Mayor Unlawfully Accessed Ex-Employee's Facebook Account via Work Computer
Written by AI from the linked story. Not reviewed by an editor. How this works
A Polish city mayor accessed a former employee's personal Facebook account through their work computer, using private messages as evidence in disciplinary and criminal proceedings. Poland's Supreme Administrative Court ruled this constituted unlawful processing of personal data under GDPR, as login credentials, profile data, and private conversations all qualify as personal data. This case highlights the critical risk of privileged individuals abusing access to organisational devices to harvest personal information. It underscores that authority over workplace equipment does not grant legal rights to access employees' personal accounts or communications, and that GDPR protections extend to data encountered incidentally on work systems.
Tactical Insight
Immediate actions
- Establish and enforce a clear Acceptable Use Policy (AUP) that explicitly prohibits accessing employees' personal accounts or private data stored on work devices.
- Remove or restrict access to former employees' work devices immediately upon termination, with a documented chain-of-custody process.
Long-term improvements
- Implement technical controls (e.g., browser profile separation, DLP tools) to prevent personal account credentials from being stored or accessible on corporate devices.
- Mandate GDPR and data privacy training for all managers and executives, with specific scenarios covering employee data rights.
- Establish a formal data access governance policy requiring documented legal basis before any personal data on organisational systems is reviewed.
Detection & Accountability measures
- Enable audit logging on all work devices and systems to record access events, ensuring logs are reviewed by an independent party rather than line management.
- Implement a clear whistleblower and data breach reporting channel so employees can report potential GDPR violations without fear of retaliation.