Privacy at the Workplace

2

SURVEY REPORT

Privacy at the Workplace

in Hungary and Germany

/ The Project is co-funded by the European Union's
Fundamental Rights and Citizenship Programme

February 2012

Privacy at the Workplace in Hungary and Germany

2

CONTENTS

SUMMARY 3

PROJECT DETAILS 9

Notes on methodology 12

THE USE OF WORKPLACE COMMUNICATION AND I.T. EQUIPMENT FOR PRIVATE PURPOSES 14

Frequency of private use 14

Socio-demographic correlations 18

Employers’ assessment of the use of workplace equipment for private purposes 19

Justified sanctions for unauthorized use of workplace equipment as perceived by employer representatives 26

DATA PRACTICES AT THE WORKPLACE 27

Monitoring communication and IT equipment at the workplace 27

Workplace characteristics in terms of privacy and data protection 30

The level of privacy regulation at the workplace 33

Information on privacy issues at the workplace 37

Remedies 41

DATA PROTECTION AWARENESS 45

ATTITUDES TO DATA PROTECTION 52

LIST OF DIAGRAMS AND TABLES 59

SUMMARY

The extent of IT equipment use for private purposes at the workplace / In Hungary, the majority of employees use the internet during work hours to access content unrelated to their jobs, and more than one third take advantage of other means of communication and information technology for their own private purposes while on the job. Fewer than one fifth of the respondents said they did not to use any of the opportunities listed. Employees in Germany rely less on workplace IT devices to private ends, although their phone use and receipt of private mail is comparable to that of their Hungarian counterparts. In Germany, 28% claim they do not resort for personal use to any communication media belonging to the employer. The difference between the two countries in this regard is probably rooted in the fact that employers in Germany are more prone to place restrictions on the use of IT requirement and to monitor computers at the workplace.
Employers assume an extent of private use that is much greater than admitted by employees, in Hungary as in Germany, but for each technology those who believe that employees habitually abuse communication devices remain the minority. The internet is generally presumed to be the medium most heavily used for private purposes, which is directly related to why employers in both countries reckon that it is the use of this medium whose restriction can do the most to improve work efficiency.
Private use of workplace equipment from the perspective of employers / In terms of the potential to improve efficiency, Hungarian employers accord greater significance and benefits to privacy-related restrictions than do employers in Germany, despite the fact that the latter believe that the private use of workplace equipment inflicts more harm on the employer.
Half of the employers in Hungary considers it worthwhile to restrict internet use, and the majority are convinced that camera surveillance and electronic entry systems have a positive impact on work efficiency.
In both countries, only a minority are of the opinion that employee use of communication and IT equipment for private purposes causes significant damage, although German employers deem the problem to be more serious than do Hungarians. For instance, 11% of Hungarian employers believe that logging on to community portals at work causes significant damage — a view shared by 29% of employers in Germany.
Senior employees in both countries identified the loss of work time as the biggest risk of using equipment for private purposes, followed by the increased likelihood of unauthorized access to corporate data and greater exposure to viruses. A similar portion of employers in each country ( 26% in Hungary and 23% in Germany) estimate that the risk involved in such uses is zero to negligible.
Albeit the majority regards the problem as less than serious, most would seem to be ready to sanction unauthorized equipment use. The sanctions most commonly found acceptable are, in this order, reimbursement of the costs incurred, disciplinary action, and termination — this last being regarded as an equitable repercussion by no more than 14-15%. An even smaller minority of employer officials (3 and 4%, respectively) offered the view that no sanction whatsoever would be called for.
Data processing practices at the workplace / Employee opinion suggests that, in both Hungary and Germany, only a minority of employers curb employee privacy by monitoring information flow via communication and IT equipment and by tracing employee movement. Employers are less likely to violate employee privacy rights in the eye of German employees than according to Hungarian employees (i.e., they are seen as less prone to monitor regular and e-mail content and to resort to camera surveillance). In Germany, however, more emphasis is placed on prevention than in Hungary, with stronger control of internet use, deeper inspection of computer files, and a more widespread reliance on electronic entry systems.
Generally, the monitoring of personal communication does not correlate with the size of the employer. By contrast, internet restriction, electronic file inspection, and camera surveillance tend to be typical of larger employers, both in Hungary and Germany.
