Many many moons ago I used to run security for a retail company. It was an interesting time, some fairly thorny problems but the biggest issue I faced was the culture that had established in the company. The cause of the issue was policy mixed with rumour.
Years before I arrived, one employee had managed to clock up a moderate telephone bill due to personal calls. Someone had noticed. They had then gone on to estimate a total cost to the company of people making personal phone calls. A policy was introduced "no personal calls to be made at work".
It didn't take long for the rumour mill to start. Before long a common rumour was that one employee working late one night had called home to say he was going to be late. He was fired the next day. Of course, none of this was true but that didn't matter.
A culture of fear had been established in the company and with all such cultures it grew and fed on rumour. It didn't take much for people to leap to a conclusion that security was monitoring all phone calls. The stories becoming ever more outlandish.
By the time I arrived, the culture of fear around security was well established. No-one wanted to speak to security or point out if something was wrong because of a fear of the consequences. Stories that security would investigate why you were looking at something and who you were talking to were widespread. The common attitude was if something looked amiss, keep your mouth shut.
All of this derived from that earlier treatment of a minor matter that could have been so much better dealt with by simply asking the employee to refrain from making so many personal calls. I've generally found that whilst people make mistakes or do foolish things occasionally that these are exceptions and treating them like adults is the way forward. Creating policies to deal with these exceptions almost always results in treating the general population as though they're not adult and the consequences of this are negative.
Certainly in places with high levels of mistrust then people want to know "their boundaries" but this is a sign of mistrust and a culture that is not healthy rather than anything positive. In such environments it can be extremely difficult to rebuild trust and the policies and rumours that surround them will counter you at every turn.
Why do I mention this? Well, be careful with your policies in an organisation. Straying away from the mantra of "treating people like adults so they behave like adults" by introducing policies to cover the exception is a sign of weak management and will come back to bite you in the long term. A policy should be a last resort and not what you should immediately dive into.
