Missing the Point: Personal Internet Use in the Workplace

Searching Google for the keywords “personal internet use in the workplace” yields well over 380,000 results, while “surfing at the office” returns around 730,000. From the employer’s standpoint, the question is rarely whether employees can be banned from accessing personal emails or social media. Most companies today consider it appropriate to keep this communication channel open to employees for keeping in touch with family, as well as handling matters with public authorities and institutions.

However, there is considerable uncertainty regarding what constitutes an acceptable extent. Will the resulting loss of working hours be too substantial for the business? “Reading an email is fine, just like making a quick call to one’s daughter or grabbing a drink from the vending machine, but shopping during working hours is not permitted—why should an employee book a trip at work?” From the employee’s perspective, privacy protection is the main issue: “Is the employer allowed to view my browser history?” And both legitimately ask themselves: “Can this serve as grounds for termination?”

The core questions can be summarized as follows:

• Is personal internet use permitted, and if so, to what extent?
• May the employer prohibit it on company devices? What about personal devices?
• May employee internet use be monitored?

We will only touch briefly upon the answers here, as they are not clear-cut, and both case law and statutory regulations vary between jurisdictions. For instance, personal internet use at the workplace is described in Austria as permitted unless explicitly prohibited, whereas in Germany it is regarded as prohibited unless explicitly permitted.

A matter of pure discretion that causes additional uncertainty is the acceptable extent of internet usage. When legislators invoke the “principle of proportionality”, this is an ambiguous concept that only yields predictable outcomes in court rulings in extreme cases. Monitoring whether an employee’s browsing habits remain within proportionate boundaries also entails numerous pitfalls if privacy rights are not to be infringed. The situation regarding hardware is more defined: employers have authority over company devices and may prohibit personal use, whereas doing so completely on an employee’s personal device is not feasible.

And why does this miss the point?

These are undoubtedly significant issues. Yet, curiously, hardly anyone seems to consider one crucial question, even though it entails substantial risks for both employers and employees. Ignoring it can become exceedingly costly:

Who is actually liable for damage to sensitive data or the corporate network?

Suppose a crypto-trojan has encrypted company data. The result is massive costs, immense frustration, and extensive downtime during the recovery phase. The IT department believes the infection arrived via an email attachment through an employee’s personal webmail client. The company files a five-figure damage claim with its employee liability insurer, but the insurer refuses to pay. The policy “covers the compensation of damages caused by an employee to the employer or a third party in the performance of work duties” (Source: wko.at). Strictly speaking, checking private emails does not fall into this category. If personal liability insurance exists, it will demand conclusive proof that the insured party was directly responsible for the damage. Can you prove who accessed the internet, when, and what they did there? Perhaps not, as companies generally do not wish to spy on their staff—leaving aside the fact that doing so arbitrarily is legally restricted.

If the employer does not wish to bear the loss themselves, civil litigation is the only remaining option. This is rarely a pleasant prospect for either party; employment relationships seldom survive such measures, and depending on the extent of the damages and the interpretation of the courts, it can even threaten private or corporate livelihood.

What can be done to prevent such a scenario in the first place? You have already taken the first step by reading this article. For business-related internet usage, companies already deploy a wide range of network solutions that improve security. Consider personal usage as well and treat these users as what they essentially are—guests in your system:

• Clearly define what is permitted

This includes schedules, maximum total duration, and potentially blocking certain websites and activities. This can be stipulated in the employment contract or in a separate agreement, and ideally implemented directly within the network infrastructure.

• Set up separate guest access

An Internet Access Control System is ideally suited for assigning each user specific time windows, quotas, data allowances, bandwidths, etc., and completely walling off individual areas or websites. With IACBOX, it is even possible to identify user devices and encrypt the WiFi segment from the access point to the endpoint.

• Authenticate your users

With IACBOX, you do not need to maintain separate lists; each user can be created seamlessly from existing directory data thanks to external authentication.

• Utilize detailed logging

Once each user has a dedicated ID, data volumes and usage times can be tracked and assigned. Activity can be audited without prying into personal details or inspecting a user’s device.