FRANCE—Letting fitness prevail over IT security: A risky choice for employees

 

A company’s sales manager asked a secretary to give him access to the client database, although he was not an authorized user for this category of clients. In violation of the company’s IT policy, she let her supervisor use her passwords, and she activated the functionality, giving him access to the database. As she was eager to get to the gym, she did not want to wait for the software to upload, so she left the supervisor alone for a short time in front of her computer. The supervisor took advantage of the situation by downloading clients’ contact details and sending the files to his e-mail address using the professional mailbox of the secretary.

The secretary was dismissed for serious misconduct.

The dismissed employee attempted to argue that her seniority and the absence of previous misconduct mitigated the seriousness of the misconduct and that she merely obeyed the instructions given by a sales manager who had authority over her.

However, these arguments did not convince the Supreme Court, which, in a decision of 5 July 2011, decided that the dismissal was lawful because she had violated the company’s IT policy.

To understand the decision of the Supreme Court, it must be noted that many contact details of clients had been downloaded by a non-authorized employee, and the dismissed employee was aware that the supervisor’s request was unusual. She was also aware of the company’s IT policy. Moreover, it appeared that the violation of the IT policy was not motivated by the fear to disobey a supervisor but by the potential of being late to the gym.