ILNews

Companies need to draft 'bring your own device' policies

Back to TopCommentsE-mailPrintBookmark and Share

The technology of smartphones and tablets allow professionals to essentially carry a computer wherever they go and, better still for companies, many employees are happy to buy their own mobile device and use it for work.

But while the convenience of handheld, portable computers enables employees to peruse email, communicate with clients and review documents without being tied to the office, the “bring your own device,” or BYOD, trend is creating tensions between how much access an employer can have to the worker-owned device and how much privacy an employee can expect.

Companies are concerned about security, keeping confidential data from falling into a competitor’s hands, and preventing financial account numbers from becoming known to hackers.

Employees want to keep prying eyes, including those of their employers, from looking at the photos of their children, text messages from friends and emails from family stored on their mobile devices.

baker Baker

Drawing a bright line between access and privacy is not possible, attorneys say. Still, rules and policies must be formulated to provide some guidance so businesses and workers will have some idea of what will happen when a company’s security is breached.

Attorneys, however, disagree from where that guidance should come. The role that market forces, courts and statehouses should play sparks debate because of the complex nature of the BYOD questions and the pace at which technology changes.

Setting company policy

Nathan Baker compared smartphones to sunglasses – they are always being left behind.

The Barnes & Thornburg LLP partner said companies must be prepared for employees’ mobile devices to get lost or stolen. Protection measures like encryption and firewalls that are common on desktop and laptop computers are not easily applicable to smartphones and tablets. So whenever an employee leaves the office with the mobile device, company data will be walking around in public with little security.

Companies can mitigate the damage by having BYOD policies which lay out the expectations and requirements. But a policy alone is not enough, Baker said. Companies also need to train their workers on what the policies say and institute methods for ensuring the employees are complying with the rules.

Baker highlighted the hypothetical situation of an employee’s mobile device being stolen and the company wanting to remotely erase the data. Employees will less likely object to having their phones wiped – which will also obliterate their personal information – if they know long before their items are lost what the process will be.

A second reason for training and compliance is litigation, Baker said. If a company becomes the subject of a lawsuit, work-related items on employee-owned devices will have to be preserved for discovery purposes.

Failure to do so can bring stiff spoilage sanctions. One example of this came in January 2014 when the U.S. District Court for the Southern District of Illinois slapped pharmaceutical manufacturer Boehringer Ingelheim with a $900,000-plus fine, in part, because the company did not tell its employees to save work-related text messages on their personal phones.

Courts and legislatures

grayson-ann.jpg Grayson

Ann Grayson, partner at Barnes & Thornburg, pointed to the Boehringer Ingelheim sanction as an example of the courts providing guidance.

The bench, she said, will face more cases involving employee-owned mobile devices and as it issues more rulings, direction will emerge on how companies and workers can navigate the tension between privacy and access. The court decisions will give an idea of where the judiciary is headed on this matter and help inform business about how to craft policies.

Attorney Cameron Shilling, director and chair of the privacy and data security group at McLane Graf Raulerson & Middleton in New Hampshire, believes the job of defining what belongs to a company and what belongs to an employee in a BYOD world will need to be handled legislatively.

The courts, he said, do not understand the concept of company data on employee hardware. Moreover, disputes arising from BYOD do not always provide a legal issue that can be addressed by the judicial system, and any remedy that comes from the courts usually does not arrive fast enough given the speed at which BYOD matters can move.

He is helping to draft legislation to be introduced into the New Hampshire Legislature this fall. Shilling believes the measure, which will define personal data versus company data and personal device versus company device, will be the first of its kind in the nation.

An employer has a right to retrieve company data from an employee-owned mobile device, Shilling said, but the employer has no right to invade the privacy of the employee.

Businesses want tough regulation to force workers to give back company data, he said. But, he continued, any legislation should extend employee privacy to company hardware. The current thinking holds if an employee uses a company computer for personal business, the employer has a right to look at the data and the employee has no privacy.

“I disagree,” Shilling said. “I think to be fair we have to recognize a rule that says an employer shouldn’t unnecessarily invade personal data of an employee on a company device.”

Baker was hesitant about a solution coming from a statehouse.

“I’m always concerned when the legislature steps in particularly on issues like this that are still so new,” he said, explaining legislation typically prevents or prohibits things, and it’s too early to tell where this issue and technology are headed.

The market, he said, may be able to provide the answers. He noted the practice of some employers asking for passwords to job candidates’ Facebook pages. State legislatures enacted laws restricting that practice but, Baker said, the problem largely solved itself when the public’s adverse reaction to the practice made employers quit.

Attorney Ken Mortensen, managing director of the risk assurance practice at PwC U.S., said the judicial branch and the legislative branch can address the problems of BYOD.

Mortensen served as a panelist on one of two seminars examining BYOD issues during the August American Bar Association annual meeting. He joined the discussion on the collision between personal privacy and corporate security.

Shilling participated on the second seminar during the ABA meeting, which also examined privacy and data security concerns.

