Taking notes for learning / records - Can these be stored on non-work resources?

Danger781

I don't know if this should be posted here, or if would be better suited to the technology forum.. I guess it's a bit of both, so for now just looking for advice and not software suggestions.

I've been using OneNote for taking notes in my current and previous roles, but I'm looking to change software. One of things I do not like about OneNote is that once I left my previous companies, I also lost access to my OneNote notes, as they were syncing to my work email. Not a real problem; I can live without them, but it would have been nice to have some of those notes as they're applicable to my new role. I know I probably could have exported them and then imported them to my personal account, but that's in the past.

I want something that I can continue indefinitely rather than starting over again every time I get a new job. As an alternative, rather than forking out a monthly fee for something like Evernote, I was thinking of going for a self-hosted solution like Bookstack, Dokuwiki, or Wikijs. I have a server that I can use to host them.

However, I'm wondering what my legal obligations / ethical obligations are here.. Can I use my personal server to host a note-taking application that I use for work (and personal use)? I don't see how this is any different to using something like a personal EverNote for example. Is this a common scenario?

Would I need to inform legal of my intention to host my own notes, or for hosting them in a cloud-based service? Surely this is a common scenario?

Am I overthinking this?

Danger781

Just an example of the type of notes I would be taking:
1. Taking notes while attending training
2. Generating notes about a topic for future use
3. Useful commands that I can for troubleshooting
4. Records of customer interactions

I guess it may end up having customer details in there, which is where my query arises from. It wouldn't be anything personal; Perhaps a name and/or email address if it's relevant to something I'm working on.

Mrs OBumble

Danger781 wrote: »

customer details in there, which is where my query arises from. It wouldn't be anything personal; Perhaps a name and/or email address if it's relevant to something I'm working on.

Ahh, what would it take for you to consider a piece of data personal???




To answer your substantive question, it really depends on what technology policies are applied by the organisations you are working for. eg One of my current companies blocks most cloud-based services: you would likely not be able to access a self-hosted service.

Now if you have a file of clearly non-proprietary, non-customer information (eg key-shortcuts), which you would be happy to email from your work address to your personal address, knowing that your manager can and possibly will examine the file, then work away with whatever tools you are allowed to install. But don't expect to be allowed to use the same software in every job.

Esse85

Point 4 is where the problem can arise.

Danger781

Mrs OBumble wrote: »

Ahh, what would it take for you to consider a piece of data personal???

I obviously didn't do a good job of quantifying my statement there. I inadvertently made it sound like I will be storing customer-related information on my personal server, which is not my intention at all here. What I intended to say was that I would avoid putting any personal data within my notes, but I may end up hastily or inadvertently adding in a contact name or email address if I need to take a quick note, or if I'm recording some information while on a phone call. This would obviously not be held intentionally or otherwise for long term note retention. I guess either way the point stands though; I wouldn't want to be liable for retaining (Accidentally or intentionally) any company related information on my personal server. I think I need to re-examine my plan of using one location for all notes..

Danger781

Danger781 wrote: »

Just an example of the type of notes I would be taking:
1. Taking notes while attending training
2. Generating notes about a topic for future use
3. Useful commands that I can for troubleshooting
4. Records of customer interactions

I guess it may end up having customer details in there, which is where my query arises from. It wouldn't be anything personal; Perhaps a name and/or email address if it's relevant to something I'm working on.

Email addresses and nanes are considered confidential under GDPR especially if the email address identifies the person so that would be a no on storing that information.

Jim2007

Danger781 wrote: »

Would I need to inform legal of my intention to host my own notes, or for hosting them in a cloud-based service? Surely this is a common scenario?

Read up on your company's policy on the use of personal devices in the office...

beauf

Danger781 wrote: »

...However, I'm wondering what my legal obligations / ethical obligations are here.. Can I use my personal server to host a note-taking application that I use for work (and personal use)? I don't see how this is any different to using something like a personal EverNote for example. Is this a common scenario?

Would I need to inform legal of my intention to host my own notes, or for hosting them in a cloud-based service? Surely this is a common scenario?

Am I overthinking this?

None of it should be on your personal resources, cloud based or otherwise.

Keep it all on the companies infrastructure, devices, cloud service, hard copies etc.

tdf7187

Danger781 wrote: »

Am I overthinking this?

Yes.

3DataModem

Irrespective of the customer data, the notes made in the course of your job are generally the property (intellectual and otherwise) of your employer.

OMM 0000

Danger781 wrote: »

Can I use my personal server to host a note-taking application that I use for work (and personal use)? I don't see how this is any different to using something like a personal EverNote for example. Is this a common scenario?

It's very different.

EverNote will have a security team and likely hire penetration testers to ensure their server is secure.

Whereas your personal server is probably not secure, and you probably don't use an IDS, HDS, or SIEM.

If someone hacks into your server and releases your notes, could it be bad for your employer? Are you willing to be sued?