140 likes | 251 Views
Legal Issues on Bring Your Own Devices. by Berry Holding-Parsons. Holding-Parsons Solicitors email: bhp@holding-parsons.com . DEFINE YOUR TERMS. my personal devices using personal devices for corporate use using corporate devices for personal use. HISTORY. THEN :
E N D
Legal Issues on Bring Your Own Devices by Berry Holding-Parsons Holding-Parsons Solicitors email: bhp@holding-parsons.com
DEFINE YOUR TERMS • my personal devices • using personal devices for corporate use • using corporate devices for personal use
HISTORY THEN: • all office documents were the employer’s • so were all phones • so were emails, at first NOW: • employees have many personal devices • employees’ devices are often ‘sexier’ than corporate ones • some corporate emails are on personal devices
LEGAL QUESTIONS? • who owns the device? • who owns the data on the emails or on Facebook? • are all emails backed up? • who has possession of the device? • who has the right to monitor? • who manages all this?
1. WHO OWNS THE DEVICE? • easy for corporate devices • the employee owns his own personal device
2. WHO OWNS THE DATA? • who owns the emails and data on a personal device? • the employer may not, unless it is agreed contractually. • who ‘owns’ an employee’s social networking connections?
3. ARE ALL EMAILS BACKED UP? • do you have a full file? • directors are often the worst; weekend work may be on their own personal devices • security risks
4. WHO HAS POSSESSION OF THE DEVICE? • what if the employee refuses to hand over his personal device?
5. WHO HAS THE RIGHT TO MONITOR? • this is a key legal issue • a contract is essential, linked to clear policies • if no contract, monitoring of personal devices may be ‘phone tapping’, i.e. interception over a public network • e.g. listening to voicemail on a personal mobile may be a criminal offence • other countries have stricter rules than the UK
WHO HAS THE RIGHT TO MONITOR? (Cont’d) • Data Protection issues are numerous • what is the position of consultant non-employees? • monitoring use of social networks?
HOW TO MANAGE ALL THIS • BYOD is riskier than cloud computing • find out what goes on: audit • clear policies: the Board must be involved
How to manage all this (cont’d) • If corporate documents are on personal devices, manage them properly: Security • password • encrypt • back up • ensure data can’t be stored
How to manage all this (cont’d) • Lock down • So employees can’t download apps (downloading will get worse in future) • Take legal advice • especially on contracts and policies
How to manage all this (cont’d) • aim for a complete separation of devices, if possible • make clear to employees what they may and may not do. • this is necessary for each new IT development, eg. social networking is not the same as email • radical thought: why shouldn’t employees use personal devices for their own calls and emails?