Our CEO wants our IT provider to configure his email client so he can see every employee's work emails in his inbox all the time. To make a long story short he's concerned about a specific employee being difficult to reach so asked to get his emails and then decided he might as well pre-emptively get access to everyone's emails in our company of ~15 people.
As I see it, this is an absolutely terrible idea for all sorts of reasons. Just off the top of my head:
- Right now, to get access to somebody's emails, you have to ask our IT provider to arrange it. This necessitates authorisation and an audit trail. This would be lost going forward.
- It makes access to the CEO's computer the weakest-link in internal security & data protection.
- Relatedly, it's not an incredibly secure computer. He habitually leaves it logged in when he's not around.
- Huge potential for abuse.
- Permanently weakens all internal data protection & controls
- Could be a general breach of regulations (that could open us up to an employment lawsuit. Not sure. Not a lawyer.)
- I don't want somebody spying on my inbox, and neither does anyone else.
- It erodes employee trust, because it feels like spying, regardless of motive.
I understand his concern and his motives. I think he genuinely wants to do the right thing but he hasn't thought through the ramifications of what he's asking.
I am just an employee (we have a HR/Compliance Director who's not in the office today). How do I effectively communicate my concerns to the CEO? I know that they legally can do this. I'm asking for advice on how to persuade them not to.