The courts will have to consider the issue and the legislatures will have to pass laws to address the concerns over the conflict between privacy and protection, Mortensen said. Legislatures are not better than the courts, he said, but the legislative branch can address the matter more comprehensively while a court’s ruling will be based on the facts of a particular case.

Both Baker and Grayson noted a key hurdle to finding a solution to BYOD issues. The variability of the situations coupled with the constant updates to mobile devices make blanket remedies difficult to formulate.

“Because of the ever-changing technology with smartphones and mobile devices, the challenge is about the time you set a rule, a new problem crops up,” Grayson said.•

ADVERTISEMENT

Post a comment to this story

COMMENTS POLICY
We reserve the right to remove any post that we feel is obscene, profane, vulgar, racist, sexually explicit, abusive, or hateful.
 
You are legally responsible for what you post and your anonymity is not guaranteed.
 
Posts that insult, defame, threaten, harass or abuse other readers or people mentioned in Indiana Lawyer editorial content are also subject to removal. Please respect the privacy of individuals and refrain from posting personal information.
 
No solicitations, spamming or advertisements are allowed. Readers may post links to other informational websites that are relevant to the topic at hand, but please do not link to objectionable material.
 
We may remove messages that are unrelated to the topic, encourage illegal activity, use all capital letters or are unreadable.
 

Messages that are flagged by readers as objectionable will be reviewed and may or may not be removed. Please do not flag a post simply because you disagree with it.

Sponsored by

facebook - twitter on Facebook & Twitter

Indiana State Bar Association

Indianapolis Bar Association

Evansville Bar Association

Allen County Bar Association

Indiana Lawyer on Facebook

facebook
ADVERTISEMENT
Subscribe to Indiana Lawyer
  1. It's a big fat black mark against the US that they radicalized a lot of these Afghan jihadis in the 80s to fight the soviets and then when they predictably got around to biting the hand that fed them, the US had to invade their homelands, install a bunch of corrupt drug kingpins and kleptocrats, take these guys and torture the hell out of them. Why for example did the US have to sodomize them? Dubya said "they hate us for our freedoms!" Here, try some of that freedom whether you like it or not!!! Now they got even more reasons to hate us-- lets just keep bombing the crap out of their populations, installing more puppet regimes, arming one faction against another, etc etc etc.... the US is becoming a monster. No wonder they hate us. Here's my modest recommendation. How about we follow "Just War" theory in the future. St Augustine had it right. How about we treat these obvious prisoners of war according to the Geneva convention instead of torturing them in sadistic and perverted ways.

  2. As usual, John is "spot-on." The subtle but poignant points he makes are numerous and warrant reflection by mediators and users. Oh but were it so simple.

  3. ACLU. Way to step up against the police state. I see a lot of things from the ACLU I don't like but this one is a gold star in its column.... instead of fighting it the authorities should apologize and back off.

  4. Duncan, It's called the RIGHT OF ASSOCIATION and in the old days people believed it did apply to contracts and employment. Then along came title vii.....that aside, I believe that I am free to work or not work for whomever I like regardless: I don't need a law to tell me I'm free. The day I really am compelled to ignore all the facts of social reality in my associations and I blithely go along with it, I'll be a slave of the state. That day is not today......... in the meantime this proposed bill would probably be violative of 18 usc sec 1981 that prohibits discrimination in contracts... a law violated regularly because who could ever really expect to enforce it along the millions of contracts made in the marketplace daily? Some of these so-called civil rights laws are unenforceable and unjust Utopian Social Engineering. Forcing people to love each other will never work.

  5. I am the father of a sweet little one-year-old named girl, who happens to have Down Syndrome. To anyone who reads this who may be considering the decision to terminate, please know that your child will absolutely light up your life as my daughter has the lives of everyone around her. There is no part of me that condones abortion of a child on the basis that he/she has or might have Down Syndrome. From an intellectual standpoint, however, I question the enforceability of this potential law. As it stands now, the bill reads in relevant part as follows: "A person may not intentionally perform or attempt to perform an abortion . . . if the person knows that the pregnant woman is seeking the abortion solely because the fetus has been diagnosed with Down syndrome or a potential diagnosis of Down syndrome." It includes similarly worded provisions abortion on "any other disability" or based on sex selection. It goes so far as to make the medical provider at least potentially liable for wrongful death. First, how does a medical provider "know" that "the pregnant woman is seeking the abortion SOLELY" because of anything? What if the woman says she just doesn't want the baby - not because of the diagnosis - she just doesn't want him/her? Further, how can the doctor be liable for wrongful death, when a Child Wrongful Death claim belongs to the parents? Is there any circumstance in which the mother's comparative fault will not exceed the doctor's alleged comparative fault, thereby barring the claim? If the State wants to discourage women from aborting their children because of a Down Syndrome diagnosis, I'm all for that. Purporting to ban it with an unenforceable law, however, is not the way to effectuate this policy.

ADVERTISEMENT