Chuck Krugel Interviewed for & Quoted in Internet Evolution’s “Policies Protect Employers Against Privacy Intrusion Claims”
Thanks to reporter Christine Parizo for interviewing & quoting me for her 11/15/12 Internet Evolution (“The Macrosite for News, Analysis and Opinion about the Future of the Internet”) article Policies Protect Employers Against Privacy Intrusion Claims. The article is available in the prior link & below. Also, I’ve included all of the readers’ comments through today. This includes my own responses to a couple of the comments.
Policies Protect Employers Against Privacy Intrusion Claims
Employees don’t just use the Internet to get sports scores and play games anymore. Their medical records and financial information are readily available online, and while employees may use the Internet at work to confirm their cholesterol test results or verify that their direct deposits went through, others might use it for more nefarious purposes.
But even if workers’ online use is completely innocent, employers need to guard themselves against claims of invasion of privacy and discrimination, according to experts.
Every company needs an acceptable use policy that clearly alerts employees that their electronic communications and activity are not private, legal experts agree. As Phillip Matlin, a partner at Los Angeles-based law firm Gordon & Rees, emailed me: “The business may monitor everything the worker does on the business’s computer as long as the employer publishes and circulates a clear policy alerting employees that computer and Internet use are not private.”
This policy protects the employer if an employee’s Internet use is not so innocent, such as if an employee is accessing someone else’s personal financial information, he added. In fact, employees should consider everything owned by corporate, says Elliot Lasson, adjunct professor of Employment Law at the University of Baltimore. “Generally speaking, anything that an employee does while on-the-clock on a company work station is property of the company.”
However, not all employees know this or expect it, which is why companies must have an acceptable use policy and get employees to sign it.
Employers need to be as explicit as possible regarding the use of company equipment, Charles Krugel, a management-side labor and employment attorney based in Chicago, told me. They also need to specify that if employees still use the company’s resources for personal use, there is no guarantee of privacy, and they do so at their own risk, he notes.
Resources also include company-owned WiFi networks, which Krugel says create their own issues when employees connect their personal devices: “You end up with the issue of whether or not it’s a secured network.” Within their policies, employers need to state that the network may not be secure for personal purposes.
Then employers need to enforce these policies consistently to avoid problems, says Krugel. “If you’re an employer who is worried about protecting yourself from legal liability or exposure, consistency will be key, especially when it comes to electronic communication.”
That consistency will help companies in the courtroom if an employee ever brings a privacy invasion or discrimination lawsuit.
Still, even if companies have ironclad policies in place, there are always employees who will disregard them. In addition to disciplining employees, Alix Rubin, an employment lawyer based in West Caldwell, N.J., advises companies to stop tracking data immediately once they notice an employee is accessing sensitive personal or financial information from a company-owned computer.
“In addition, the person conducting the monitoring should not be the employee’s supervisor or anyone in the employee’s chain of command who has the authority to alter the employee’s terms and conditions of employment,” Rubin cautions. This helps companies avoid discrimination lawsuits.
In the end, a comprehensive written policy will help protect companies — but make sure your attorneys have vetted the document before you turn it over to employees.
How comprehensive is your Internet use policy? Have you had problems with employees accessing sensitive data on company time?
— Christine Parizo is a freelance writer specializing in business and technology.
Comments
The company I work for definitely is strict on this policy. During the first week of your new hire period and periodically afterwards, you login to the online learning management system and read the policy and acknowledge it. So whether you actually read it or not, once you check the acknowledge button, it is tracked in your curriculum history. So if there is ever a question, the company can say that you were aware of the policy. Also, several of the social websites that people would typically go out to is blocked and of course all traffic is being monitored.
between “professional” and “personal.” I write about politics and computers, and a bunch of my friends are involved in politics and another bunch are involved in computers, so I end up with a lot of interesting ideas and contacts by surfing Twitter and Facebook every day.
It’s one thing to bring one’s own device and use the corporate network to do one’s “personal” stuff, but what if one brings a device that has its own data plan? I think that’s going to be more of a problem going forward, trying to secure that — and that’s the question I hae about the whole General Petraeus incident, how much that was a factor.
Good suggestion, Christine. Along with the comprehensive written agreement, I’d go for a virtual one as well.
DrT – The same question occurred to me — how does BYOD affect these issues? What if an employee accesses personal information on a personal device used also for work, with employer’s software on it?
And what about remote and home-office workers, who will use a mix of corporate and personally owned equipment. (For example, my employer here at Internet Evolution provides the notebook computer, but the keyboard, mouse, display, Wi-Fi router and Internet connection are all mine.)
Jason, that’s a good policy. I’m rather anti-BYOD for that reason – what if my phone (full of quirky kid and pet pics and craft snapshots) were wiped, then I found it under my bed or something with a dead battery? Or I decided to download a banking app to check my balance or pay bills? Too many risks to my personal device, I say…
Look at the flip side. With BYOD you could do a lot work on the go and you might not necessarily be confined to the office space for your work.
Using web based applications will solve the issue of wiping the phone if it is lost. If the corporate data is being kept on the web wiping the phone might not be required.
Keeping a backup of the device is a good policy, particularly for employees who practice BYOD.
Of course, that undercuts an employer’s phone-wiping policy.
Also, what if they find something criminal, should they act right away?
Employers shoud have a clear & easy to understand policy that if employees use company owned or operated IT, then employees should have no expectation of privacy. Moreover, if the employer learns that an employee MIGHT be using company owned/operated resources for criminal activities, those activities will be IMMEDIATELY reported to the proper authorities. Should an employer ignore possible criminal activity, it risks exposure & liability for negligence or even criminal charges; when in doubt, act right away.
I agree, Mitch. The policy approach seems clear and simple, but confusion exists not only between devices (does a personal device become a work device when it’s used for work?) but between accounts. Policies need to get into nitty gritty detail…
That is, if they’re needed at all. I’m not an attorney, but I should have thought the law governs what employers can and can’t review and respond to; a policy isn’t going to change that, is it?
