Employees don't just use the Internet to get sports scores and play games anymore. Their medical records and financial information are readily available online, and while employees may use the Internet at work to confirm their cholesterol test results or verify that their direct deposits went through, others might use it for more nefarious purposes.
But even if workers' online use is completely innocent, employers need to guard themselves against claims of invasion of privacy and discrimination, according to experts.
Every company needs an acceptable use policy that clearly alerts employees that their electronic communications and activity are not private, legal experts agree. As Phillip Matlin, a partner at Los Angeles-based law firm Gordon & Rees, emailed me: "The business may monitor everything the worker does on the business's computer as long as the employer publishes and circulates a clear policy alerting employees that computer and Internet use are not private."
This policy protects the employer if an employee's Internet use is not so innocent, such as if an employee is accessing someone else's personal financial information, he added. In fact, employees should consider everything owned by corporate, says Elliot Lasson, adjunct professor of Employment Law at the University of Baltimore. "Generally speaking, anything that an employee does while on-the-clock on a company work station is property of the company."
However, not all employees know this or expect it, which is why companies must have an acceptable use policy and get employees to sign it.
Employers need to be as explicit as possible regarding the use of company equipment, Charles Krugel, a management-side labor and employment attorney based in Chicago, told me. They also need to specify that if employees still use the company's resources for personal use, there is no guarantee of privacy, and they do so at their own risk, he notes.
Resources also include company-owned WiFi networks, which Krugel says create their own issues when employees connect their personal devices: "You end up with the issue of whether or not it's a secured network." Within their policies, employers need to state that the network may not be secure for personal purposes.
Then employers need to enforce these policies consistently to avoid problems, says Krugel. "If you're an employer who is worried about protecting yourself from legal liability or exposure, consistency will be key, especially when it comes to electronic communication."
That consistency will help companies in the courtroom if an employee ever brings a privacy invasion or discrimination lawsuit.
Still, even if companies have ironclad policies in place, there are always employees who will disregard them. In addition to disciplining employees, Alix Rubin, an employment lawyer based in West Caldwell, N.J., advises companies to stop tracking data immediately once they notice an employee is accessing sensitive personal or financial information from a company-owned computer.
“In addition, the person conducting the monitoring should not be the employee's supervisor or anyone in the employee's chain of command who has the authority to alter the employee's terms and conditions of employment,” Rubin cautions. This helps companies avoid discrimination lawsuits.
In the end, a comprehensive written policy will help protect companies -- but make sure your attorneys have vetted the document before you turn it over to employees.
How comprehensive is your Internet use policy? Have you had problems with employees accessing sensitive data on company time?
— Christine Parizo is a freelance writer specializing in business and technology.
You would think that people would do the right thing automatically. They would not use company assets or company time to do personal work, especially if that "work" skirts legality. You might think that, but you would be wrong. People do some pretty thoughtless and even illegal things on your network every day, and if you haven't told them it's stupid and wrong, well, they can honestly say they didn't know any better. Ridiculous, but true. That signed policy is your Get Out Of Jail Free card on the off chance that an employee does something that would attract the attention of, say, the Justice Department, or creates an unpleasant work environment, or any of a dozen other annoyances and vexations to the spirit. Just because they shouldn't doesn't mean they won't, so protect yourselves, while you still can. It puts me in mind of a very old Doonesbury cartoon, in which the head of the law school is standing at a podium explaining that they had to put together an ethics curriculum because some lawyers just weren't "getting it." Putting his face in his hands, he intones, "Right and Wrong 101 is one such shot in the dark." Don't be that guy. Save yourselves, before it's too late.
The company I work for definitely is strict on this policy. During the first week of your new hire period and periodically afterwards, you login to the online learning management system and read the policy and acknowledge it. So whether you actually read it or not, once you check the acknowledge button, it is tracked in your curriculum history. So if there is ever a question, the company can say that you were aware of the policy. Also, several of the social websites that people would typically go out to is blocked and of course all traffic is being monitored.
I dont have that much of faith in policies especially the ones which have been implemented via online since those policies do cover every aspect on paper but nothing when it comes for practical issues.
between "professional" and "personal." I write about politics and computers, and a bunch of my friends are involved in politics and another bunch are involved in computers, so I end up with a lot of interesting ideas and contacts by surfing Twitter and Facebook every day.
It's one thing to bring one's own device and use the corporate network to do one's "personal" stuff, but what if one brings a device that has its own data plan? I think that's going to be more of a problem going forward, trying to secure that -- and that's the question I hae about the whole General Petraeus incident, how much that was a factor.
Do you really think employees will consider these policies while bringing any privacy invasion or while using the company's internet for some personal work??
i don't think so, because signing the policies has now become a formality rather than an oath as employees do not have any other option except to accept the terms and conditions of a company.
so if companies want to be more secure they have to take some major steps rather than just presenting a policy infront of an employee at the time of hiring.
In our firm, most social networks are blocked. I agree with this decision, because it doesn't really do anyone much good if the employees are posting on Facebook or checking status updates during work hours. I think the periodical agreement policy pop-ups and reminders are a good idea on the side of the company; it's like their insurance in the future if ever an issue ensues and cases have to be settled.
Good suggestion, Christine. Along with the comprehensive written agreement, I'd go for a virtual one as well.
