Is a company liable if someone leaves their bank logged in on a company PC?
<p>If a company sets up computers in a break area for employees to access their timecard, payroll, bank accounts, etc., can the company get in trouble if an employee leaves their private accounts logged in?</p>

<p>The party providing the computer, ISp connecting the computer to the internet, or manufacturer of the computer would not be liable. A person wishing to sue for damages would have to establish that the defendant was negligent in their action. The underlying premise is that all parties have some obligation to all other parties to care, to some extent. The inquiry ask haw
a reasonable
prudent person would behave in this context when pursuing their goals to avoid harming others. A reasonably prudent person would not provide a rack of sharp carving knives on the floor of a daycare center. A reasonably prudent person would provide a rack of sharp carving knives on a work-table at a fish-cleaning business. In both cases, it is possible that a person might cut themselves. In the daycare center, the toddlers on the floor are not assumed to share any of the burden of care, in the fish-store, the employees are assumed to share some of the burden of care.</p>
<p>The ISP knows that it is possible that a person will harm themselves when they surf the web, but that does not make them liable for damages when an irresponsible party deliberately and knowingly connects to a nest of viruses, likewise the computer maker. The alternative is that providing an internet connection always makes you liable, or building a computer: that would be the end of SE. Two parties can significantly and reasonably mitigate the risk: the bank, and the customer. The customer can either decline to use this unsafe computer, or they can take precautions, in particular remembering to log out. The bank can also do certain things without harming their interest: providing ample warnings (which they do), or automatically logging a customer out after a period of inactivity (a metric of the fact that the customer just up and left). Banks do that too.</p>
<p>The only control that could be reasonably be expected from the company, short of simply not providing a computer in the break room, would be filtering to prevent any access to certain kinds of web sites, such as porn sites, banks, or SE. Filtering for the first type of site is overall consistent with reasonable company objectives (which is to accommodate reasonable employee interests in accessing or transmitting information during the work day). Given the reasonable goals of the company, the jury would not likely find that the company had breached their duty to the employee. The jury balances these interests of the parties, and would determine that the company could not be expected to filter out connection requests to banks, and that they can reasonably rely on prudent actions by the employee and bank to prevent whatever happened.</p>

<p>The usual question for questions like this, &quot;what legislation?&quot;</p>
<p>When a company sets up IT infrastructure for use by their employees, it <em>may</em> have to take steps to assure that no personal data is stored there outside established procedures (which would go against the purpose of a break room computer). It <em>may</em> be sufficient if they post a sign, &quot;do not leave personal data,&quot; or make the employees read and sign a policy to that effect.</p>
<p>But all this will not excuse the employee from taking care with bank credentials.</p>

<p>As far as I know, providing a computer for people to use does not make one liable for subsequent theft due to people using that computer carelessly.  If the computer stores passwords so that a subsequent user can easily access an account there might be liability.  There are ways to safeguard against this.</p>
<p>Similarly, if I let someone borrow my car, I am not liable if they take it to the mall and leave their wallet in it and the wallet is stolen in the parking lot.  If the locks don't work and I didn't tell them I might have liability.</p>

privacy data