I'm working as full time software developer at relatively small IT company (around 15 employees) which itself is a part of larger group of small to mid sized companies. In preparation for EU's new GDPR directive we (the employees) were given a series of papers to sign. Couple of them include certain statements which I find to go too far in regards to employees's personal responsibility and liability in case of loss or exposure of confidential data.
Two documents in question are roughly translated as: Statement about safekeeping and handling of personal data and Statement about data secrecy. I'm going to highlight the parts which seam odd to me (for sake of accuracy I've tried to translate everything as literally as possible, so please bear with me).
(...) I agree to handle the documents and information which contain personal data with increased attention, and to also take all available measures at my disposal to prevent unauthorized access and reading of documents by unauthorized individuals. If by any means personal data is lost or exposed by fault of mine (intentionally or by not paying attention*), I will be held responsible and I agree to compensate for caused damage.
I'm signing this statement at full moral, legal, yada yada yada responsibility.
* not paying attention is the literal translation of word used. They could opted for word that means "negligence", which is common legal term, but they didn't.
The second document is virtually identical, just replace the phrase "personal data" with " business (or trade) secret" which is earlier in the document defined as basically any company's data I'm working with.
So my question is: are these type of "contracts" common in software industry (sorry if "contract" is not the proper legal term)? Is this normal and I'm just being overly cautious? Perhaps the general sentiment of statements is ok, but wording is bit clumsy? Are there any employee protection laws that prohibit these kind of employee liability (talking about EU, Croatia specifically)?
My primary causes of concerns are these two phrases in combination:
- "take all available measures at my disposal": simply sounds too broad and inclusive to me. I'm junior/mid level developer, developing for ERP system, and have virtually single-handedly implemented modules which communicate sensitive data over the Internet. Given that I'm not security expert (far from it) will I be held personally liable because I failed to implement some security protocol correctly? Surely, I haven't "taken all available measures at my disposal". I ve could read documentation better, asked additional questions on SE, etc...
- "I will be held responsible and I agree to compensate for caused damage": this simply sounds ridiculous to me, reparation from lawsuits for these kind of things can bankrupt whole companies, let alone my puny bank account...