This morning I received a text message from my employer: I don't have to show up for work. The hacker group "CyberNinja$" had attacked our company with malware. All data had been stolen and encrypted and blocked. Until they are unblocked again, we employees will be given a vacation. Duration unknown.
A maximum of five vacation days would be deducted. Can my employer cut my vacation because of the hacker attack?
Kevin F.
An attack by malware or encryption software (ransomware) with the purpose of extorting organizations is part of the employer's risk. Similar to conventional IT failures. If work is lost because of this, the employer owes you wages without you being obligated to perform. You do not have to make up the lost work.
Deadline not Met
Kevin's employer's short-notice arrangement to take vacation days is problematic for two reasons. First, although the employer is allowed to determine the timing of the vacation, they must give three months' notice. An immediate order is not possible - even if force majeure is involved.
Vacation Purpose not Fulfilled
Secondly, furlough due to a hacking attack will hardly fulfill the actual purpose of vacations: employee relaxation. If, as in Kevin's case, it's completely open when you have to return to work, you can neither organize excursions nor really sit back.
In Kevin's case, there is also this: He has agreed the vacations for the current year with his employer in writing. The employer cannot postpone them unilaterally.
Reduction of Overtime Is Possible...
Instead of deducting vacation, Kevin's employer has another option to "share" a little of the damage with his employee. If Kevin has overtime on his working time account, the employer can ask him to compensate for it during the forced leave. If Kevin agrees to this, his overtime will be reduced.
In practice, many companies secure such consent from employees in advance – by including a corresponding clause in the employment contract or personnel regulations.
... Build-up of Minus Hours rather not
The possibility of reducing overtime could give clever employers the idea of building up minus hours in employees' working time accounts. The opinions of legal experts differ as to whether this is permissible. Some believe that employers should be able to compensate for hours in which they cannot employ employees over a longer period of time.
For others, this contradicts the fact set out in the Swiss Code of Obligations that employees are not obliged to perform. This may not be deviated from to the disadvantage of the employees.
Short-time Work Is Questionable
Finally, the employer can still come up with the idea of ordering short-time work. However, it is questionable whether this is possible. Short-time work does not cover the employer's "normal operating risk". IT failures are probably one of them. In contrast, a pandemic, for example, would not be a normal operating risk.
Kevin F. is very satisfied with the advice he received from the legal service of Employees Switzerland. He is reassured that he will be able to enjoy his regular vacation in full.
