Can my boss pretend to be me to access work computer and private messages? [closed]

Question

I’m new here!

This is related to UK ICO/Employment Law. I am office based.

A complaint was made by a colleague in another department about their team mate (they suspected that our work msg service (slack) was being used to talk about them. Bosses (owners of company) went through their private DMs and found many conversations, including a conversation with myself where I’d given an opinion on said employee (he’s very distracting and frustrating at times!).

This resulted in the company owner logging into my computer to read messages across all comms channels when I was ooo, they even searched for specific names (the owners names, who weren’t even involved in this complaint (what is this entrapment?!). Thankfully they didn’t find anything that was particularly bad - just opinions. The following week the bosses announced that a company wide investigation would take place regarding messaging apps, and they asked everyone (including me) for our password pins so they could access our work computers. I thought this odd as I knew they had already accessed mine (the document of screenshots of my conversations still saved on my computer proved this).

I’m frustrated because all other employees were given the opportunity to clean up their messages. We have not been treated equally.

They also lied to my face about this.

In addition, we have no IT use policy, at no point have they ever said they would monitor our activity, nor have they outlined their expectations in any company docs or contracts relating to how we should communicate. In fact, our contract says that they will obtain explicit consent for any personal data requests.

Of course I appreciate that it’s company property, but there are grey areas;

1. We are asked to BYOD (bring your own device) for work, so messaging platforms are installed on our personal devices.

2. We don’t have IT policy in place, and they have never outlined that they would monitor activity. They have never provided expectations or parameters on how we should use IT equipment.

3. It feels somewhat targeted, I feel like I have been singled out as others haven’t been treated the same.

4. As far as I’m aware there was no lawful reason for them to go through my computer, or suspect me of shady activity.

It’s my view that we have a reasonable expectation of privacy, and that colleagues should be treated equally.

Has anyone ever been in this situation? Legally where do I stand? Has there been a breach? Or do I just need to accept it?

Many thanks in advance!

Answer 1

Messaging systems store their data on servers. All you're doing by installing a client on your personal device is accessing company paid server resources. This is no different from email. The data is stored on company resources, all you have is a client to access that data based on the conditions of your employment.

The data is legally owned by the company. Public organizations have to store emails and messages for 10 years for FOIA purposes. This is not your data.

Take this as a lesson to not use company resources to gossip about other employees.

Answer 2

The answer to this depends a bit. Generally, the data you create on their platforms is legally owned by them, as is the hardware they provide. What's puzzling is they shouldn't need your PINs and passcodes to do this.

HOWEVER: you note that you are required to bring your own devices. If it is your personal device they accessed, they are breaching the Computer Misuse Act.

EDIT1: Also it doesn't really matter if other employees delete messages or not. The delete button on most platforms doesn't actually delete, it just marks the data as a no-show on the clients; the platform reporting tools can still see them, and so can your boss. Your bosses, given their frankly idiotic and reckless method of getting this data, may not know that such reporting tools exist, however.

Answer 3

To be honest, a company-wide search over some gossip on Slack seems a bit overreacting. In case of serious problems (fraud, corporate espionage, harassment and those kind of things) such a search is allowed, but not for some simple gossip. Of course, if such an investigation is underway, a company prefers not to tell everyone.

If there is one lesson to be learned, that is that you must make a differentiation between your own device and the company's device. So, even though my company asks us to bring our own phone, I have a separate business phone and private phone.

You don't have some form of absolute "reasonable expectation of privacy", especially not on systems that contain data owned by your employer. Or in legal terms: it all will, as ever, depend upon the facts of the particular case.

Answer 4

Apart from moral and possibly legal problems, your IT will or should have a big problem with this. Since you can prove that your boss accessed your email, there can now be no evidence that any email sent from your account was sent by you. So if you ever get fired because of some activity on your computer, you can go straight to an employment tribunal.