0

We have a Data Protection Officer who is quite senior; and should, on paper, know the intricacies of EU/UK Data Law. However, they often make questionable choices that are challenged by other colleagues, many much more experienced than the DPO.

Our DPO is also our CISO, and in response to a single employee (out of thousands) potentially exporting PII (accidentally) to a personal device, has asked for a policy that I find intrusive, and concerning. The CISO/DPO is notoriously dismissive and usually doesn't reply to emails/phonecalls; so before challenging the policy I would like to be sure of my position.

The request is to create a mail-flow monitoring that would capture any emails sent externally containing a photograph, and BCC them into a mailbox monitored only by the DPO/CISO. Our employees would not be aware of this activity, and we would not be able to audit what the DPO/CISO has/has not seen in this mailbox (limitation of the technology).

Not only do I find this intrusive, I find the response entirely disproportionate to the actual incident.

On what grounds, if any, do I have to challenge the intrusiveness of this?

Are employee's entitled to any reasonable right to privacy within an organisation, within this context?

N.B, I do not have the option of approaching the DPO/CISO and discussing directly.

  • 3
    If you really want to kick up a fuss about this one, you need to talk to an actual lawyer. However, there seems to be a simple solution: use your work e-mail only for work purposes, then there's no problem. This is what you should be doing anyway, so... – Philip Kendall Feb 16 at 10:57
  • You can get eveyone to attach benign images to every email they send ... that mailbox will be so full so fast he won’t know what hit him... As you are in the UK you could check with Citizens Advice, but this is probaly a minefield and may end up in court to provide a Stated Case... – Solar Mike Feb 16 at 11:20
  • 2
    "Our employees would not be aware of this activity" may be very relevant - depending on jurisdiction it may well be the case that this is permitted if people are properly informed about it, and absolutely illegal if (as in this case) you attempt to hide it from them. – Peteris Feb 16 at 22:00
  • 1
    @Peteris the Jurisdiction is the UK, and you are correct that not notifying them that it at least may be used for such purposes is illegal as per the Data Protection Act. – 520 says Reinstate Monica Feb 16 at 22:05
  • 1
    @Neuromancer there are a few possibilities. The first is that the PII data in question was photographic by nature (eg: a document scan). Another is that they already have a keyword system in place to catch text-based exfiltration, which can be bypassed by using images instead. Given OP's description of the CISO, they sound like the kind that would implement measures that get in the way of productivity quite a lot, so some employees may try to find ways around what they perceive to be 'bullshit' measures, hence the use of pictures. – 520 says Reinstate Monica Feb 17 at 1:28
2

There are many laws surrounding privacy; your employer monitoring your actions on work devices/services doesn't break any of them.

Your work devices and services are owned by your company and not you. Therefore they are the ones with the ultimate rights to do what they like with these devices/service, not you.

Your CISO/DPO made the right choice to make this a policy; while this may have been an incident with a single employee, that is enough to have your company screwed hard by GDPR among other privacy laws. The fines for being in breach of these laws are enough to end a company. You may also recall that the leakage of hundreds of thousands of taxpayers' PII (also in the UK) was also a case of a single employee doing something they shouldn't.

Most places tend to have the fact that they reserve the right to monitor device/service usage as they like in their Acceptable Usage Policy. This is probably something already in your contracts. They are not required to admit that they actually do this kind of monitoring.

  • all correct and straightforward – Fattie Feb 17 at 14:02
1

In most companies, sending private emails, for example during your lunch break, is permitted. And even if you are not permitted to send private emails, private emails are still private emails. Most over the EU, reading your private emails (even those that you were not supposed to send) can get the company into trouble.

Collecting all my private email, without a specific reason, without telling me, and making them accessible to that one person, that's a massive intrusion of privacy, and if that happened at my company and I found out, there would be hell to pay.

Now Fattie's answer is different, but the question to the company and your DPO is: Do you feel lucky, punk?

  • The question isn't relating to private emails but emails sent from work email addresses, which your employer will have significantly more legal control over, even in the EU. – 520 says Reinstate Monica Feb 16 at 22:01
  • I can send private emails from my work email address. Maybe I shouldn't, but I can, and they are private, and if the DPO reads them and I find out, he is in trouble. – gnasher729 Feb 17 at 1:12
  • You can, but it will be subjected to the same monitoring as your work emails. The employer is not required to differentiate between work and personal emails (which would be an insane requirement for the business; how could they possibly work that out without monitoring or reading the emails in the first place?). – 520 says Reinstate Monica Feb 17 at 1:19
  • That's exactly the point: The employer does not have the right to look at private email without a good reason. The "insane requirement" for the business is their problem, not mine. What this DPO suggests is ridiculous, because of these problems. – gnasher729 Feb 17 at 10:46
  • "In most companies, sending private emails, for example during your lunch break, is permitted. " This is wrong, Gnash. (Obviously you can do that on another email account, your own.) The overwhelming majority of companies do not offer private use of company email. I even quoted the relevant EU regulations/law/whatever (in the EU, they never quite clarify "what any thing is", but there it is!) – Fattie Feb 17 at 13:57
1

You are right to be concerned

It strongly appears that your Data Protection Officer has a "conflict of interest" in the duties he is performing here.

To be specific, article 38(6) of the GDPR states:

"6. The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests."

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL

And the supporting guidance from the ICO states:

"Basically this means the DPO cannot hold a position within your organisation that leads him or her to determine the purposes and the means of the processing of personal data."

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/?template=pdf&patch=248#link19

For the avoidance of doubt, employee data is fully in scope for GDPR (article 88).

Essentially, the role of the DPO is to be an independent arbiter within your organisation. They should certainly not be rifling through photos sent by employees, and definitely not doing so alone in secret.

What you actually do about this (escalate to management / HR, or some other route) depends very much on your organisation. You might want to (without mentioning any of the decisions he has made or your concerns about them) simply highlight to him the organisational risk of the DPO not being independent, e.g.

"I was looking through an article on the GDPR the other day, and it said that the Data Protection Officer should be someone independent. I'm a bit concerned that we should make sure we have someone independent, so we don't get into any problems with audits", and maybe, if he is still dismissive, forward some of the quotes above.

Once you have an independent DPO in place, you can then raise your concerns about the specific policy to them.

-1

Are employee's entitled to any reasonable right to privacy within an organisation, within this context?

There is absolutely no "personal privacy" concept related to "work email".

(Note that - apart from anything else - every single work email and communication is, of course obviously, stored and kept and can be reviewed at any time. Adding a flag for image items is no different.)


https://edps.europa.eu/data-protection/data-protection/reference-library/private-use-electronic-communications-workplace_en

It reads "where limited private use is allowed .. such and such" and "Limited private use of these tools is often permitted..."

There's absolutely no guarantee or even expectation that a particular company X will offer private use of company email.

  • 2
    You are wrong, in Europe you can have a reasonable expectation of privacy even if you use your work email for private communication. – Mark Rotteveel Feb 16 at 17:01
  • I believe that is totally wrong, Mark. The act reads "where limited private use is allowed .. such and such" and "Limited private use of these tools is often permitted..." There's absolutely no guarantee or even expectation that a particular company X will offer private use of company email. (Don't even mention that it is absolutely trivial to additionally have a private email.) – Fattie Feb 16 at 17:06
  • 3
    Well there is engadget.com/2017/09/05/european-court-work-email-monitoring (judgement) which at least requires upfront announcement of monitoring and scope of monitoring. And I believe there have been other cases. – Mark Rotteveel Feb 16 at 17:09
  • yes, the OP does seem to be totally informed about the monitoring ... – Fattie Feb 16 at 17:36
  • That is true, but I believe there have been further cases refining what a company can and cannot do with the information collected through such monitoring. And on a related note, I vaguely recall a case in the Netherlands where the judgement was that given a lot of private/personal things can only be handled during office hours, employers cannot forbid reasonable private communication during working hours. I might be wrong on both though, as I haven't located good sources yet. – Mark Rotteveel Feb 17 at 9:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.