My intention was yes, there is an expectation that if you're renting a computer on behalf of an employer or accessing their internal network, that's a different situation than using a personal device. In the same way, circumventing a captcha to automate logging into an account you own is a right I imagined being protected, but exploiting an XSS vulnerability to scrape private data behind a login is not.

I would be open to having my mind changed on where that line is. I'm cautious about trying to nail down a very hard line about what is and isn't 'public', because I see some ambiguity (using a personal device for work, using EULAs to enforce non-disparagement clauses).

With Right to Remember, I felt like I needed to at least allude to that distinction:

> and archiving information that they have lawful access to.

But I didn't feel comfortable drawing hard lines elsewhere. If I found a solid metric that I felt could be easily, universally applied, I'd be willing to adopt it.