5

Some company policies include the possibility to monitor their Technology for security purposes when employees utilize it, including monitoring software to scan and review Company material stored, sent and received via the Company's network.

I assume that this means that all the files and folders which are synchronized within a service the employee access to with the company credentials (e.g. One Drive) can be monitored, as well as the content in the cloud itself.

That said, does this also apply to files and folders which are stored locally (not synchronized with any of the mentioned file hosting services)? May the company have access to them?

6
  • 5
    Yes & that is a common practice to have some monitoring. Whether it is legal or not - I do not know.
    – Dmitrii Z.
    Mar 31 at 10:37
  • 7
    It's their equipment, their data and you are their employee. In case you have data of private nature on your work-computer, you MAY have violated certain policies in case they are stated in your contract and are also enforced in reality. Some companies cut their employees more slack, some are really strict - especially when IT-securitry is an important factor..
    – iLuvLogix
    Mar 31 at 10:42
  • 13
    This is country-specific. If you are in Germany, say, and private usage of your laptop is explicitly allowed, then the answer to your question would be no. In most countries, though, data protection (and employee rights generally) are much less strict. Mar 31 at 11:24
  • 4
    In Germany, if my boss needed some business related information on my laptop which is not supposed to be used privately, he could look for the information but would have to stop reading as soon as he realises it is something private, and he wouldn't be allowed to use that private information in any way. And he wouldn't be allowed to look into a folder named "private" even if the laptop isn't supposed to be used privately.
    – gnasher729
    Mar 31 at 14:40
  • 2
    Casting a fourth and final close vote here. The core of the question appears to be a legal matter which may be on-topic here if defined clearly but it would require a location to provide useful answers. If you are more asking about the ethical side side please rephrase the question accordingly in an edit.
    – Lilienthal
    Apr 1 at 7:49
20

If it's company equipment then it's normal for a company to have the ability to search the hard drives and folders or dismantle the whole machine if they want and search for contraband.

This can even be done without the employees knowledge after working hours. In my experience this is the best way for more routine investigations where it's more about checking a machine off a list than a suspicion.

In terms of a more solid investigation it is common practice in some industries for security to walk into an office and physically take the machine from in front of a worker without prior warning. Or escort the person out while IT personnel either take the machine or investigate in situ. This is done to mitigate against someone quickly deleting evidence. Usually if that happens all your passwords to company mail, network resources etc,. are also changed.

If you're on a LAN (Local Area Network), then it's possible that sysadmin has access to your whole drive without ever needing to leave their office. It's just a matter of a network share and can be done without your knowledge.

If it's personal equipment off premises then no, a court order would be necessary to seize the machine or order you to turn over the information. If it was personal equipment on premises then it would depend on any formal agreement the company has with you regarding such a scenario. In some cases you could be stopped from accessing the equipment while authorities are getting the appropriate authorisation. Normally by security escorting you off the premises at a time when you're away from the equipment.

4
  • 2
    This is good, but it's missing information about companies with bring-your-own-device policies. In these cases, if you bring your own personal device, you may be required to install software that could give your company access to some or all of the device. There should be some agreement, though, as to how far that access extends or when the access can be made. Mar 31 at 12:10
  • 3
    @ThomasOwens yes I covered it briefly in the last paragraph (formal agreement), I judged it unnecessary for more detail unless the OP modifies the question, it's also missing thin clients which don't even have hard drives and other possibilities. There are so many potential scenarios and I didn't want to write a book :-)
    – Kilisi
    Mar 31 at 12:12
  • 2
    Fair point. It would ultimately fall under "personal equipment on-premises" (or, for WFH, "personal equipment used for work"). Mar 31 at 12:15
  • 1
    This. I've filled in as IT many a time (small company) and if I needed to do something with a machine I simply did it. Once it even was a fairly deep delve into the file system. (Why does this machine behave differently than a bunch of supposedly identical ones? What's different??) Apr 1 at 1:01
13

3 simple rules that you should assume to be universally true regardless of whether they’re in your contract, even if they're supposed to be illegal in your jurisdiction:

  1. The company has access to everything on a company device.

  2. The company has access to everything that can be reached through a company login.

  3. The company has a log of every single thing you’ve ever done while logged in or while using a company device (and that includes everything you do using their Wifi connection).


