Recently I have been noticing some weird activity on my workstation (which is password protected) such as Browser Data (History, Saved Passwords, Ignored Prompt Options, Plugin Data, Browser Session Data which is used to restore tabs on startup) being erased. I suspected that it was either my employer or another employee who outranks me mainly because the data removal as been progressively "evolving" starting at just lost tabs and history then to plugin data and then selective removal of add-ons and also the fact that I turn off the workstation so they have to get past my password (which isn't weak - it is 9 characters with one number and one symbol in it). I expect as much anyway because this is a work PC and my employer is entitled to check the data (though it makes work harder when I lose history of code snippets I use for work).
One day I noticed that after work hours there were entries in my browser history, particularly googling the net alias I use, finding an old forum I used to visit, googling an old project I worked on and googling a latin philosophical proposition I used as a tagline, "Cogito Ergo Sum". From there I decided to keep an eye on my history and note down what time exactly I left work. (Though it's weird they are looking up this stuff on my workstation rather their own).
One morning I checked my history, I saw the tell-tale sign that someone had been on as 20+ URLs were opened at the exact same time which would be Chrome opening up my recent tabs at startup, the time recorded was 4 minutes after I left work. Another 4 minutes later there was one more entry which scared me and that entry was for
mail.google.com. If you don't know what that URL is it how you get into your gmail inbox and if you're not signed in it will redirect to the login page. What scared me was that I don't normally log out of my email because I trust the security of my workstation. Taking precaution when I got home that day I went to every website on which I was registered and reset all my passwords and when I did this I saw that I was still logged into my email so whoever accessed my email didn't go in to see if I was logged in and logged me out.
Now I understand that in IT or any job in which you use a PC with net access the PC and the Internet is a work resource. Anything on the PC the employer is within their rights to monitor and that includes email, personal or otherwise, and aside from the personal banking details and passwords I have nothing to hide in my email. However, I expected my employer (and any employer) to maintain a professional standard in not opening sensitive personal emails and if there is a reason to do so I should be notified in advance about which emails they intend to read (otherwise how am I to know that they aren't going into my email and stealing my bank details) or at the very least tell me that they are going to access my personal email.
It has been a couple of weeks since this has happened and I have not logged into any account at work but I have never been talked to about this. I am still concerned that this happened after office hours so I am wondering, are are employers allowed to access/search through one's personal email outside work hours?
NOTE: The likelihood that this was someone outside the workplace is very unlikely considering when I left on the day in question there was still some collegues still at work. This would mean in 4 minutes everyone had to leave, the intruder gain logical access without tripping the intrusion detection / intrusion prevention (IDS / IPS) system and access my workstation by turning it on and brute - forcing my password. The odds are stacked against such a scenario.