security, so please keep that in mind.

As others have said, you should look into having a separate server instance with fake data to develop against. As a developer, there is no reason to test against a live system. If something ever went wrong, you wouldn't want to be the one that people are pointing fingers at.

|improve this answer
-3

Depends on what you consider ethically wrong. I for one would be curious and do it when no one is watching, not because it's right or ethical, but because I would want to know if I'm getting shafted with the pay. As the answers above pointed out, I would refrain if specifically requested not to or it's illegal to do so.

|improve this answer
  • 9
    If I find out that you looked at my salary without my permission and without any need I will do my hardest to get you out of the company. I think my boss will agree with this, so I won’t have to work hard. Even more with GDPR. – gnasher729 Jan 4 '19 at 14:00
  • 10
    "Depends on what you consider ethically wrong." - spot on; there are some truths people don't like to hear; like ethics is a personal thing. Legal points are not however - and this would be breaking the law. Anyway, what would you do if you did find out you were being paid less - if you say to your boss "I saw everyones pay and I want more" their reply will be with a boot. – UKMonkey Jan 4 '19 at 14:10
  • 2
    @paulj, OP was told to work on billing/invoicing, not payroll. IANAL, but pretty sure this would be a violation of GDPR – cdkMoose Jan 4 '19 at 18:28
  • 1
    @paulj what makes you think he's a wage slave; do you know his income? As for what law it breaks, as almost every answer here says, GDPR. I'd put money that it says it in his contract too. As for ethically, most would argue that spying on your colleagues isn't ethical. I suggest you read answers and comments before commenting. – UKMonkey Jan 4 '19 at 18:44
  • 9
    '"because I would want to know if I'm getting shafted with the pay." - This is not a valid reason to view sensitive information. This is absolutely horrible advice. If the author has a business need to test something on the production server, the author can view his own information, instead of that of a colleague. – Donald Jan 4 '19 at 21:08