Imagine that one of your employees just notified you that he lost his cell phone at a restaurant last evening. It was his personal cell phone, but, like many of your employees, he regularly used it to send company emails and to access confidential company information. As the employer, what are you to do? Can you have the cell phone remotely wiped clean?
Bring your own device (BYOD) arrangements, whether formally instituted or not, are common in many workplaces, and it is not hard to see why. These situations — where employees connect their own personal devices (smartphones, tablets, laptops) to their employer’s email systems and other applications — permit employees to freely choose their own devices, while providing a significant cost savings to employers.
There are, however, several unique challenges that come with having a BYOD arrangement in the workplace. For this reason, it is critical that employers have strong policies in place to effectively set expectations between themselves and their employees. Properly setting expectations is almost as important as the policy itself.
Here are a few of the key issues that should be addressed in any BYOD policy:
Payment for the device
Who is going to pay for the device? Some employers do not pay, while others may choose to pay for a portion, or provide employees with a monthly stipend towards the purchase of a device. But, how much or how little an employer contributes is not the issue in this context. The critical takeaway is that employers must be sure to include how the device is going to be paid for in any BYOD policy. This will help avoid any confusion when employees receive their bills every month.
Ownership of the device
Does the employee or the employer own the device? Sometimes this answer can be as simple as looking to who pays for it, but when dealing with a device that is used both for personal and work-related use, the answer can become more complex.
- At a minimum, employers should explain in their BYOD policies that any software utilized to access company material is the property of the employer. Similarly, so is any information stored on the device which is used by the employee to perform work-related activities. Such provisions will permit an employer access to company information as needed, plus enable the employer to monitor employee progress on work-related activities.
- A BYOD policy should also contain a provision explaining that these devices may need to be examined by and available to the employer to respond to any discovery requests with regard to any work-related information that is stored on them.
Securing the device
How can an employer protect its confidential information against loss or theft? In the hypothetical described earlier, the employer was contemplating remotely wiping all of the content off of the phone. Is this permitted?
The answer is not a straight yes or no, but is rather maybe.
The important consideration is that the employer should work with legal counsel to establish a policy of how to handle such situations before they arise, and make sure that employees understand that policy. Wiping a phone clean, although sometimes necessary, should be a last resort.
There are other measures that can maintain security:
- Employers should require that employees have their devices password protected.
- Employers should install encryption software onto the devices, and assist employees in updating that software.
- Employees should immediately notify the employer if their phone is lost or stolen.
- Employees should be advised to frequently back up the personal content on their device onto another device (a smart phone onto a laptop), or onto a “cloud” service. This way, if their devices need to be wiped clean, employees will not lose their personal content.
Nonexempt (hourly) employees using a device
If an employee that is paid hourly responds to a work-related email on her device after work hours, should she receive payment for the time that she wrote that email? Again, this is a question that each employer will have to decide, but that answer should be included in all BYOD policies. By outlining specifically when and how hourly employees will be paid for using their devices for work-related purposes, employers can avoid a significant amount of confusion with respect to hourly employees come pay-day.
Non-work related activities and social media
A potential drawback inherent in any BYOD arrangement is that employees will have access to their personal content, including social media, while working. With over two billion combined Facebook, Twitter and Instagram users, it is impossible to completely prevent employees from posting, sharing, or “liking” at all times throughout the day. Instead, employers can incorporate social media expectations into their BYOD policy.
For instance, employers can set time restrictions, or attempt to limit such non work-related activity until a lunch break. Employers can also inform employees that they will not be paid for personal time spent on the devices during working time.
Employers must be careful, however, not to place overly severe restrictions on an employee’s use of social media. In recent years, the National Labor Relations Board (NLRB) has found that social media policies that are overly broad can be unlawful if they unreasonably restrict an employee’s ability to engage in protected concerted activity. Legal counsel can best assist employers to ensure that their social media policy is not overly broad.
BYOD arrangements can be a positive, yet challenging, addition to the workplace. A well-organized, clear and consistent BYOD policy can help to alleviate several of those challenges. Setting expectations for employees is almost as important as the policies themselves. Employers should provide copies of the policies to employees, and the employees, once they have read them, should sign a form stating that they have received those policies. Employers should also take the time to explain the motivations behind certain provisions. After all, the clearer the initial presentation of a BYOD policy is, the more successful that policy will be in the long run.