Can the employer fully access employee data according to EU law? The computers at the company I work for recently show the message below during log on. This computer system is the property of Company. It is for authorised use only. All activities conducted on and information accessed, processed, stored or sent using this system may be examined. By using this system, all users aknowledge notice of, and agree to comply with, the Company IT Acceptable Use standard. Unauthorised or improver use of this system may result in disciplinary action. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use. Log off immediately if you do not agree to the condictions stated in this warning. Is the statement legal according to European regulations? Besides, it is my work computer, it is not that I have an option not to log on. Related question for Norway
The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities). According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be: for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"), proportionate ("it was the only possible way available"), and communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy). In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).
No. As long as you don't see and have no means to access this data, but it is under the control of the user at all times, you are neither the controller or the processor of this personal data, and the GDPR does not apply to you.
With respect to the first question, discussing an idea in a non-encrypted email is not a publication that forfeits the right to patent an idea, even though it is not 100% secure. In the same way, talking about an idea for a patent with your patent lawyer in a secluded booth of a coffee shop in person does not constitute publication of the idea for this purpose, even if someone is secretly spying on you at the time. Since I am at the moment employed by a company, even though the idea originates from myself, it seems that I should quit my job first not to have my current company have any claim over my idea. It is possible that the contract makes even ideas that you come up with yourself while employed by the company the property of the company. If so, you are legally in the wrong and the idea belongs to the company. But, proving the reality that you are stealing the idea from the company is harder if there is nothing in writing. An email discussing an idea while you are employed would have to be disclosed in litigation with your employer over whether the patent applied for belongs to you or to your employer under an employment agreement. If you didn't put it in an email, it wouldn't exist to turn over in litigation.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
Yes, this is a valid concern As written, every piece of IP you produce while employed belongs to the employer. This includes your hypothetical game. It also includes your weekly shopping lists, your Christmas card to your Great-Aunt Nellie, the … a-hm … private video you make of you and your significant other. As written this is overly broad and probably unenforceable. However, it’s always better to have clear and legally enforceable clauses in your agreements because unclear, arguably unenforceable ones lead to disputes. To be fair, the employer has probably lifted some (bad) boilerplate and hasn’t actually thought through what it means. Get it redrafted.
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. That is not correct. According to GDPR Article 2: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. This Regulation does not apply to the processing of personal data ... ... (c) by a natural person in the course of a purely personal or household activity; GDPR Recital 18 states in relevant part: (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. Personal data that is not processed by &quot;automated means&quot;, for example data which is transmitted verbally, by hand writing, or by manually sent email, is not covered by the GDPR. Data which is used by a natural person for &quot;personal activities&quot; is also not covered. Consulting one's personal lawyer might well be a personal activity unless it is a business matter. Even if such a transfer of data were in scope for the GDPR, consent of the data subject (DS) is not the only available lawful basis. GDPR article 6 permits any of several possible lawful bases to be used, particularly paragraph 1 point (f) which reads: (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Also possibly relevant is point (c) which reads: processing is necessary for compliance with a legal obligation to which the controller is subject; In short, providing one's personal lawyer with the names and addresses of relevant people in connection with a legal issue is not at all likely to be prohibited by the GDPR, nor to require the consent of the people whose names and contact info are provided. However, a comment by user PMF reads: The Data Protection laws are mostly for companies, not for individuals. This is an overstatement. The laws do apply to natural persons as DCs, although enforcement is largely targeted at businesses, particularly large, for-profit businesses.
The GDPR's right to erasure just applies in some specific situations. While messages you wrote on Slack are personal data, they are generally also part of a larger discussion with others. If your messages are removed, the discussion becomes incomplete, so that will violate the freedom of expression of those others. Art. 17(3) GDPR provides an exception for the right of erasure in such cases. So basically, whoever is the controller, you probably don't have the right to have your messages to be deleted. However, you would have the right to have your account pseudonymized like Slack replied in the Reddit post you linked to. See also my answer in "Does a user have the right to request their forum posts deleted?". Basically, it is correct that Slack can be just the processor. Even if the controller cannot get access to more than 10000 messages unless they pay. However, Slack is not allowed to do anything with those messages, except when the controller says so. In its Privacy Policy, Slack distinguishes between customer data and other data. It states to be the processor for the customer data, but controller for the other data. Because those are tied together, I am not sure this distinction can be made. If not, Slack and the customer will be joint controllers, but it requires probably a court case to decide on that. For example, the Court of Justice of the European Union has ruled (in the Fashion ID case) that putting a Facebook "like" button on your website, makes you a joint controller together with Facebook. And (in the Wirtschaftsakademie case) that also creating a Facebook "fan" page makes you a joint controller. But neither of those are very similar to the situation with Slack.
An EULA, or "End User License Agreement", is a contract between the software user and the software publisher. It usually protects the interest of the software publisher, e.g. you can only use it on one computer; you may not alter it or distribute it without written agreement etc. In this case, the EULA specifies that: The software may be harmful to the user's computer The user's personal data may be sent to third parties The software may used to aid or perform illegal activities The software publisher is not responsible for any damage caused by using this software First thing first, is this a valid contract? Let's take a look at the essential elements of a contract: Offer and Acceptance Intention Consideration Capacity Consent Legality Possibility of performance The Legality element specifies that the contract must not be something disapproved by law. Botnets are used for attacking other computers, i.e. an unlawful act. Installing botnets may violate the Section 3A of the Computer Misuse Act 1990 in the UK. Sharing user's personal data may also violate data privacy laws. Let us, for the moment, assume the contract is valid. Item number 4 still causes a problem: an overly broad liability waiver. While liability waivers are common and normal, one can argue that the said waiver in this case seems to cover intentional or reckless acts. Such items in a contract are deemed as unenforceable. Parental control systems and remote observation systems are different. They can be used legally, and this legal use is common. Thus, distribution of these systems is legal. Needless to say, it is very difficult to argue that virus and botnets share the same. Of course, one can still use a remote observation system in an illegal way. In this case, the software user is liable, but the software publisher is not liable because the user's behavior is beyond their control.