The employee sample suggests that data protection in Hungary is better regulated and institutionalized than would appear to be the case according to the employer sample. In the assessment of employees, one out of four workplaces has an appointed privacy officer, compared to only 13% according to the employers asked. Also, employees are more likely than their employers to believe that the rules of processing personal data at the workplace are well-documented and accessible.
In both Hungary and Germany, the level of organization of data protection does correlate with the size of the employer, with larger corporations more likely than smaller companies to have in place an assigned privacy officer, a well-documented and readily accessible policy, and a rigorous inspection protocol.
The level of privacy regulation / Employees reckon that the majority of employers in Hungary provide for most of the aspects of data protection under concerned in this survey. It is only in regard to email monitoring, community portal use, and camera surveillance that respondents aware of an internal policy remain the minority. On the other hand, in the assessment of employers, only the opening of mail and private telephone use are subject to policy rules, and then only at a narrow majority of workplaces. In a few cases, it is true for Germany as well that employees assume a level of regulation that is higher than presumed by the employers.
Comparing the situation in the two countries overall, it can be said that employers in Germany are more likely than in Hungary to have provided for issues of processing data.
It is true for both Hungary and Germany that larger employers with at least 50 employees are more likely to have a policy in place that regulates the processing of employee data.
Information on privacy issues at the workplace / In Hungary, 30 percent of employees claim that the privacy rules at the workplace, if any, were not made known to them in any manner; this ratio is only 14% in Germany. In both countries, around 30% of employers report that they have no privacy policy in place.
Employees are most often advised of the internal privacy policy verbally or in writing in both countries. The second most common form of advising employees is to have them sign a privacy statement; this in turn is followed by information provided by the privacy officer. Larger employers in both Hungary and Germany are more likely to enshrine and communicate these rules in one form or another.
Remedies / The primary source of remedy against abuses known to Hungarian employees is the workplace supervisor (this is how one out of three employees answered the question), followed by the Data Protection Commissioner and the labor court, according to the employees. No more than one out of 10 employees would turn to a competent internal institution such as a works council or privacy officer. By contrast, in Germany the works council is identified (by 30%) as the number one forum addressing grievances, and more than one fifth of employees also identified the privacy officer as a source of remedy.
Data protection awareness / By and large, Hungarian employees appear to attribute more rights to the employer than their German counterparts: For nearly every data category under review, a much larger share of Hungarian employees believe that the employer may rightfully hold and process their data. What employees tend to think about the rights of their employers usually correlates with the given level of privacy regulation at the workplace and the manner in which employers are advised of the rules. In Hungary, employees will invariably be more likely to believe that their employer is entitled to process a variety of their data if there is a data processing/data protection policy in place at the workplace.
The influence of regulation upon the awareness of and assumptions about privacy issues makes itself felt particularly strongly when rules are in place in respect of a specific medium. In jobs where internet use is subject to rules, 73% of respondents — compared to the average 45% — are of the opinion that the employer has the right to know which web sites have been visited by the employee.
Accordingly, at larger companies, where privacy regulation is more advanced and monitoring more common, respondents are more likely to think that the employer may rightfully hold and process such data as footage recorded by security cameras, the address of visited web sites, and even comments posted in chat rooms.
Attitudes to data protection / Employees in Hungary seem to perceive more ample maneuvering space in terms of privacy issues than employers and German employees. They are, however, far less problem-sensitive than German employees, even as they tend to better concede monitoring by the employer as being both necessary and justified.
The degree of self-determination attributed to employees by Hungarian employers is not only far smaller than that in the eyes Hungarian employees, but in comparison with the German set as well. Besides weaker control by the employee, Hungarian employers also perceive weaker problem-sensitivity than we find in the German sample.
What all of this shows, then, is that — when it comes to privacy issues — employers in Hungary do not feel apprehensive about their employees or their ability to enforce their rights, while in Germany they do. This picture is reinforced by the fact that, going by the assumption of German employers, employees would seem more problem-sensitive than they consider themselves to be.

