european-union data-protection security
The right to hide one&#39;s password
<p>It's well known that <a href="https://security.stackexchange.com/questions/5539/is-it-ok-to-tell-your-password-to-your-companys-sysadmin">you should never reveal your password to anyone</a> -- including your boss, your sysadmin, etc. My friend's former boss has sued her, demanding (among other things) the password to her account on the company's Mac laptop she used for work. (They have the laptop but claim they cannot use it w/out the password.)</p>
<p>I am asking for an <em>authoritive reference</em> to a regulation, law, best practice or whatever for a case like this, where &quot;authoritive&quot; means something more authoritive for a judge than a SE answer -- e.g. a law, a textbook, an Apple manual, a sysadmin rulebook or something along the lines. Ideally, the reference should also state the prescribed practice as &quot;absolutely universal&quot; (or maybe even better) Mac- or EU-specific (the company is in EU).</p>
<p>A related question: are passwords covered by data protection regulations (e.g. GDPR)?</p>

<p>You have the right to keep your password secret. But if this causes damages, you can be held responsible for the damages.</p>
<p>Simple example: Your company provided iPhone, worth £1,000, is protected with your passcode. Without that passcode it is literally unusable. You refuse to provide the passcode. If you refuse to provide the passcode, AND refuse to reset the phone using your passcode, you can be held responsible for the damages.</p>
<p>Another example: Your computer, containing your work product that is owned by the company, is protected with your password. If you refuse to hand over the password AND refuse to change the password to 1234 for example, you can be held responsible for damages.</p>
<p>You don’t have to provide your password, but you have to prevent damages caused by this.</p>

<p>The GDPR requires the processing entity to apply &quot;Appropriate Technical and Organisational Measures&quot; to ensure compliance. Article 32 says</p>
<blockquote>
<p>Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, [...]</p>
</blockquote>
<p>Article 40 (2) says</p>
<blockquote>
<p>Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation<br />
[...]<br />
(h) the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32;</p>
</blockquote>
<p>These articles do <strong>not</strong> spell out directly that revealing passwords is against proper TOM, but in my judgement revealing a personalized password is not in accordance with the state of the art. When there is a technical requirement to share secrets between several individuals, they should be kept in a secure system where each user has an individual, non-shared access that can be logged.</p>
<p>But involving the GDPR that was might not be the most reasonable or constructive solution to the problem. This isn't really a question for Law SE, it is one for The Workplace SE or Information Security SE.</p>
<p>If the laptop contains only business/professional data, help them to recover that data. Meet in a cafe or somewhere like that. Log in. Copy all data files onto a stick. If your friend is the only one with an admin account, have her create <em>another</em> admin user for the company.</p>
<p>If the situation is tense, bring a witness and have the company sign a protocol of what was done and precisely when. This <em>should</em> have been done during out-processing.</p>
