Access to employees files.

[JaffaC121]

Hi all,

 

The Business Manager has asked me to grant access to an employees files while she is off with stress. I have also previously been asked to give access to employees files & emails after they have left. Is there any rules and regulations on this? I am not 100% comfortable giving others access to files and emails without the employee's consent.

 

Cheers

[witch]

Can you see if there is something employees signed when they started? This might mention other people's access to their files which would give you your answer

[thimon]

You have to remember that this is the user's WORK email and user account, not personal account. As long as you've got it somewhere in your school policy that a line manager can request access to a staff members account for X reason, with the request sent in writing to your ict email / service desk, then I don't see the problem.

[DrCheese]

Management do not need the employee's consent to view their documents or emails created/managed on the school system (At least if you have a half decent AUP) - You should do these more or less without question (Document in writing if you're worried) as you aren't privy to what or why SMT may need access to these files.

 

I draw the line at being asked to provide access to anything personal (i.e if the user left themselves auto logged on to personal accounts & you reset their password) but I have used evidence from a personal email account that was screen captured via Netsupport DNA before which was valid (Basically don't log onto anything you wouldn't want work to see on a work system!!)

[noelmm]

As long as I have these types of requests in writing from the Business Manager or Principal I don't have a problem. When a new member of staff starts I inform them that I am able to access their documents etc. but only at the request of certain people, I always give the example of long term illness as a potential reason.

[hardtailstar]

Our policy here is that the request needs to go to the head teacher and then they will ask us to give access.

 

Check your AUP and just double check any other related policies.

[Rob_D]

Same sort of thing here. We've done it on the odd occasion (mostly with people who have left), but it has to be signed off by the head.

[rom1984]

Were asked to mark any emails/folders etc as "personal" if they contain something personal that we wouldn't want the employer to access. It will generally be honoured that these will not be manually accessed (unless there is a good reason not to honour it)

[thimon]

(unless there is a good reason not to honour it)

Kinda defeats the point

[DrCheese]

Yeah you're setting yourself up for headaches with that, especially if you have to take staff to a disciplinary - A blanket "We reserve the right to view everything" in your AUP is required.

[enjay]

Were asked to mark any emails/folders etc as "personal" if they contain something personal that we wouldn't want the employer to access

 

How do you mark an email as personal? Folder yes, but not individual emails. Also, if you search for a document/email, you might not know the folder it is in.

 

It will generally be honoured that these will not be manually accessed (unless there is a good reason not to honour it)

 

And who decides whether the reason is good enough? Is that decision-making process documented?

 

 

Staff here are told IT can see anything and everything which happens on school-owned devices, including personal phones etc connected to school wifi, but will only access this information if needed as part of their job. Leavers are told to tidy their email and documents before leaving, and once they've left, their line manager is granted access for 2 months. My team are told not to open any folders named "personal"; if they absolutely have to open one (e.g. a server has fallen over due to a 200GB "personal" folder), they are to approach me first (and I in turn would probably approach the HT or SBM, or maybe act then inform later depending on the severity of the situation) and we'll then view the folder together if needed. Thankfully I am yet to need to do anything like that.

 

I suppose there's a risk of my team seeing a file name such as "my grievance against mr bloggs.doc" during a routine check of a backup log or similar, but for me that is an acceptable risk. IT staff have access to sensitive information as an essential part of their job, so discretion and professionalism is expected.

[MatthewL]

In my eyes there should never be anything of "personal" on work network, same with emails I have a personal email account for that purpose. Anything sent and received at work is forwarded to personal account if needed and deleted unless it relates to my job.

 

I certainly don't store anything personal on my area, most I have is a mileage form or two etc or change of details type forms as these are work related.

[Rob_D]

I certainly don't store anything personal on my area, most I have is a mileage form or two etc or change of details type forms as these are work related.

 

I'm the same. But I wonder if that's because our access gives us a very abject lesson in what other people can potentially see.

