Your manager calls you into the office and says there has been a problem at work. Maybe someone posted
something about the company online. Maybe they think an employee has been messaging a customer. Then
comes the request: “Give me your Instagram password. If you have nothing to hide, it shouldn’t be a problem.”
Should you hand it over?
In general, your employer does not get unrestricted access to your private social media accounts simply because
you work for them. Your Instagram, Facebook, TikTok or other personal account may contain private
conversations, photographs, contacts and information that have nothing to do with your job. Employment does
not automatically give your boss the right to see all of it.
This is particularly important when an employer asks for your password, rather than information that is already
publicly available. If your Instagram profile is public, for example, your employer may be able to see the same
posts that anyone else can see. Giving them your login details is completely different. A password could allow
someone to access private messages, archived posts, account settings and information about other people who
have communicated with you.
Polish employers have legitimate reasons to protect their businesses. They may need to investigate leaks of
confidential information, protect customers or respond to inappropriate conduct connected with work. Employees
also have obligations toward their employers, and something posted publicly online can sometimes have
workplace consequences. But none of this means that your employer automatically has the right to demand
complete access to your private account.
Personal data is also protected by law. Employers in Poland must comply with rules governing what employee data
they collect and why they collect it. The fact that information might be useful or interesting to an employer does
not automatically mean that they are entitled to obtain it. Accessing a private social media account could expose a
large amount of information that is completely unrelated to the purpose of employment.
You should be particularly careful when your boss tries to obtain access through pressure rather than through a
clear workplace procedure. Statements such as “Everyone has to give us their password,” “If you refuse, we’ll
assume you’re hiding something,” or “Just log in and let me look for five minutes” should make you stop and ask
questions. What exactly does the employer need? Why do they need it? What information are they trying to
verify? Is there a less intrusive way to deal with the problem?
Do not give someone your password simply because they are your manager. Once another person has your login
credentials, you may lose control over what they can see or do with the account. If an employer needs a particular
piece of information for a legitimate reason, that does not necessarily mean they need access to everything else as
well.
There is also an important distinction between a personal account and a social media account that you manage as
part of your job. If a company hires you to run its Instagram page, for example, the employer obviously needs
appropriate access to the company’s account. The same can apply to company email addresses, phones and other
work systems. That is very different from demanding the password to an account that belongs to you personally.
Another difficult situation arises when employers expect workers to use their personal social media profiles for
business. A restaurant may ask employees to promote events on Instagram, or a shop may encourage workers to
repost advertisements. An occasional request is one thing. Requiring employees to turn their private accounts into
company marketing channels is another. Before agreeing, ask whether posting is actually part of your job and
whether the requirement appears anywhere in your employment arrangements.
If your employer demands access to your personal account, stay calm and do not feel pressured into immediately
unlocking your phone or handing over a password. Ask for the request and its reason in writing. Keep copies of
relevant messages and make a note of what was said if the request was made verbally. Most importantly, do not
assume that refusing immediate access means you have done something wrong.
If you believe your employer is improperly demanding access to private information, you can seek advice from a
trade union, labour rights organisation or Poland’s National Labour Inspectorate (Państwowa Inspekcja Pracy –
PIP). If the situation involves the collection or use of your personal data, Poland’s data protection authority (Urząd
Ochrony Danych Osobowych – UODO) may also be relevant.
Your employer may employ you. They do not own your private life. A legitimate workplace concern does not
automatically give your boss the password to everything you do online.