If you store files locally, on a personal device that you own, on a personal login which is never used for work related business, then you might be ok so long as you never allow the company physical possession of the device and the company account isn’t an administrator account on your machine.

4
  • 2
    "The company has a log of every single thing": do you mean that the company sees all the documents opened by the employee even when the device is not connected to the internet?
    – franz1
    Mar 31 at 13:33
  • 10
    @franz1 There is definitely software they could have installed that would log it. Whether they actually did, who knows. But you should act as if they have.
    – Kaz
    Mar 31 at 13:38
  • 4
    There's a difference between private information where I don't care if my boss knows about it, and private information that I absolutely don't want my boss to see. For the second type, you should product yourself even if access to it was illegal.
    – gnasher729
    Mar 31 at 14:44
  • This is a reasonable summary of what the company can access. Whether it is legal for them to actually do so is jurisdiction dependent. If they do accees something there are not legally allowed to that means they can't use it in any official way and even if they don't they may get into trouble if it comes out they accessed it.
    – quarague
    Apr 1 at 7:18
3

When nothing else is said, it is implied the owner can do as they please. It is also implied that you only do company specific things with the company equipment.

Whether that is a computer, that you do not use for private stuff or a power drill that you do not take home because you got a new TV you need to fasten to the wall.

With nothing else said, it is implied that the company has total control over company property.

The only limits frequently drawn by law are privacy concerns where a necessity of either living or the specific job is concerned. For example, you have to use the restroom multiple times a day, the company cannot have cameras there, just because they own the building. If you need to undress/dress for your work, the company cannot have cameras there, even if they own the building, the cabinets and even the work outfits. Because it's your privacy within the necessary restraints. It's not your free decision to use the restroom, you have no choice if you work a normal day.

Saving a private file on a work computer is not necessary and totally voluntary. If you do that, that is your own problem. Matter of fact, it is against the implied policy of using work equipment for work only.

There might be different agreements for bring your own device, company cars that can be used privately etc, but those will be explicit.

So if you cannot find an explicit exception, it is very likely the company has every right to search any of their own property, whether it's rooms, lockers or computers. There is no such thing as "your computer" or "your locker" in a company. It's their computer and their locker, that they allowed you to use for company business only.

2

I'd say ... "here is a simple, universal, not-country-specific answer."

"Yes," the company can do as they damned well please with their laptops, and with the official, on-the-clock actions of their employees," who are (by definition) at that time "acting as their legal agents."

Because – the company is legally liable for everything that happens on their behalf, and they must be able to contain that liability.

Simple answer: Don't do anything on "the company's" laptop that isn't, strictly and explicitly ... "the company's." "Buy and use your own laptop."

From the point-of-view of "the company," unauthorized and unanticipated "personal use of" company assets is an enormous (and, largely unpredictable and largely uncontrollable) legal liability, for which the company might find itself arraigned in an unfriendly court of law.

1
  • +1 from someone working in cybersecurity for 6 years. Data leakage is a huge liability and very valid concern for any employer
    – Anthony
    Apr 1 at 15:27
1

If the employee works on hardware provided by the employer, the employer can integrate any surveillance it deems neccessary. Overall you should not do personal stuff on your work PC, unless specifically allowed to do so.

That given, all data on the local drive is company property and the company can do with it whatever.

This is different in a "bring your own devices" environment. If the employee is the owner of the hardware, the employee can't be forced to give access to the hardware or install software he does not want to install. Of course the company has all rights to the information generated on company time on that device, and is entitled to receive all that.

1
  • 1
    That kind of surveillance would be illegal in many jurisdictions. Mar 31 at 19:34

Not the answer you're looking for? Browse other questions tagged .