[enjay]

In my eyes there should never be anything of "personal" on work network, same with emails I have a personal email account for that purpose. Anything sent and received at work is forwarded to personal account if needed and deleted unless it relates to my job.

 

I certainly don't store anything personal on my area, most I have is a mileage form or two etc or change of details type forms as these are work related.

 

Perhaps true (although I know people who don't have a PC at home, so only use their school-provided laptop), but we're venturing slightly off-topic here. The original question was about granting access to a user's entire folder, not just any personal information they may or may not have. Certainly, there are documents and emails in my account which are confidential in nature and I wouldn't want just anyone to access.

[mavhc]

Don't use a work computer for things you don't want people at work to see. If you have no computer, no phone, no tablet, then get a better job so you can buy one, or buy a pen and paper.

 

It's not as obvious at my new school, but I set up the last school with a mapped drive that gave read only access to every teacher's home drive (but not SMT), that way people were reminded of the policy they agreed to

[enjay]

Don't use a work computer for things you don't want people at work to see. If you have no computer, no phone, no tablet, then get a better job so you can buy one, or buy a pen and paper.

 

It's not as obvious at my new school, but I set up the last school with a mapped drive that gave read only access to every teacher's home drive (but not SMT), that way people were reminded of the policy they agreed to

 

So all staff can see everyone's appraisals? And disciplinaries? and confidential safeguarding data?

[mavhc]

So all staff can see everyone's appraisals? And disciplinaries? and confidential safeguarding data?

 

No, because their weren't stored on their home drives

[enjay]

No, because their weren't stored on their home drives

 

Where do managers store such things, then?

[PotNoodleTech]

The headteacher can request this of you, I would suggest you get it in writing or on email and then comply with their wishes. May also be an idea to keep a little spreadsheet of requests, handy if things with the other member of staff turn into a disciplinary 2 years down the line and all of a sudden you've got people asking you when was this asked, when did you do this, etc.

 

Any work created during school time on school devices is property of the school, not the teacher.

[Rob_D]

Don't use a work computer for things you don't want people at work to see. If you have no computer, no phone, no tablet, then get a better job so you can buy one, or buy a pen and paper.

It's not as obvious at my new school, but I set up the last school with a mapped drive that gave read only access to every teacher's home drive (but not SMT), that way people were reminded of the policy they agreed to

 

If you're going to do that, why bother with home drives at all? Why not just have everyone using a shared drive?

 

I could see it pushing staff into using USB drives as somewhere to work on and store files they don't want others to see yet.

[mavhc]

People who deal with sensitive matters are in a different group, not readable. You have home drives because they're read only to everyone else. Most things end up on a shared drive anyway.

[TechMonkey]

Don't use a work computer for things you don't want people at work to see. If you have no computer, no phone, no tablet, then get a better job so you can buy one, or buy a pen and paper.

 

It's not as obvious at my new school, but I set up the last school with a mapped drive that gave read only access to every teacher's home drive (but not SMT), that way people were reminded of the policy they agreed to

 

That is asking for trouble. Surefire way to end up in a tribunal

[mavhc]

That is asking for trouble. Surefire way to end up in a tribunal

 

Why?

 

...

[MatthewL]

My new employer doesn't have home drive for users. The idea is all is done for work and is work for said team. Exception for a small number of users but I was quite surprised to see that.

[TechMonkey]

Why?

 

...

 

There is a massive difference between your employer may look at your files and everyone can look at your files willy nilly.

 

Where do standard users store their Appraisals, reviews or sensitive documents that are meant to be for them and their line managers eyes only now that everyone can now look? Disciplinary matters, bereavement issues, medical or mental health documents.

 

What if something is downloaded that someone else looks at that is either misinterpreted or causes issues? What about medical or sickness documents that may need to be saved to a home area to be passed on to management?

 

The better question is why does everyone need access to all documents, even read only? Just to prove your point that you want to stick to? It ignores best practice of the principle of least privilege. One mistake, one accidental save, and you have the potential to cause massive HR/employment issues. As I said great shortcut to a tribunal and a complete disregard or ignorance of potential issues.