BYOD & The Board Of Directors — Part One: A Risk To Reckon With?

by Dentons
Contact

The information security concerns relating to employees using their own devices for work (such as smart phones, netbooks and laptops) are a hot topic. Although “bring your own device” or BYOD is here to stay, the practice of employees using their own devices for employment duties creates information governance challenges.

What about the role of BYOD at the level of the board of directors? Corporate officers, including the corporate secretary, frequently communicate with board members through electronic means. Directors are also likely to communicate with one another between meetings through electronic means. It is not uncommon that these electronic communications may include preliminary evaluation of strategic matters, legal advice, draft employee compensation arrangements, material contracts and draft financial reports.

This post examines some of the duties of directors with respect to the use of their own devices and email accounts. Subsequent posts will set out the case for a board information governance policy and examine some of the elements of such a policy.

Is it really a problem?

Before dismissing the information governance challenges related to electronic board communications, consider the following questions:

  • How often is information sent to directors at personal email addresses or to email addresses belonging to other companies that may employ the director?
  • Does the corporation have a good handle on the device and security standards being used by directors when they are handling some of the most sensitive material non-public information of the corporation?
  • What assurance is there that third-party technology policies do not create rights in the information sent to those third-party accounts, such as, for example, when a director is employed by another company?
  • What happens if confidential information is retrieved and stored on a director’s personal device and the device is lost or stolen or lacks security protection? Is the device capable of being wiped?

A director’s duty of to protect corporate information

A director has a duty to bring the care, diligence and skill of a reasonably prudent person to the protection of confidential corporate information.

Directors owe a statutory duty of care in fulfilling their obligations to the corporation. Paragraph 122(b) of the Canada Business Corporations Act, RSC 1985, c C-44 (CBCA), for example, provides that directors and officers must “exercise the care, diligence and skill that a reasonably prudent person would exercise in comparable circumstances”.

In addition to the duty of care, directors of Canadian business corporations owe a duty of loyalty to the corporation. The duty of loyalty is a common law duty that has been incorporated into most corporate legislation in Canada. For example, paragraph 122(a) of the CBCA provides that every director must act honestly and in good faith with a view to the best interests of the corporation.

The Supreme Court of Canada has described this “statutory fiduciary duty” as including a duty to maintain the confidentiality of information acquired by being a director. This statutory duty also typically prohibits directors from using information acquired by virtue of their position for personal gain.

Even leaving aside the fiduciary duties of a director, a duty of confidence may arise anytime a person receives information that has a quality of confidence about it in circumstances in which there is an express or implied obligation of confidentiality.

Issues for directors to consider

The care, diligence and skill to be exercised by a reasonably prudent director depend on the circumstances. There is, therefore, no single prescriptive information governance practice that will fulfil a director’s statutory duty of care. The types of controls that a director may wish to consider deploying depend on the sensitivity of the information and its importance to the corporation.

Below is a checklist of questions that a director may wish to review as part of determining whether the director’s information governance practices are consistent with, and capable of, fulfilling the director’s duties of confidentiality to the corporation.

Device and Network Security

  • Is the device only used by the director or is it shared with other people, such as family members?
  • Are all devices on which the director views electronic communications and material secured by a strong password (at least 8 characters containing at least one number, one capitalized letter and one symbol) and protected by anti-virus software that is frequently updated?
  • Are all devices on which the director stores corporate information encrypted? If not, are there particular types of information that should not be stored on those devices, such as personal information of employees and officers or material non-public information relating to merger discussions or financial results?
  • Is the device enabled with a remote wiping technology in the even that it is lost or stolen?
  • Is the director using the device when connected to wifi? Does the director use secure wifi connections? Is the director’s home network protected by a firewall?

Account and Information Security

  • Does the director access information through a secure portal? If not, are there particular types of sensitive information that should only be available in this way?
  •  Is the director receiving information through an email address to which others have access, such as an administrative assistant? Should those third parties be bound by a confidentiality agreement?
  • Is the director receiving information at a personal email address or an email address belonging to another corporation? If so, is this appropriate for all types of information? Do the terms of service of the personal email address provider or the terms of use of another corporation’s email policy permit access to the email account by third parties? Are those third parties governed by confidentiality agreements?
  • Is the email account protected by a strong password? Is email encrypted when transmitted? Are email and other electronic records encrypted when stored?
  • Is the email address provided as part of a cloud-based service? If so, does the director understand what limitations there are on that service?
  • Does the director have the technical skills to understand whether information retained on the device is being collected, used or stored by other applications without the director’s knowledge?

Document Management

  • Is the director storing electronic records on a third-party’s system? If so, are the records password protected or logically separated from records that can be viewed by others? For example, are records received by the director stored on his or her employer’s systems in a manner that would permit others to view or otherwise inspect those records?
  • Does the director print material? Is that material stored in a secure location? Who else has access to the information?

Records Retention

  • Does the director have the technical and administrative capability to comply with the corporation’s records retention policy? For example, does the corporation’s records retention policy require retention of emails between directors about the corporation’s business for a defined period of time? Is the director able to ensure compliance?
  • If the director is using the email or electronic storage services of another corporation in which he serves as an employee, will the director have access to that email if he or she is no longer employed by that corporation? If not, has provision been made to migrate those records in the event of retirement or dismissal?

Litigation

  • Does the director have the technical and administrative capability to comply with a litigation hold in the event that litigation arises and records created, retained or received by the director are responsive to the issues in the litigation?
  • Has the director mixed personal and business uses on the device in a way that will make it more likely that the director’s personal records or records relating to his or her duties to another corporation will need to be inspected in the event the device must be produced for litigation purposes?
  • These issues may be daunting for directors. However, there are technological solutions. Directors may wish to consider more structured ways to receive board information, such as through secure portals or third-party cloud based board communication service providers.

In subsequent posts on this topic, I’ll look at these issues from the perspective of the corporation embarking on creating information governance policies for the board.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Dentons | Attorney Advertising

Written by:

Dentons
Contact
more
less

Dentons on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Privacy Policy (Updated: October 8, 2015):
hide

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.

Security

JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.