9

I work in the IT department as a mid-level programmer. One of my responsibilities is to maintain and support the internal mailer of the company.

For some reason my boss came and told me I need to CCO him all future emails sent by one of my colleagues, because he thinks he is trash talking about others with other colleagues and he just wants to have a look.

Let's say he wants to spy on him without the other person knowing about it. I have until next Monday to do it but I'm feeling really bad because maybe he will get fired.

How can I determine if what he is asking me to do is illegal? And if it is, how should I address this situation with out breaking the law, and without getting in trouble for insubordination?

Details:

The colleague he wants to spy on is one of my superiors with 5 years more than me on the company. My boss is the founder of the company, he does not have a superior and can kick out someone without repercussions or judgment.

UPDATE - 23/06/2017

On Germany most of companies that manage private data have a Datenschutzbeauftragter (Data protection department), I contacted them without giving any relevant information and ask if the action my boss want to do is illegal, after they get informed about it they call me back and there's the response:

The personal company internal emails are confidential, only can be monitored if is specified on the contract, thing obviously I don't know.

Getting the points, by default CCO the emails from my colleague to my boss is illegal without specify it on the contract on a clause. My next step will be contact with my boss with a casual conversation saying it doesn't looks so legal to do things like this and I don't want to get involved.

In case the conversation goes wrong I will address to HR department telling them about the problem but I'm sure it will make a conflict with my boss.

|improve this question
  • 6
    Talk to the IT Security people in your company (without too many details), and see if they are concerned (clue: they should be). Then tell your manager that the IT Security department needs to be in the loop... I think the request will go away pretty quickly. – PeteCon Jun 21 '17 at 15:02
  • 2
    There are data protection laws, and, depending on the country, the bosses request may be illegal. Interesting question, but possibly not answerable by non-lawyers. – Captain Emacs Jun 21 '17 at 15:04
  • 4
    Spying on someone without them knowing it may be illegal in germany. Consult a lawyer even over the phone for one – mag Jun 21 '17 at 15:15
  • 2
    @PeteCon can you make that comment (maybe with more detail) as an answer. It honestly seems like the best approach – Robert Dundon Jun 21 '17 at 15:22
  • 1
    @Paparazzi in the US company assets belong wholly to the company including correspondences. Privacy laws are not protecting people very much in the US these days. Germany tends to value privacy rights more. – mutt Jun 21 '17 at 15:59
6

Does your company have a Betriebsrat (work council)? Does your company have a Datenschutzbeauftragter (privacy officer)? If your company does enough data processing to have a dedicated IT department, it likely falls under §4f BDSG which would mean that it would have to appoint a Datenschutzbeauftragter.

If your company has these, you should contact them before you do something which might violate the private information rights of an employee. This is also a good way to stall, because a manager can hardly sanction someone for wanting to consult these before doing something which might be illegal. And if they decide to inform the employee in question that they are being put on a watchlist, then that's hardly your fault either.

|improve this answer
  • Yes, we have a Datenschutzbeauftragter but is an external company because we have a lot of data and we cant take all the responsibility, the problem is I can't contact them because I don't have the phone number or the company info. – Troyer Jun 22 '17 at 13:11
  • 2
    @Troyer You are working in a company where the IT department doesn't know how to contact the Datenschutzbeauftragten? That's a major WTF. Having someone to ask how to avoid doing illegal stuff is the reason that position even exists. – Philipp Jun 22 '17 at 13:16
  • I'm the only one that knows the action the boss wants to do, for sure I can contact with some colleagues and they can contact to Datenschutzbeafutragten or giving me the phone, but spreading the "secret" to my near colleagues can make trouble on my opinion. – Troyer Jun 22 '17 at 13:19
  • 1
    @Troyer Just say that the reason you need to contact the Datenschutzbeauftragter is confidential (which it is). Handling confidential matters is part of their job description. – Philipp Jun 22 '17 at 13:35
  • 2
    @Troyer Write your boss a mail that you are going to consult the privacy officer before you do it, so they can't accuse you of insubordination just because you did it without their knowledge. Forward the reply of the privacy officer to your boss, and ask them how to proceed. If the privacy officer says it's ok, you proceed. When they say it's not ok but your boss says ignore them, that's where the situation gets actually hot. – Philipp Jun 22 '17 at 13:42
18

Disclaimer: This is not legal advice, it should not be taken as legal advice, I'm not establishing a client relationship with this, etc. This is the musings of a random german off the internet, you need to consult a lawyer specialising in employment law.

