Skip links and keyboard navigation

Information and communication technology

Authorised and unauthorised use of ICT services, facilities and devices guideline

Document type:
Guideline
Version:
Final v2.0.3
Status:
CurrentNon-mandated
Owner:
QGCDG
Effective:
December 2015–current
Security classification:
OFFICIAL-Public

Introduction

Purpose

A Queensland Government Enterprise Architecture (QGEA) guideline provides information for Queensland Government departments on the recommended practices for a given topic area. Guidelines are for information only and departments are not required to comply. They are intended to help departments understand the appropriate approach to addressing a particular issue or doing a particular task.

The Use of ICT services, facilities and devices policy provides the authority to a departments chief executive officer to authorise limited personal use of government-owned ICT services, facilities and devices by departmental employees. If limited personal use is allowed, departments must clearly define what use is considered authorised (official, professional and personal) and unauthorised and include comprehensive examples and the permitted levels of such use.

This guideline has been designed to:

  • define the concepts of limited personal use and authorised and unauthorised use
  • provide a range of examples for departmental consideration when they are determining and defining authorised and unauthorised use of ICT services, facilities and devices.

Audience

This document is primarily intended for:

  • chief executive officers (CEOs)/other senior officers who authorise how departmental ICT services, facilities and devices may be used
  • human resource professionals
  • information management/ICT policy staff.

Scope

In scope

Employee personal use of government-provided ICT services, facilities and devices including where employee personal devices are used to access government email/Wi-Fi etc. is in scope.

Out of scope

The following are out of scope:

  • Examples of employee use of personal ICT services, facilities and devices for official purposes should be captured within departmental bring-your-own-device policies.
  • Conducting government business on private email accounts or systems and messaging applications is covered by the Public Sector Commissions Private Email Use Policy.
  • Detailed implementation advice on official use of social media. This should be distinguished from limited personal use (including professional use) of social media via government-owned ICT services, facilities and devices. For detailed implementation advice on the official use of social media please refer to the QGEA Principles for the official use of social media networks and emerging social media.

Authorised and unauthorised use

When defining what use is authorised and unauthorised, departments need to carefully consider the core business of their departments and the roles and responsibilities of their employees. It is recommended that departments use the headings authorised use and unauthorised use in their policies and guidelines in order to decrease both ambiguity and legal risks. Departments need to ensure that use of government-owned ICT services, facilities and devices is closely linked to business but strikes a balance between official and limited personal use.

Departments should implement practices to ensure that employees are competent in the use of ICT services, facilities and devices. In addition, access to ICT services, facilities and devices should be consistent with departmental security requirements and practices.

The examples in the following section are indicative only and departments should consider their own business requirements and risks when providing examples of authorised and unauthorised use.

Authorised use

The following examples of authorised use of ICT services, facilities and devices have been broken down into the following primary categories:

  • official
  • professional
  • personal
  • other

Departments should convey to employees that government-owned ICT services, facilities and devices should be primarily used according to a business need to help carry out the work of the department and for employees to be well informed.

Official use

Examples of official use may include, but are not limited to:

  • using ICT services, facilities and devices for work-related purposes
  • using the internet to access work-related information
  • sending emails to colleagues on work-related matters
  • sending emails outside of the work environment on work-related matters
  • any use of a departments or Queensland Governments social media account by an authorised employee to engage with the community for approved purposes (for more information see the QGEA Principles for the official use of social media networks and emerging social media.

Professional use

Departments may wish to make government-owned ICT services, facilities and devices available to staff for professional development provided that such use is approved by appropriate senior officers. Professional use may occur during work hours or in an officers own time. Approval is at the discretion of senior officers, provided such use does not interfere with the activities of the department or affects the productivity of other employees and complies at all times with relevant department policy regarding acceptable behaviour.

Examples of professional use may include, but are not limited to:

  • using the internet (including social media) for professional development such as the Study and Research Assistance Scheme or other approved study, research or professional forums
  • using computers, email and other ICT services, facilities and devices to support study
  • supporting employees to engage with professional associations or discuss professional issues via forums
  • networking with colleagues and peers provided that this does not breach confidentiality or privacy obligations (e.g. maintaining an up-to-date profile on LinkedIn).

Personal use

Limited personal use of government-owned ICT services, facilities and devices should be seen as a privilege and not as a right and is generally expected to:

  • take place during the employee's non-work time (e.g. during an employees lunch break or after hours) and not be counted when accruing banked time or TOIL
  • incur minimal additional expense to the Queensland Government
  • be infrequent and brief, not delay official business and should be for non-commercial purposes
  • not interfere with the operation of government and does not violate any state/ departmental policy or related state/federal legislation and regulation
  • be able to survive public scrutiny and disclosure.

Departments should also ensure that employees and regulatory bodies would perceive any restrictions to be sufficiently justifiable.

Departments should ensure that employees understand that they are expected to continue to follow department principles, guidelines and codes of conduct.

Where limited personal use is permitted (for example internet banking) departments must ensure that employees are aware that the Queensland Government accepts no liability for any loss or damage suffered by the employee as a result of this personal use.