It would be really nice if everyone did the right thing... but they don't, unfortunately. Sometimes an employee has to verify a doctor's appointment or a bank deposit, but why that can't happen over the phone on a lunch hour is anyone's guess. (Really, it's not that hard to find a quiet space during lunch, coming from someone who worked in what felt like a zoo. Stairwells are nice and quiet. Dirty, but quiet.) It's just how this day and age is...
Acceptable Use Policy is one thing but now that we have to embrace BYOD, we know one thing for sure, this concept will get more complex. Employees would accept privacy in their own devices, it will not be like employers will be able to enforce everything they need. Separation of business app/data and personal app/data will play a key role in finding a right solution.
DrT - The same question occurred to me -- how does BYOD affect these issues? What if an employee accesses personal information on a personal device used also for work, with employer's software on it?
And what about remote and home-office workers, who will use a mix of corporate and personally owned equipment. (For example, my employer here at Internet Evolution provides the notebook computer, but the keyboard, mouse, display, Wi-Fi router and Internet connection are all mine.)
That's a good point, @Mitch. What do you do with BYOD, or with telecommuters? Or even people who work from home on occasion, using their personal devices that are set up to access the company network?
The ThinkerNet does not reflect the views of TechWeb. The ThinkerNet is an informal means of communication to members and visitors of the Internet Evolution site. Individual authors are chosen by Internet Evolution to blog. Neither Internet Evolution nor TechWeb assume responsibility for comments, claims, or opinions made by authors and ThinkerNet bloggers. They are no substitute for your own research and should not be relied upon for trading or any other purpose.
Last week's official US release of the BlackBerry Z10, the BlackBerry 10 touchscreen device, on the AT&T network marked the official entry of BlackBerry as a player in the formidable US smartphone market. While most consumers may not be swayed from their shiny, sleek iPhones and Android devices, businesses may still have a compelling reason to deploy BlackBerry 10. However, BlackBerry needs to do a few things before businesses will jump on the bandwagon, including opening up their management API and luring consumers to their device.
Whenever I whip out my BlackBerry Bold in public, someone will undoubtedly say, "Oh, how cute. You still use a BlackBerry." Yes, I do, and I'll use it until the day I die.
As legacy applications outlive their usefulness, companies look toward the cloud for maximum efficiency and minimum expense. But nothing is as simple or easy as just “moving to the cloud.” Legacy applications need to be modernized, and data has to be migrated. It’s the kind of headache that makes any seasoned IT pro reach for the coffee maker -- and a fistful of Advil.
Social integration, mobility, and the cloud -- with a side dish of social media -- are becoming evermore critical elements of enterprise content management (ECM).
More companies are trolling social networks to find and vet potential job candidates. Beware the pitfalls of blurring the line between personal and professional lives.
New York's Metropolitan Transit Authority is conducting a pilot test of digital kiosks to guide subway users to where they want to go more efficiently and at lower cost.
The Murdoch/News International scandal has all the elements of the digital age, from phone-hacking through embarrassing emails to agile digital reporting.
The plan for unmanned police drones to patrol traffic and other city conditions in Seattle has sparked a new set of legal concerns about privacy. Law traditionally lags technology, but we can expect now to see a new round of activity in the courts as legal definitions begin to emerge on what "next-gen privacy" will look like.
The quest for Webpage clicks and ad impressions is creating a market for sensational truths and lies in equal measure. How are we going to get to the bottom of any real issue online – like what's really going on with Carrier IQ, for example – if we can't separate hype from reality?
Cheaper, consumer-grade mobile devices are allowing SMBs to capitalize on Internet mobile communications and are replacing more ruggedized devices in industrial applications for companies of all sizes. Cost is one factor. Comfort is another.
New York's Metropolitan Transit Authority is conducting a pilot test of digital kiosks to guide subway users to where they want to go more efficiently and at lower cost.
The whole Amazon.reader debate is a double-stupid. It's stupid to think that there's any e-book buyer who doesn't know Amazon's URL, and it was stupider to let ICANN launch the whole free-form TLD initiative to start with.
While NFC's original goal was to enhance mobile commerce applications, it is finding its way into a number of other uses, which is creating both opportunity as well as challenges for IT departments.
Enterprises would like to move to cloud computing but are hesitant because they are concerned about providers’ ability to secure company data. Here are some tips that help to ensure that if breaches occur, the business is not left holding the bag.
Edmunds separates customers into segments based on the info it collects on its site and from partners, and uses that to push out custom content, said Brian Baron, director of business analytics for Edmunds.com, at Predictive Analytics Innovation Summit.
The automotive website uses propensity modeling to target ads and customer registration forms, said Brian Baron, director of business analytics for Edmunds.com, at Predictive Analytics Innovation Summit.
Subsidized handsets, rather than locked handsets, should be the focus of regulators. We're not getting good deals, not fostering innovation, and weakening our power as buyers.
Expert Integrated Systems: Changing the Experience & Economics of IT In this e-book, we take an in-depth look at these expert integrated systems -- what they are, how they work, and how they have the potential to help CIOs achieve dramatic savings while restoring IT's role as business innovator. READ THIS eBOOK
your weekly update of news, analysis, and
opinion from Internet Evolution - FREE! REGISTER HERE
Wanted! Site Moderators Internet Evolution is looking for a handful of readers to help moderate the message boards on our site – as well as engaging in high-IQ conversation with the industry mavens on our thinkerNet blogosphere. The job comes with various perks, bags of kudos, and GIANT bragging rights. Interested?
To save this item to your list of favorite Internet Evolution content so you can find it later in your Profile page, click the "Save It" button next to the item.
Email This