This is almost certainly illegal. Broadly speaking, surveillance (especially hidden surveillance) of employees is not permitted in germany. You may not even read or forward their emails unless there's a clause in this guy's contract that specifically states they're not to be used for private communication. (§ 3 Nr. 6, 10 TKG an employer that does not specifically prohibit private usage of business email is an email operator and subject to the principle of telecommunication secrecy)

IF there is a clear (provable!) expectation of the emails not to be used for private reasons and IF your boss can prove reasonable suspicion and IF this is a one-off incident then you may be allowed to do this. These are pretty big IFs and I wouldn't risk criminal charges over it if I were you - so go the safe route and get a lawyer.

Source(s): Asking out Data Protection Officer, asking my Boss and https://www.anwalt.de/rechtstipps/ueberwachung-am-arbeitsplatz-was-ist-erlaubt_050997.html

|improve this answer
  • 2
    @IDrinkandIKnowThings Consult a lawyer before monday and tell your boss that the lawyer said this is illegal. It's germany, the boss certainly can't fire you for refusing a illegal order. – mag Jun 21 '17 at 15:44
  • 4
    I'd consult HR before lawyering up. HR may not be on the OP's side, but HR will be looking at CYA for the company. And if the boss is proposing something illegal then HR will want to protect against that. – Peter M Jun 21 '17 at 16:02
  • 4
    Someone higher up in the company wanting to see work-related emails sent on company equipment over company networks is "almost certainly illegal?" Interesting. In the USA the tendency is more towards "you are wholly-owned property of your employer." Nice to learn about differences across cultures as they relate to these kinds of issues. – PoloHoleSet Jun 21 '17 at 18:35
  • 2
    Even before going to HR, ask the boss if he has checked whether the intercept would put the company at legal risk. – Patricia Shanahan Jun 21 '17 at 20:57
  • 3
    @PoloHoleSet : Yeah. It turns out that having a Head of Government (and lots of others) who grew up under the Stasi and plenty of seniors who grew up under the Gestapo means that the Germans take privacy way more seriously than the US. Also, they are just generally much bigger on employee rights. – Martin Bonner supports Monica Jun 22 '17 at 13:58
4

I would run this one straight to HR. It's not so much a question of this being illegal, because your boss apparently has authority over the e-mail system at work AND most workplaces have a blanket policy that e-mails sent over the company system should not be assumed as private.

The real question here is ETHICS. We can assume that much of the monitored person's e-mails will have to do with work. But you can't run a business without some degree of confidentiality across different roles.

There is a concern, however: if you go to HR, your boss will probably deny that he ever gave such an instruction. You may wish to involve your boss's boss AND HR as a means to protect yourself. Or - this is a long shot - maybe you send him an e-mail as a memorandum of his request, and ask him to acknowledge it. You might need an attorney's help here as to strategies, because it's very tricky. Best of luck.

|improve this answer
  • The problem is the boss that request that action is the founder of the company, so it does not have a superior. – Troyer Jun 22 '17 at 7:15
  • 4
    It's not at all clear that the blanket policy you refer to in the first paragraph would be legal in Germany - it is a very different culture to the US. – Martin Bonner supports Monica Jun 22 '17 at 13:59
4

A real problem is the person has an expectation of privacy.

This person could be exchanging legitimate confidential information your boss is not supposed to see.

I would get this checked off with security and HR. Maybe even legal. How you tell your boss that is tricky. If he orders you to perform the then get it in writing that you are doing it because were ordered and you have privacy concerns.

If there are performance concerns HR should be involved. A more reasonable approach would be for HR or security to audit like 100 emails between him and specific colleges with approval from legal. Forward all future email is pretty extreme.

It was edited the boss is the founder of the company and they have no IT security group.

