The growing BYOD trend doesn’t mean employees are bringing their own drinks to work, but it is giving their employers headaches. That’s because employee use of personal devices such as smartphones and iPads in the workplace, dubbed bring-your-own-device (BYOD), is raising privacy and security concerns.
Companies started flirting with the idea of employees selecting, purchasing and managing their own devices in 2010 as tech-savvy young employees became dissatisfied with the less-sophisticated devices their employers often provided, according to media reports. The trend took hold in 2011, as CIOs realized BYOD would increase employee retention and productivity, according to a 2011 survey by technology company Citrix Inc.
“When some companies prohibited the use of Facebook at work, many employees left those companies. Now companies openly advertise that they are ‘Facebook friendly.’ BYOD presents a similar issue,” says Dave Walton, a Cozen O’Connor member.
The rapid adoption of mobile devices and applications that support business has immense potential to increase productivity. Easier connection to company networks and the use of cloud computing allow users to access company data from remote locations, Walton says.
But companies’ security policies haven’t kept pace with the growth of BYOD. “Only 43 percent of respondents to PwC’s 2012 Global State of Information Security Survey said that their organization has implemented a security strategy for use of employee-owned devices. And only 27 percent of U.S. respondents in a 2011 Gartner survey believed their mobile security was adequate to pass an audit,” says Jim Guinn, managing director at PricewaterhouseCoopers (PwC), a professional services firm.
Now, many corporations are scrambling to install policies and procedures to maximize the benefits and mitigate the risks of BYOD. In-house counsel need to consider drafting employee agreements affirming the company’s right to access information stored on these devices.
“Companies ask us for guidance on what they should include in their BYOD policies, but determining best practices is significantly premature in a developing mobile market,” Guinn says.
Companies are taking many different approaches to managing BYOD.
For example, some companies let employees use their existing personal devices for work with varying agreements for payment of monthly Internet charges. Others give employees stipends to purchase the devices they want. Some do both. Another approach is buying employees’ personal devices for a token amount and agreeing to sell them back at the same price when employees leave the company.
Legal ownership of devices may determine how far employers can go in protecting company data on these devices, says Brian Jackson, a Fisher & Phillips attorney who counsels employers on workplace policies. Jackson recommends that companies maintain ownership of devices while allowing employees to select them.
Regardless of who owns the devices, providing technical support and security for all possible devices poses a problem.
“It is nearly impossible to manage the thousands of potential operating systems and device configurations from a variety of manufacturers,” Guinn says. One solution is to restrict employees to selecting devices from an approved list.
Many companies are requiring employees to install mobile device management [MDM] software on their personally owned devices, giving employers control over the device. In the event a device is lost or stolen, corporations may wipe all data from the device. Some MDMs use GPS to track the location of devices, which helps determine whether a device is lost rather than stolen before initiating a remote lock or wipe.
To avoid potential privacy challenges from employees, the company should clearly state its right to access and protect data on devices.
“An employer should state these rights and privileges not in employee handbooks but in carefully drafted stand-alone agreements written in plain English,” Jackson says.
Potential issues regarding company access to or deletion of personal data can be anticipated in such agreements.
Employees who participate in BYOD programs should be required to sign such binding agreements before being allowed to access company resources with their personal devices. Although there is no bright-line legal rule (see “Legal Limbo”), this may be helpful should an employee later challenge an employer’s access of his personal device. “The informed and written consent of an employee to an audit should survive a later challenge,” says Jackson.
IT departments or third-party vendors that have no contact with those who make employment decisions should conduct audits of personal devices, Jackson recommends. Otherwise, personal information uncovered during an audit identifying an employee as disabled or revealing his religious beliefs could become the basis for a discrimination claim if that employee is later subject to an adverse employment action. Showing that the decision maker could not have had access to such information would provide a good defense to an intentional discrimination claim, Jackson says.