Let&#39;s say a UK employer doesn&#39;t have a password policy - can they insist that an employee divulge a password used on a client&#39;s systems?
<p>Purely a hypothetical scenario:</p>
<p>UK employer is an agency with various teams that provide services - some of which are digital - to a third party.</p>
<p>The employees create accounts on the third party's systems in order to do this.</p>
<p>The employer or the third party then request that the employee hands that password to a boss/manager/IT type person for whatever reason.</p>
<p>No password policy has been shared with the employee.</p>
<p>Where does the employee stand if they didn't feel right handing over a password?  We don't know why.  Let's assume they weren't very careful and used a password that they also use for personal accounts or something.  There was no password policy after all.</p>
<p>Let's say that the employee isn't being given a chance to change the password first.  Also, the third party could easily have IT reset the employee's password (obviously), begging the question why they even need the employee's password beyond what they say is standard procedure.</p>
<p>Where do they stand?  Can the employee refuse to share the password?</p>

<p>There are two different things: The account and my password. If I set up the account to do my job as an employee, it is most likely that the company should have the right to access the account. If I used the same password that I use for my online banking, that's a stupid thing to do and I am quite sure the company doesn't have the right to this particular password.</p>
<p>As an employee, I would have to change the password to something unique that isn't connected to me, and that cannot be used by the company or anyone against me, and <em>then</em> hand over that password.</p>
<p>In the strange situation that the password cannot be changed, I and the company have a problem. And I might end up changing my online banking password. As I said, using it in the first place was stupid.</p>

united-kingdom workplace personal-information