Examples of personal use may include, but are not limited to:

  • completing job applications
  • limited personal emails and internet searches that are not unauthorised, unlawful or criminal
  • keeping up-to-date with news and current events
  • using a printer or photocopier to print a few pages of personal information
  • making occasional brief local telephone calls
  • making financial transactions including bill paying or home banking
  • using a work supplied personal identifier (such as an email address or mobile number) to support personal account recovery or two factor authentication provided the use of the related service (e.g. web mail) would be within limited personal use policies and is not associated with or could lead to unauthorised use.

For further advice on the personal use of social media, refer to the Personal use of social media guideline.

Use of work supplied personal identifiers (e.g. email addresses)

The limited personal use of work supplied personal identifiers (e.g. email addresses) is no different to other government provided ICT services, facilities and devices. The same general principles apply. Where limited personal use of work identifiers is allowed, this use must be within limited personal use policies. That is, it should not be associated with services that are unauthorised or could lead to unauthorised use.

The section below includes specific examples of unauthorised use of work identifiers.

Unauthorised use

Because a wide variety of materials may be considered offensive by colleagues, clients or suppliers, individual departments should define what constitutes unauthorised use for their particular department and ensure policies reflect both the departments and employees legislative, ethical and policy obligations.

The examples within the table below should be considered unauthorised by all departments.

ThemeUnauthorised use examples
Offensive or obscene material

Uploading, downloading, storing, forwarding or in any way registering for, subscribing to, distributing or communicating:

  • pornography
  • inappropriate pictures, graphics, jokes or messages (particularly any material of sexually explicit, racist, sexist, discriminatory or otherwise potentially offensive behaviour, including the use of inflammatory, obscene, vulgar, insulting, abusive, threatening, harassing or provocative language)
  • any other material which is likely to cause offence or which would be considered socially unacceptable.
  • Participating in sites that run the risk that they could lead to the above examples of offensive or obscene material (e.g. dating sites).
Unlawful, criminal, defamatory and fraudulent material and use
  • Uploading, downloading, storing, forwarding or in any way distributing or communicating information that the employee knows or reasonably suspects or ought to know is unlawful or criminal material.
  • Uploading, downloading, storing, forwarding or in any way distributing or communicating information that the employee knows or reasonably suspects or ought to know is untrue, defamatory, libelous, misleading or deceptive.
  • Impersonating other people or falsely claiming to represent other people whether alive or dead, real or fictional.
Commercial purposes
  • Using ICT services, facilities and devices to conduct personal business for personal gain or profit, including fee-based or subscription services or stock trading.
  • Uploading, forwarding or communicating any commercial advertising material or any commercial websites for personal gain.
Productivity and use of workplace resources
  • Overseas or other expensive personal phone calls (e.g. toll numbers)
  • Registering or subscribing with a work supplied personal identifier or accessing gambling sites online
  • Downloading and/or playing any inappropriate or time-consuming games or software (e.g. Farmville on Facebook) or for inappropriate periods.
  • Registering or subscribing with a government identity or accessing dating or inappropriate services online.
  • Downloading or storage of files or storage of files from streaming and/or file sharing platforms, which are not for officially approved purposes.
  • Downloading material such as letters relating to pyramid schemes unless authorised to do so for official purposes.
  • Performing any act which the employee knows, reasonably suspects or reasonably ought to know degrades or otherwise negatively impacts the performance of government ICT or external party ICT (e.g. downloading excessive amounts of internet data, spamming, transmitting files that may place an unnecessary burden on department resources or external parties).
  • Downloading material from the internet or email that the employee knows, reasonably suspects or reasonably ought to know contains viruses, worms, Trojan horses, spyware or any other contaminating or destructive features.
  • Creating or maintaining personal websites (except in the course of authorised use of social media).
Participation in external organisations
  • Advocating religious or political opinions.
  • Participating in any lobbying or political activity or endorsing political parties or candidates.
Privacy and confidentiality
  • Taking photographs or videos of people without their consent, where consent is required by law.
  • Uploading personal information, including photographs or personal details (such as names, private addresses or home or mobile telephone numbers) of third parties (including colleagues) without their prior consent, where consent is required by law.
Intellectual property
  • Providing third party information or material without obtaining the appropriate intellectual property permissions.
Intellectual property
  • Using work personal identifiers (e.g. email address) when creating personal accounts or profiles on social media.
  • Making comments or disclosures concerning your official roles and duties (this includes disclosing work related contact information, documents, images, etc.) or work-related activities and events unless the information is in the public domain.
  • Citing or referencing the Queensland Governments clients, partners, suppliers or employees without prior approval, except where such information is in the public domain.
  • Engaging in attacks or insults of any kind including:
    online arguments or flame wars by participating in repeated hostile and insulting interactions with other users of social media
    trolling behaviour by posting inflammatory, extraneous or off-topic comments on social media with the primary intent of provoking other users of the social media
    cyber-bulling, cyber-stalking or cyber-harassment by posting content with the intention to torment, threaten, intimidate, humiliate, embarrass or otherwise target other users of social media.
  • Engaging in any other action which could harm the goodwill or reputation of the department or the Queensland Government.
Last updated:
4 November 2024