43

I work from home most of the time. I use my corporate laptop for work, and I keep my personal laptop open as a second monitor, for internet research. Whenever I open Google Translate or Linguee on my personal laptop, I get a pop-up window on my professional laptop telling me that a translation website must not be used to disclose protected information.

So it means that there is a software on my professional laptop constantly monitoring all the network activity, and the websites accessed by any device on the network (even personal devices). Is this legal under the EU laws?

Improve this question
10
  • 7
    Are you using a VPN from your personal machine?
    – Erik
    Nov 3, 2021 at 8:19
  • 21
    OP, this is probably not the right venue for your question. Although your question arose in a work-related context, your question concerns the legal framework. law.stackexchange.com might be better suited. However, given that legality likely depends on technical implementation security.stackexchange.com is likely to have experts (often with basic knowledge of the legal framework) with the right background.
    – MvZ
    Nov 3, 2021 at 9:22
  • 27
    Wait a minute, when you say you use your personal laptop as a second monitor, do you mean you have it connected directly to your work laptop and it is acting as another screen? Or are they separate computers?
    – Seth R
    Nov 3, 2021 at 15:31
  • 11
    Thank you for the answers. Some clarifications: I don't use a VPN on my personnal laptop. The two laptops are not physically connected (it may be misleading when I wrote "secondary monitor", I meant secondary device). The only link between the two laptops is that they are connected to the same WiFi network.
    – user4780495
    Nov 3, 2021 at 19:12
  • 7
    Are you in any way sharing accounts between the two computers?
    – Thorbjørn Ravn Andersen
    Nov 4, 2021 at 14:02

3 Answers 3

Reset to default
84

If you place your personal laptop let's say on the kitchen table and connect it to your wi-fi and your work laptop on your desk and connect it to your work (probably using your wi-fi and a VPN) There should be no way that your professional laptop can know what your personal laptop is doing.

If it does, that would be considered hacking/invasive and certainly against EU law.

Now... I don't think your employer does it. It is a lot more likely, that your setup of computers at home is not as strictly separated as I described. You probably have your personal laptop somehow connected to your professional laptop. Either because you use it only as a second monitor as described, or maybe because it's connected to the work VPN, too.

Please also note, that if you are logged in with for example your Google account in the Chrome browser on both laptops, it will synchronize between those two. You can turn it off, but if you don't, yes, your employer will find out what you did on your personal laptop.

Again, it is very unlikely that your employer has any kind of criminal hacking activity going on, it is very likely that you get something wrong in your own setup of devices and online accounts.

If you have a specific question about your specific setup, you can probably get help on Information Security SE. Be prepared that they need a lot more technical details to give you a good explanation for what happens.

Improve this answer
14
  • 5
    This is the correct answer. @user4780495 please let us know what part of your setup was bridging your work and personal laptop once you figure it out.
    – Gregory Currie
    Nov 3, 2021 at 10:50
  • 15
    @AlanDev not without some deliberate action to make them talk to each other, no.
    – Seth R
    Nov 3, 2021 at 15:05
  • 9
    I don't use a VPN on my personnal laptop, and there is no physical connection between the two devices. An interesting point that you raised, is the synchronization of my browser history due to my Google account sync on Chrome. I will try with another browser and let you know.
    – user4780495
    Nov 3, 2021 at 19:14
  • 22
    @user4780495 a good practice is to have a separate, throw-away gmail account for logging into work computers and the like if necessary. Having your personal e-mail logged into a work computer is all sorts of risky.
    – T. Sar
    Nov 3, 2021 at 20:08
  • 5
    @user4780495, I suggest you take it a step further than just using a different browser. Make sure you are not logged into any Google account on your personal machine. Even with a different browser, Google accounts will stay connected if you are logged in, especially when using a Google service like Translate.
    – Seth R
    Nov 3, 2021 at 20:26
9

I would call your company's IT department and have them figure out what's going on. They shouldn't know what your private computer is doing. They don't care what your private computer is doing. They most likely don't want to know because it only can cause problems. Like your wife might come into your room and use your private computer, that's a legal mine field if the company records what she is doing.

They may be able to figure out what's going on. For example, my private laptop can access the internet through another laptop of the same brand if I set up both computers accordingly, and in that case the company would probably see everything my private computer does because it's actually the work computer accessing the internet and passing everything on to the private computer.

Improve this answer
4

I am not a lawyer, so the legal question is answered only to a "probably, to my layman understanding" level (Germany).

Assuming that this is more than a coincidence:

This probably depends on the country and the means by which it is achieved, and the fine print which you signed when you got the laptop from you employer.

Things which come to my mind are:

  • Passive monitoring (Although i am not 100% sure how that would work on a wifi network) of IP traffic, and flagging DNS requests: Not nice, but as long as you signed something probably legal if the device does not store this information but only warns you.

  • Inserting the own machine via acting as a DHCP Server: Not nice, not reliable, a lot of hassle, would be very much like your business laptop "sharing" it's internet connection and competing with your router.....

  • Inserting the professional laptop via ARP spoofing and intercepting the connections to the router actively. Definitely hostile, probably illegal even if general permission to monitor the network is granted.

So i assume that it is passive, and (assuming it was listed hidden in the fine-print) legal as long as certain provisions (no storage of the data) are kept, probably legal.

  • Use a VPN on your personal laptop
  • Connect one of your laptops to the "Guest" network of your router and see if it continues

If it continues, something else is happening.

Improve this answer
4
  • 9
    I don't believe even point 1 can be legal in Germany in any way, even if it is part of the employment contract. OP is allowed to have a family member or basically anyone using their personal WiFi network. These people have rights and OP can't sign them away.
    – Roland
    Nov 4, 2021 at 11:34
  • 1
    "depends on the country" - with the EU being the big exception to that rule, and this question is tagged EU. In the EU this rapidly rises to the level of criminal offense.
    – MSalters
    Nov 4, 2021 at 15:40
  • @MSalters this would break all kind of privacy laws, to the point that I find it hard to imagine a company would be crazy enough to implement something like this
    – user3399
    Nov 4, 2021 at 15:44
  • @Roland: But if they sign that they carry the work out on a separate isolated network, it's another story. Also, a passive monitoring with no data storage/collection or transmission intercepting unencrypted traffic is per-se not necessarily affected by privacy rules.
    – Sascha
    Nov 4, 2021 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .