Question about personal data at work

[arduino88]

At work I've been asked to email my username and password to someone in one of our other offices, their argument is that they need this to set up a new laptop for me.

Giving someone my login details allows them to view/alter my bank details (where I get paid), my pension details, as well as view my national insurance number, access to view/send emails as me.

Having worked in the computer industry, giving people your login credentials is an obvious no no.
Is it even legal to ask an employee to provide such details, giving people I've never met access to the above data?

Thanks in advance.

[FlamingParrot]

Re: Question about personal data at work

I'm shocked to see your desktop P/W gives access to all that private information! :jaw: Normally the company log in merely allows people to access the corporate network and intranet, not their own personal details, which should be held privately by HR. IT people can easily reset user passwords, so they would all be gaining access to that personal information.

They will need your log in details to set you up for remote access via your laptop, that's customary, what isn't customary is to use the same log in to access the corporate network and your personnel data!

What sort of business is this?

[arduino88]

Re: Question about personal data at work

Thanks for your reply.

To answer some of your questions, this is a large IT company ( I know ).
Access to someones login gives them access to outlook. Access to anything else can then be granted by clicking the usual "reset password" style links (on the appropriate systems) which in turn email you (keep in mind they'd have access to outlook at this stage) confirming you want to reset your password before providing you with a new one (temporary).

I've worked in the IT industry for 15 years and have never been asked by someone to provide my logon credentials. This is a world wide windows domain, software roll outs are automated. There is no logical reason for them to login as me and perform any operation.

Thank you for your time.

[Eloise01]

Re: Question about personal data at work

Answering the actual question, yes it's legal to ask for them. There is no law that says they can't ask! I would share concern about data security if it is really that easy to access other information with just that information because that would suggest the IT department have permanent access to it by dint of their ability to set and change user names and passwords! However I suspect if you check your employers policies, they will have the authority too monitor email you send and receive anyway.

It might sound rather obvious, but have you discussed your concerns with your employer?

[arduino88]

Re: Question about personal data at work

Thank you.

I've contacted our the security team, who after a week have taken no action.
After the weeks delay I've contacted their head of department, who states that they're aware of the problem and are working on resolving the issue by changing the process. I doubt that'll happen any time soon.

Thanks for your reply.

P.S. By not giving them these details I don't get my new work laptop which I need, however I refuse to partake in such stupidity.

[Eloise01]

Re: Question about personal data at work

So it would appear that your choice is to refuse, or to agree and change the password when set up is complete. Or if you can do it, set it up yourself.

[arduino88]

Re: Question about personal data at work

Indeed, they don't let individuals set this up themselves. The entire process should be automated, which I know can be done.

If I provide these details and something does happen then there's potentially no audit of who carried out the action. Where is if they change my password on the domain and carry out such actions the details of who changed the password are audited. Hence I'm not to blame.

Thanks again

[enquirer]

Re: Question about personal data at work

FlamingParrot is right. Global access like this is a no-no.