You are kind of stuck. If you refuse you could get fired.

|improve this answer
  • 1
    Your legitimate concerns aside (checking policy/protocol), as a thought experiment, how far can that expectation be expected to stretch? I don't believe for a second that any e-mail I send is private, particularly not a work e-mail sent through our Exchange servers. Presuming that OP uses a similar e-mail server along with the ease of forwarding an e-mail, can one really argue for the expectation of privacy in the workplace? – sleddog Jun 22 '17 at 14:04
  • @sleddog Comments are not for discussion. – paparazzo Jun 22 '17 at 14:26
  • Then, framed as an improvement to your comment: your first line "A real problem is the person has an expectation of privacy." It's not whether or not the person has the expectation of privacy; it's whether or not that expectation is reasonable to have. In the case of using work resources to send e-mail, I'd posit that it is not a reasonable expectation – sleddog Jun 22 '17 at 15:28
  • 1
    That is your opinion. You are in the US you should not expect privacy? This person probably has that expectation and it is probably reasonable in Germany. – paparazzo Jun 22 '17 at 15:45
  • Until that question can be equivocally settled, it would make for a better answer to remove your own opinion about the legitimacy of that expectation. Whether or not the person has that expectation is irrelevant: it's whether or not that expectation is reasonable. The BDSG seems to indicate this expectation is not reasonable to have as an employee using an employer's resources, but IANAL, and I haven't read it all yet. – sleddog Jun 22 '17 at 16:02
4

A slightly more passive approach that does not immediately involve HR or Legal (incl. external lawyers) and gives you a chance to gather documentation is to delay your action on the task (not refuse it directly) and when the manager follows-up with you on it simply state:

Sorry, I forgot about it in the midst of XYZ. Can you send me an email so I don't forget? Please and thank you.

This way you have it in writing, for documentation purposes (I would print some hard copies of it as well, just for CYA sake). This also might have the manager rethink the order (i.e. he/she got the subtle hint that you are not going to do something ethically questionable or otherwise illegal without it being traceable back to him/her) and just forget/ask someone else. If he/she is disturbed by the fact that you are asking for an email/written documentation then simply and very politely and calmly say:

I sincerely apologize for any trouble or misunderstanding about this, but I just do not feel comfortable with this request and would like to get your boss's and HR/Legal's approval on this because it may be in violation of XYZ laws. (Then head to HR/Legal and/or the manager's boss's office immediately because odds are the manager is going to flex his/her management muscles).

Once either of those outcomes happen, I would consult the HR Director, or equivalent, and note that such a request was made and provide any documentation you have about the request. This way there is a record made to the legal representatives of the company for future questions or incidents. You can then submit a separate letter, or speak to the HR person directly, about your stance on the request and why, if, how, etc. it should have been/or be handled in the future (if you so desire).

This way, you have written documentation of the request and your due diligence in contacting the appropriate parties at the company if push comes to shove later on. With this, you could say that you did everything a reasonable person would have done in the same or similar circumstances and had no reason to believe the request was out of the ordinary/required further attention after consulting HR/Legal on the matter.

Disclaimer: This is NOT legal advice or any substitute thereof. Consult a professionally qualified attorney for actual legal advice. I take no responsibility for any results you may or may not incur because of my advice.

Best of luck with this issue.

UPDATE

With the additional information provided, there are some more points to consider:

1) Your boss is the founder of the company

Ok, so this is very important. While yes, being the founder does give him certain privileges that are otherwise unobtainable, it does not completely exempt him from responsibility or repercussions because of his actions. Without going into legal reasonings, there are factors such as employee moral, workload, efficiency, and costs associated with replacing/firing/laying off (or equivalent in Germany) employees. Do not think he is "untouchable" or "has no superior" ... that would be the public or internal employees / managers that would note such actions.

2) You do not want to do something illegal or get fired for insubordination

Sadly, you must make a choice about the issue. You cannot hold it in limbo forever, or much longer for that matter. Yes, the possibility of being let go is real, but depending on your relationship with the boss, work ethic, history at the company, etc., it is probably not likely if you are a good employee. If you feel that the request makes you uneasy then simply do not do it. Integrity is more important than money to many employers in many instances. Employers respect integrity and the willingness to stand-up and voicing concerns about an issue versus being a silent submitting "yes" man. If you have a family, then you might need to consider the financial idea of not having employment for sometime (however, you did not provide this information). You can easily reframe the firing into a positive in an interview by stating that "I was asked to do something potentially illegal and hurtful to the company as a whole and decided on the most ethical and legal action that was best for the company as a whole: voice my concern about the request and its legality".

