Monday, July 13, 2009

Data Protection Act?

I was recently made redundant from my job, yet while I was there, they never produced to me any type of document that I was required to put my signature on. I worked there for 3 months, as a full time, permanent employee, and another colleague started on the same day as me, and they also were not forced to sign any document, we were not even shown these contracts. I only realised they issued contracts, as current employees had shown them to me. Our manager had informed us that he would get them over to us, when we started, but we never recieved them? I recently logged onto my companies database since being out of work and they telephoned me, stating I was in violation of their Data Protection Act and could take action against me, I said I'm happy for them to do so as I have not signed anything against my name. 1) Were they illegal not to provide me with a contract? 2) They surely cant win a court case regarding this matter can they?
Answers:
(UK)
The company should, by law, have supplied you with a written statement of particulars (the basic terms of your contact) within 8 weeks of you starting there. It is not necessary for you to sign this - by working for them and them paying you, you have entered into a contract.
Regarding the 'Data Protection' incident. You have not done anything to contravene their data protection policy as you are not bound by this - you no longer work for them. What can they do, sack you? They didn;t even get you to sign a data protection/IT accaptable use policy when you worked there!
Are they claiming that you are in breach of the Data Protection Act? How so? You have not illegally hacked into a computer. You have merely accessed a database using a password that was given to you. The company has a legal obligation to protect the data it holds - in allowing you easy access to the site after you have left I would suggest that they are at risk of being sued by many of their customers! If they want to push this one explain that you wished to demostrate lapses in the companies data protection procedures and hreaten to take this one to the local/national press to demonstrate the woefully inadequate security of this company's database. In fact, I'd be tempted to do this anyway!
what
They have poor IT security if you can still access the database after you no longer work there.
You can sue them for breach of employment law for not giving you a contract.

They can take action against you for logging into their database - but I would have thought they should have better security measures in place and should have changed passwords etc. Guess it depends on what you were looking at on the database - if you were trying to use the information for personal gain, or to sabotage the company, then they can take action.

Get advice from ACAS or CAB, and ignore all phone calls etc!!
It is not illegal for a company to fail to provide you with a contract, whether it be an employment contract, a non-compete contract, or a non-disclosure contract. However, it is probably illegal and certainly civilly actionable for you, as a former employee, to access the company's database. Even without a contract, a court would likely impute the knowledge to you that you may not utilize company resources after your employment has ended. If I were you I would stay the hell out of their database.
Umm, you logged onto the company database and you don't work for them anymore? Thats spying, which it could be considered corporate espionage. Also, if you had access to change any data, thats another potential nono. It doesn't matter whether or not you signed something. That contract could have had to do with everything you do while under said contract is owned by the company.

Why did you log onto the company database if you don't work for them anymore?
Scott F is spot on.

In many jurisdictions, you committed trespass to computer, which can be a tort, or a misdemeanor, or a felony. In the US, there is also a federal statute, the Federal Computer Crimes Act, which applies when, among other things, you knowingly access a protected computer facility in excess of your aurthority to do so. Having been terminated from your job, would you just casually saunter back to your cubicle and act as if you were still working there? Of course not! Its no different when your cyberself moseys on in to a database. Now you might have a defense on the first bite of the apple by saying, gee, I didn't know that the database belongs to the company and I'm not entitled to look at it. In New York State, people have been sentenced to substantial prison terms for returning to the company's internal network after being told to bugger off.

Any questions?
If you are in the UK, go to the Citizens'Advice Bureau. They should help.

Entering into your old employer's internet is impossible unless the IT and RH depts are incompetent. They will not take action because if they do they will show all interested persons that their IT sytem is not secure.

Make sure that they paid your tax and social security payments.

No comments:

Post a Comment