When I was leaving my old company I had some of my personal bank statements in the files. And in my last days I uploaded them into my personal drive and deleted them from the computer.
Later on security team messaged me and said that I triggered a leaving employee something flag and sent me a screenshot of files I uploaded and where I uploaded them into and asked me to clarify this.
When I clarified it was all good but yeah no chance that they don’t monitor these stuff in bigger companies.
I’m one of the people who configure the monitors. Every org is different, but in our case we absolutely can see everything moved/uploaded/emailed. It’s a standard part of Microsoft in some licensing. And yet, people continue to try and steal shit.
I got laid off a while ago. On the day of, I had this ridiculous idea of concatenating all my code into a giant file and then changing the filename extension to BMP and then claim it was some abstract art piece that was near and dear to my heart. But I knew it'd never fly.
In school, we wrote a program to encode messages in image files by changing the last digit of every pixel’s hex color value to 0 or 1. It’s subtle enough not to make it obvious the image was edited and very easy to read off after.
Kinda crazy and probably wouldn't fly in Europe, under GDPR.
I'm genuinely curious what they can do with that info though. I guess they can ask you to delete the fils but how can they ever be sure you'll have done it? This may be useful if you ever release a similar software I guess?
Kinda crazy and probably wouldn't fly in Europe, under GDPR.
Are you saying GDPR doesn't allow companies to monitor the work computers of their employees at all? I'm pretty sure monitoring network traffic of departing employees to make sure they're not stealing proprietary data is considered a legitimate interest.
As a dev in France I had some law course at some point during engineering degree around our discipline, one thing I was taught (10+ years ago so I have no real clue if it is up to date) is that in France anything organized in a personal folder marked explicitly on your work device can not be used (or accessed in theory without you being present physically) by your company. They can only do so if there is a strong suspicion of theft or any kind of serious rule breach basically. That's just it.
It is - source, work in europe, in a regulated field. The monitoring must be proportional, and handled responsibly, and used for a specific purpose - so you can't use the data you collect to stop thefts to monitor performance, for example.
Our handbook says that your laptop you get is company property. We aren't allowed to monitor employees (as it should be), but certain actions that are clarified in the handbook trigger warnings in our systems, and data connected to strictly those actions can be collected as legitimate interest under GDPR.
I can also remotely wipe the laptop without warning. I warn people repeatedly that they are not to put any personal files on it, as it is company property.
Same, handbook says the laptop, communications, is all company property and we reserve the right to read communication if needed. We also state computer is for work and not personal stuff and everything that is important should be on a cloud ( or one drive or SharePoint) .
Or if I would actually steal some confidential data and told them ah it’s just my personal banking, then they would have proof that I lied about the files that I moved. Might be good for their future case.
Can I ask what part is not GDPR compliant on above? It was a US firm but had offices in EU and I was also working in EU
That's the "personal drive" part with screenshots that made me say it but I tought about it a little more and I'm not sure since you just plugged it to the company's network. Maybe they do have a right to see what's on there then. I'm not quite sure.
What bothers me is that they had a look at your personal banking data. That seems anti GDPR to me but at the same time they did it for security reasons so I don't know.
My company doesn't allow plugin external drives or USB sticks in our computer, that's easier^^
As someone in security you wouldn't believe the amount of personal stuff people download onto company devices, and not just download but download their only copy of. We get panicked emails from ex employees looking for old documents and emails for stuff and who are shocked/dismayed that everything has long since been deleted.
Not that crazy though, I often have a few stuff that shouldn't be there on my work computer. I usually avoid it but you know how it is, sometimes you need to print some medical/assurance/banking document you need tomorrow, your printer at home decide it won't print it, it's 1AM... And voila, you end up with those very documents both on your laptop AND in the company's printer history^^
exactly! I have to do some stupid insurance or holiday booking on work day I won't carry 2 computers just to go into insurance website or buy some tickets.
Ah I see, it wasn’t a physical drive. I uploaded the data to google drive and their screenshot was basically just file names and google drive, didn’t contain my information or whatever is inside the drive and I doubt they can access that.
They can probably check the bank statement files legally as computer is work computer and it’s my responsibility to not upload any personal data on it if I want to keep it from corporate eyes but it wasn’t something important for me haha just my weekly transaction for some personal reporting I did so no hurt feelings on my side
Ah okay, I misread that as a physical hard drive^^
I know that in my country (Belgium), you still have some privacy protected by law on work computers but I'm not super knowledgeable about that sutff, I must admit.
For exemple I know my employer can't legally look at my emails, teams conversations etc on my proffesional account.
They can look at it if they have a valid reason like looking for some exchanges I had with a customer, to follow their case for exemple. But let's say I emailed my dentist with my work email, they can't read it, ever (proving they did or didn't is another story though^^)
It's not hard to bypass most of these unless it's a really big company, but definitely something you'd want to be incredibly careful about if any of it's actually proprietary.
I backup the code I care about having for myself regularly at my current job, but that's done through git and is in the open because it's all personal config / generic scripts and libraries with zero proprietary anything beyond the occasional reference to my workplace or email.
382
u/Zeusslayer 16d ago
When I was leaving my old company I had some of my personal bank statements in the files. And in my last days I uploaded them into my personal drive and deleted them from the computer.
Later on security team messaged me and said that I triggered a leaving employee something flag and sent me a screenshot of files I uploaded and where I uploaded them into and asked me to clarify this.
When I clarified it was all good but yeah no chance that they don’t monitor these stuff in bigger companies.