Again, I wish you the best of luck and hope for the best.

|improve this answer
  • 1
    +1 for waiting the manager follow up. This delay will posibly make the boss reconsider the whole issue. – DesignerAnalyst Jun 22 '17 at 9:01
2

As far as i know (no lawyer, so this is not to be considered legal advice):

In Germany e-mail are considered mostly the same as normal mail and you would be offending against the "Postgeheimnis."

I would strongly advise you get written proof of that request and get to a specialized lawyer as soon as possible. This is mainly to protect you from committing a crime yourself or getting terminated unlawfully. This is a bad situation to be in, either way because your boss seems to not care to much about the law, so I imagine a (wrongful) termination if you disobey is hanging in the air?

Your boss may be committing a crime in itself in requesting you to do this. And its possible that he is asking you to commit a crime for him. You have to weigh reporting it to the police against your obligation to protect you employer from harm. Is there a boss of you boss, you could report this to?

|improve this answer
  • do you mean now or not? :) – Sebastien DErrico Jun 21 '17 at 15:44
  • saying something is or is not a crime is in fact legal advice... Saying what the law is or says is just stating fact. Saying what action may be is just opinion. legal advice is not allow the other 2 are. – IDrinkandIKnowThings Jun 21 '17 at 17:09
-3

My first thought is, I would quietly tell the person the boss wants to spy on what is happening. Then he can make sure that he doesn't say anything in his emails that will get him into trouble.

If there was reason to believe this person was using company emails to discuss something grossly illegal or immoral -- like he's discussing with co-conspirators his plan to assassinate the prime minister -- different story.

In the U.S., company email accounts are considered to belong to the company and so the company has the legal right to monitor them. In legal parlance, there is "no reasonable expectation of privacy". From what others have said here, that is apparently not true in Germany. I'm not a lawyer, certainly not an international lawyer, so I'll take their word for it.

Is there someone else in the company you can talk to? Someone mentioned talking to HR. Or you could talk to your boss's boss. That would probably be better than talking to an outside lawyer. If it's legal and within company policy, they can tell you that. If not, it's up to them to deal with it further rather than you.

|improve this answer
  • 1
    "I would quietly tell the person the boss wants to spy on what is happening." - Er...No. Never get directly involved in a conflict or discuss management's disciplinary/investigatory actions about an employee (it's ethically bad, legally questionable, and relationship suicide). Also, might want to avoid the far fetched conspiracy theories when discussing the issue, if ever. – B1313 Jun 22 '17 at 2:27
  • The "conspiracy theory" was intended to be whimsical hyperbole, not a likely scenario. – Jay Jun 22 '17 at 13:19
  • 1
    @b1313 Really? You've never said to a co-worker, "Hey, the boss is cracking down on people who come in late. You might want to be careful", that sort of thing? That happens fairly routinely in companies where I've worked. – Jay Jun 22 '17 at 13:23
  • No. I have never discussed anything even remotely related to management with anyone. Anything management says is confidential (unless explicitly stated, in writing, is not such) and should never be repeated. Someone giving another person a heads up is a clear sign that they (the someone) cannot be trusted with confidential or otherwise private information. If a manager makes the mistake of telling you something that you leak out...they will not ever make that mistake with you again ... or help you out (unless it is absolutely essential for the company), for that matter. – B1313 Jun 23 '17 at 1:20
  • @B1313 "Anything management says is confidential (unless explicitly stated, in writing, is not such)" Do you mean that literally? If the boss says, "Please remind Bob that the Foobar project is due Friday", you will say, "I'm sorry, but I can't tell Bob anything you said to me unless you put it in writing"? Or if the boss told you, "The client says they want these changes made to the product", that you wouldn't, under any circumstances, tell the rest of the project team about that unless he said to in writing? – Jay Jun 23 '17 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.