3

My owner has recently accessed my personal email and was showing as an active device to that email on my google account.

He recently changed my recovery email to his own on two of the work email accounts I use. One was already setup upon hire and the other I created. He is a hard, unfriendly man to work for and I assume is getting ready to fire me after 2 years of working my butt off, but never enough for him (Pay decent and single mom).

I kinda get he wants to see what I am doing, sending and receiving... But today I noticed he accessed my personal email also and was showing as a active device. Is he allowed to do this? I rarely use this personal account at work. It was linked with other email accounts through Google I believe and I assume that is how he got into it. I put the 2 step verification on now and changed my password.

This is happening in Ohio.

marked as duplicate by Philip Kendall, gnat, nvoigt, David K, Mister Positive Feb 24 '17 at 18:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 19
    Change your password now. – SmallChess Feb 24 '17 at 2:33
  • 9
    Work e-mail accounts belong to the company, you have no beef if he changed them. Personal e-mail, though, is yours. – Loren Pechtel Feb 24 '17 at 4:05
  • 8
    If you're in a situation where someone owns you, email security should probably not be the highest priority. – user53718 Feb 24 '17 at 4:08
  • 6
    Your boss has no legal right or claim to your personal Gmail account. If you can get undeniable proof went where he shouldn't have, that would make for a nasty legal issue for him. As far as work email accounts, they are company property. A good rule to follow is to keep work email accounts work related, and separate from personal business. – NZKshatriya Feb 24 '17 at 4:54
  • 6
    I'm trying to understand how he managed to gain access to your personal email. Did you use your work email address as a recovery email for your personal email account? If so, you've probably discovered that this is a really bad thing to do. – Snow Feb 24 '17 at 8:16
10

Is he allowed to do this.?

No he isn't.

You have a few obvious recourses such as changing passwords, legal action etc,.

At the very least I would change passwords on my personal account and check if facebook or other social media accounts are affected and probably change those passwords as well just in case. It's very dodgy what he did and many social media accounts are linked to personal emails for recovery. So your trust in this chap should hover around the zero mark.

Apart from that it's up to you, a lot depends on how badly you want to keep your job. His potential for being dodgy seems pretty high.

  • 2
    @Snowlockk sure... if she thinks it's worth the outcome... I tend to just move on and get on with my life rather than collect ammo for a protracted and expensive potentially reputation ruining battle if I can avoid it. – Kilisi Feb 24 '17 at 8:13
  • 6
    "No he isn't." How would you know? From an ethical standpoint this is almost vile, sure, but you'd need to be familiar with US law, Ohio state law, the details of what really happened and OP's employment terms and employment contract (if any) to say for sure. – Lilienthal Feb 24 '17 at 8:53
  • 2
    @Lilienthal na... I'm don't need to be a lawyer to assert this, feel free to rebut with some actual law cases from Ohio though – Kilisi Feb 24 '17 at 9:13
  • 3
    Well no, the point is rather that this isn't a community with legal expertise. You're making a bold claim that this is illegal when it might not be and most of the userbase has no way of verifying your unsourced claim. Just because you feel like it should be illegal doesn't make it so. There's a reason we close questions like this. – Lilienthal Feb 24 '17 at 9:28
  • 2
    Que sera sera, perhaps downvote me? I'm not going to change my answer. – Kilisi Feb 24 '17 at 9:30
1

The answer to your question depends upon the contents of the agreement you signed when you took employment - and the answer to how your boss managed to gain access to your personal account.

For example, many companies with BYOD policies also include in those policies the right to look at ANYTHING on those devices - even if it is personal.

Many companies also retain the right to inspect and look at anything running through their networks - including your private email if you were accessing it on company equipment.

Lastly, if you have connected anything personal to a work account, your agreement may permit them to access your personal data as you have "linked" it to the company, thereby making it their data too.

But, even with all of that, if your boss managed to get access by tricking you, guessing your password or some other "hackish" method, then he may have crossed the line between monitoring and hacking, and that could be prohibited by your company and the law.

1

IANAL

Employers have the almost unlimited rights to monitor or modify anything being used on their computer system. The computer system could include: devices the employer owns, software or cloud-based systems the employer owns or administers, or any devices connected to the employers network. The idea is to protect the employer's information and intellectual property.

First and foremost you can assume any electronic communication being sent over an employer's network is property of the employer, and may be privileged/confidential. The other thing that I'd assume is that because you've linked your work and personal accounts, you've also compromised your personal account. I think this is a misstep.

Keep in mind that company bring-your-own-device and electronic use policies waive a lot of your rights to privacy. This could be as extreme as giving the company implicit access and permission to your personal data in pursuit of securing their information systems. That's why it's of paramount importance to carefully consider what you do with your work devices.

While it's ethically wrong to access an employees private email, I think the company has a potential argument here that your "work" and "personal-work" email accounts are somehow administered under the same blanket account as your "work" email and thus all accounts need to be scrutinized. It may also be problematic for them that you're accessing personal email on the company information system. You would have been wise to completely separate your personal email account and refrain from associating it for with any work accounts at all.

0

For a legal answer you need to go to a lawyer with knowledge of rules in your location. However, at locations I have worked, legal staff opinions have been: If you access it from work, then work can access it. That is, if you log into an account from work equipment, then work has every right to capture your password and access the account to verify you are not stealing, spying, or in other ways doing damage to the company. The reasoning being they have not authorized you to use company assets for personal use, so by accessing the accounts, you have forfeited any right to privacy.

I am not a lawyer, and do not know if these lawyers were correct, but that is the policy of many companies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.