To think my boss shouldn't have access to my emails?

[thepartysover]

I'm soon to be going on maternity leave and as part of my handover my boss has asked for the password to my work email address "so that nothing gets missed".

I will be setting up an out of office email response (including the relevant people to contact in any instance) - am I being unreasonable to say no to this, or does my boss have the right to access my correspondence?

[Kko1986]

As an ex IT engineer He has to have hr approval. Also passwords should never be shared as IT he can just give himself permission to your mailbox and add it to his email.

[DGRossetti]

No this is not appropriate and I'm shocked anyone working in IT would request this.

Conversely I'm not ... although I totally agree it's not appropriate ...

[NiceLegsShameAboutTheFace]

There is a difference between allowing colleagues to access your email account and an employer having the right to access your work email.

OK. I'll try and make things easier for you. My employer does not have the right to access my work emails. Other employers, with different policies, are available.

Wouldn't even have to be by law. If an employee was sick and something urgent had come up and the information was on that person's email, as a manager, you should be able to get access to that account to deal with it. It might take time to get access but there should be a policy in place and people should be aware that could happen.

No, I shouldn't. And, in fact, I can't.

[DGRossetti]

My employer does not have the right to access my work emails



I'd hope they had systems in place to ensure employees weren't busy emailing (say) loads of customer details to their personal email accounts though ....

[Blueoasis]

Your boss is the IT guy and he asked for your password? He needs fired, he's terrible at his job.

You NEVER share passwords. People being stupid like that is how breaches mostly happen. Phishing scams happen a lot. Not even your boss should have your password, no one should in your company except you.

I would tell him no, but that you will have all emails sent on to him. It's quite simple to do that.

[DeRigueurMortis]

Sorry just to add, if he wants to access your emails the correct approach is for him to put in a request to have them forwarded to to him for the duration of your maternity leave.

It's something that's easy to do yourself if you're using MS Exchange (just add a "rule") but frankly where I work it would be part of the "maternity protocol" anyway and IT admin would set this up (without anyone needing your password) to re-direct your email to a nominated person - backfill/temp replacement/manager/co-worker etc

[icannotremember]

I wouldn't give him my password, that in itself would be an offence for which I could be seriously disciplined. I would happily set up a rule that all emails I received were automatically forwarded to him, though. No one at work has the right to my passwords, but management have full rights to all content, if that makes sense.

[Purpleartichoke]

Standard business security says he should not have your password, ever. Possible solutions are IT setting up a mirroring so he gets forwards of everything or you simply having an out of office message up that instructs people to email him instead.

As your boss, he does technically have access to your emails because they belong to the company, but is unlikely to be the person actually reviewing your correspondence.

[TheEmojiFormerlyKnownAsPrince]

Sharing email passwords in our place is a disciplinary offence

[DGRossetti]

What about private emails with HR? Sickness or Occupational Health stuff? What about job applications or private files stored on your folders?

You really, really, really should not be using a company provided account to apply for external jobs. Also what "private" files are you storing on work systems ?

[NiceLegsShameAboutTheFace]

I'd hope they had systems in place to ensure employees weren't busy emailing (say) loads of customer details to their personal email accounts though ....

No, we don't. I work for a forward thinking organisation that trusts its staff.

[TinchyP]

"I'd hope they had systems in place to ensure employees weren't busy emailing (say) loads of customer details to their personal email accounts though ..."

Agreed. At my work all emails sent and received are scanned to check the content. Those who think their employer cannot and does not check everything sent and received are fooling themselves, or their employers will shortly be in serious trouble.

[Darkbendis]

Self employed currently, but in all my previous jobs (financial) I was not supposed to give my password of my work email to anyone, and we had to change it regularly so that there was no or little chance to be guessed. Asking for someone's password or giving your password to someone would have resulted in a disciplinary. The IT guy(s) could access my account without my password anyway, if need be, through their own procedures.

[TinchyP]

@NiceLegsShameAboutTheFace it's not about trusting your staff, it's about protecting third parties' data in line with legislation. The response of 'we trust our staff' is not going to satisfy the ICO when there is a massive breach of sensitive data.

[Di11y]

don't share your password but do put formal arrangement in place for access.

[NiceLegsShameAboutTheFace]

Those who think their employer cannot and does not check everything sent and received are fooling themselves, or their employers will shortly be in serious trouble.

Wouldn't disagree. I'm sure that the cleaner at Google can probably read my personal emails too However, third parties are not permitted to access my email inbox: work or personal. They probably can. But they shouldn't.

There's a giant, heavy spanner on the counter in the staff room. I can take it and smash it over someone's head if they piss me off. Or even if they don't. I shouldn't. But I could. And if I were to do so, and was found out, there would be consequences.

[NiceLegsShameAboutTheFace]

it's not about trusting your staff, it's about protecting third parties' data in line with legislation. The response of 'we trust our staff' is not going to satisfy the ICO when there is a massive breach of sensitive data.

It still doesn't alter the fact that my employer, under its own policies, does not have the right to access my emails.

I don't know what else you want me to say. That's my workplace. And they are its rules.

[Samaranian]

gdpr.report/news/2017/11/17/5383/

It's an interesting subject. Under GDPR, employees are entitled to a private life which to a certain extent, entends into work.

[Anewbooknotanewchapter]

I am really worried that my employer has access to my work email account. I have sent private information via work email to colleagues/my line manager related to absences linked to very personal and private events that have affected my ability to do my job/be in work over the last couple of years...... I had no idea IT department could just root through these as and when they pleased.

[WaxOnFeckOff]

You give delegated access as then, if he replies to an email from your account, it doesn't just go as if you have sent it rather than him, it goes from him via your account. I'd be uncomfortable about him accessing as if he is you but perfectly happy to give unlimited access.

[MiniMum97]

No he shouldn't have your password. That is very poor practice security wise. He could send emails pretending to be you!

I also understand from my previous police if with that was very hot on this sort of thing that actually work weren't allowed to read all of your emails. In particular anything marked personal and confidential.

As others have said the proper way to do it is for you to put on a redirect or make him a delegate.

[NiceLegsShameAboutTheFace]

If it helps, we're not permitted to hold third party data in our emails. We have strict rules on data and how its stored.

[NiceLegsShameAboutTheFace]

it's stored

[WaxOnFeckOff]

Policy is generally that managers/hr can be given access to your emails without your permission but only if they have a genuine reason such as suspected fraud or other abuse of policy (bullying, drug dealing etc).

Access with your permission should be done by delegated access.