PROJECT DETAILS

Client / University of Pécs
Researcher / Ipsos Zrt.
Date of survey / February 2012
Data collection method / Online
Population / Employees and employers in Hungary and Germany
Sampling / The sample is representative of Hungarian and German workplaces according to the size of the company
Sample size / Employees in Hungary and Germany: 500 persons each
Employers in Hungary and Germany: 200 persons each

Diagram 1: Sample composition – employees (%)

Hungary / Germany
BY NUMBER OF EMPLOYEES
under 50 / 57 / 36
50-249 / 32 / 19
over 249 / 11 / 45
BY REGION
Central Hungary / 47 / Baden-Württemberg / 8
Central Transdanubia / 9 / Freistaat Bayern / 20
Western Transdanubia / 8 / Berlin / 4
Southern Transdanubia / 7 / Brandenburg / 2
Northern Transdanubia / 8 / Bremen / 1
North Great Plain / 11 / Hamburg / 4
South Great Plain / 10 / Hessen / 9
Mecklenburg-Vorpommern / 1
Niedersachsen / 7
Nordrhein-Westfalen / 18
Rheinland–Pfalz / 7
Saarland / 1
Freistaat Sachsen / 9
Sachsen-Anhalt / 1
Schleswig-Holstein / 4
Freistaat Thüringen / 4
BY SEX
men / 54 / 55
women / 46 / 45
BY AGE
18-30 / 21 / 21
31-45 / 40 / 45
46 or older / 39 / 34
BY HIGHEST EDUCATION COMPLETED
elementary / 7 / 5
secondary / 50 / 54
higher / 43 / 41
BY SECTOR
industry / 18 / 18
services / 34 / 45
agriculture / 2 / 0
public administration/services / 26 / 16
other / 20 / 21

Diagram 2: Sample composition – employers (%)

Hungary / Germany
BY NUMBER OF EMPLOYEES
under 50 / 93 / 93
50-249 / 3 / 4
over 249 / 3 / 4
BY REGION
Central Hungary / 56 / Baden-Württemberg / 9
Central Transdanubia / 8 / Freistaat Bayern / 13
Western Transdanubia / 8 / Berlin / 5
Southern Transdanubia / 6 / Brandenburg / 3
Northern Transdanubia / 8 / Bremen / 1
North Great Plain / 5 / Hamburg / 3
South Great Plain / 8 / Hessen / 6
Mecklenburg-Vorpommern / 2
Niedersachsen / 10
Nordrhein-Westfalen / 26
Rheinland–Pfalz / 5
Saarland / 3
Freistaat Sachsen / 4
Sachsen-Anhalt / 4
Schleswig-Holstein / 4
Freistaat Thüringen / 4
BY RESPONDENT POSITION
highest / 68
lower / 32
lowest / -
BY SECTOR
industry / 30 / 14
services / 45 / 48
agriculture / 4 / 1
public administration/services / 4 / 19
other / 17 / 19

Notes on methodology

The survey sample represents workplaces, for both employees and employers, by the number of individuals employed, broken down into groups of companies with under 50, 50 to 249 and, respectively, 250 or more employees. The low real ratio of companies with over 250 employees in the 200-specimen sample results in a very low element number for employers. To offset the problem, these companies were given in the sample a higher share than they actually possess in the total, and representativity was ensured by weighting. However, in order to avoid using the weighted low element number as the basis from which to draw conclusions with regard to the privacy practices of the largest companies in the survey, categories by company size have been examined without this representational weighting.