Legal question: Dispute with client

[diesel]

However since my termination they sent my work PC off for forensic examination.
Cheers

did u use client systems for any other work or sending or receiving emails that are not appropriate? Only reason for such an investigation is that they had some doubt or reason you were doing something more than you should be? is your work for the government hence the forensic investigation?

I heard where I work that not IT are not allowed to access even the local drive on any persons desktop as this is infringement of DPA according to the client where I am working now.

[malvolio]

The client's policy may state the individual is liable for breaches of their security policy.

However as you have no copy of the policy or signed something personally to agree to this, get a solicitor to write the client and the umbrella a nasty letter.

Just wondering if there was a disclaimer on the log in screen - you know, the one we all just ignore and hit OK to get to the username prompt...

'Cos that's all the notification the client need give.

Also ignoring security protocols is very serious to the client: it can invalidate their own insurances and risk their PCI/DSS or HMG Accreditations.

[GazCol]

Can you get a copy of the client’s IT and HR policy? Most private companies will have something in their HR policy that states access to an employee or contractors PC and/or inbox can only be granted if it’s as a result of a criminal investigation, bringing the company into disrepute or is business critical. You might find the IT policy contradicts their HR policy – one tends to be written by bods that should stick to writing code and the other tends to be written by a lawyer.

Either way you need impartial legal advice, rather than contact your umbrella or agency I would get something arranged at the CAB first off.

[northernladuk]

I don't know if ignorance of site IT and security policies is a defence in your legal issue it is an believably stupid thing for you to do and highly unprofessional IMO. ALL large sites have policies and they obviously have a tight one with the USB issue. As a supplier to a client I would argue an obligation on your part to make sure you know. Saying they didn't give you the paper isn't an argument in my book. You find out what it is, especially using dropbox and other cloud media to store client information on. You run a company providing services, surely you have a responsibility to make sure you adhere to client policy and procedures.

[GazCol]

I don't know if ignorance of site IT and security policies is a defence in your legal issue it is an believably stupid thing for you to do and highly unprofessional IMO. ALL large sites have policies and they obviously have a tight one with the USB issue. As a supplier to a client I would argue an obligation on your part to make sure you know. Saying they didn't give you the paper isn't an argument in my book. You find out what it is, especially using dropbox and other cloud media to store client information on. You run a company providing services, surely you have a responsibility to make sure you adhere to client policy and procedures.

The other side of that coin is that it's unbeliveably stupid for a clientco not to make contractors aware of IT security policies, not to mention if a manager at that company is giving advice that contradicts any policy.

[original PM]

I don't know if ignorance of site IT and security policies is a defence in your legal issue it is an believably stupid thing for you to do and highly unprofessional IMO. ALL large sites have policies and they obviously have a tight one with the USB issue. As a supplier to a client I would argue an obligation on your part to make sure you know. Saying they didn't give you the paper isn't an argument in my book. You find out what it is, especially using dropbox and other cloud media to store client information on. You run a company providing services, surely you have a responsibility to make sure you adhere to client policy and procedures.

No he does not he is with a brolly - and for me that is key they cannot proesecute him directly - they can only go after the company.

The brolly should then (assuming standard T&C's with a brolly which always seem to mention things about complying with any security/health and safety rules and regs for a client site) look to punish the employee - can they prosecute?
Well that will be interesting to see.

[diesel]

my client is a FTSE company...surprisingly they allow USB, drop box access etc...you visit the IT guys and they are using utube and ebay all day!
I has a small independent client 2 years ago and they had a no USB policy....but people still used drop box.

[northernladuk]

The other side of that coin is that it's unbeliveably stupid for a clientco not to make contractors aware of IT security policies, not to mention if a manager at that company is giving advice that contradicts any policy.

I agree but I am more likely to think this is a failure in process rather than a purposeful act and there are a lot of people in this chain. Could be worth finding out what the process is to get these documents. I am wondering if it is in fact the agencies responsibility to make sure the contractor is prepared for site before he get's there. After all there is no connection between the contractor and the client.

[northernladuk]

No he does not he is with a brolly - and for me that is key they cannot proesecute him directly - they can only go after the company.

The brolly should then (assuming standard T&C's with a brolly which always seem to mention things about complying with any security/health and safety rules and regs for a client site) look to punish the employee - can they prosecute?
Well that will be interesting to see.

Apologies, quite correct. Still unprofessional of him to ignore them.

[DirtyDog]

Apologies, quite correct. Still unprofessional of him to ignore them.

To be punished for something which has had implicit (or even explicit) approval from management isn't professional.