Employer BYOD Concerns: Part 2 of It's 2013. Do You Know Where Your BYOD Policies Are?

In Part 2 of "It's 2013. Do You Know Where Your BYOD Policies Are?" we will discuss employer BYOD concerns. Check out Part 1 to learn more about employee interests; Part 3 will present developing trends and suggest best practices for BYOD policy drafting and implementation.

The Employer's Perspective on BYOD
While BYOD provides employees with enhanced user experience, their employers welcome BYOD for cost savings, increased productivity, and improved employee satisfaction. Yet, these benefits come with certain costs, primarily data security risk, as well as regulatory compliance risk.

Why BYOD Keeps CIOs Awake at Night
Security management becomes much more difficult the less control an IT department has over the relevant data and hardware. BYOD by its very nature makes control a challenge. Security breaches may result from inadvertent action. For example, sensitive information could be accessed by unauthorized individuals who are using a friend's iPad, or sensitive data may be inadvertently placed in a shared cloud folder. The proliferation of cloud-based services such as Dropbox and Siri make this accidental leakage all the more concerning. A security breach can also result from active external penetration, through theft, hacking, malware, or espionage. Finally, intentional leakage of information by authorized employees poses a third category of information security risk.

Information Security Strategies
To prevent the various types of breaches described above, IT departments will generally employ a range of tools and practices. Security tools include password protection, forced disabling of certain applications, and remote wipe controls. A growing number of companies provide mobile device management (MDM) solutions to help manage BYOD programs. These solutions typically manage devices by enforcing security policies, managing password controls, controlling the installation of applications, and remotely wiping a device. In addition to these technology-based controls, policies and practices may prohibit or require certain activity from employees.

Security Strategy Example: Cloud-Application Risks
As an example of a BYOD security strategy, IBM prevents its employees from using many cloud-based applications, including Apple's Siri. In response to concern by IBM and others, Apple revealed this Spring that user data generated through the use of Siri remains in cloud storage for 2 years. Dropbox and similar cloud-based storage services are frequently used by employees even though the risks have been widely reported. If employees will be handling sensitive information regularly, then tools and policies must be in place to ensure that this information is not sitting unprotected in a cloud environment.

Compliance with Data Security and Breach Notification Laws
Federal and state laws regulate data security and other activity surrounding the use of mobile devices. Many of these laws were created to prevent unauthorized access to third party personally identifiable or sensitive personal information. Such laws include the Health Insurance Portability and Accountability Act (HIPAA), Drivers Privacy Protection Act of 1994 (DPPA), Fair Credit Reporting Act, Gramm Leach Bliley Act, Federal Trade Commission Act, and NASD Rule 3110. Most states have also adopted security breach notification laws over the last decade. Most of these laws require certain breach notification policies and other incident reporting and response procedures, which may be more difficult when employees do not report promptly the loss or improper access to personal devices. Noncompliance can trigger stiff fines and other penalties.

Other Compliance Regimes to Consider
The application of other laws to the BYOD context may not be immediately obvious. Export laws, such as the Export Administration Act regulate the carrying of certain information outside of the United States, or exposure of this information to certain foreign nationals. The executive or engineer who takes a Blackberry on a personal vacation may be inadvertently "exporting" protected technology in violation of U.S. trade controls. In addition, the devices may be accessed in customs as a security measure--exposing restricted information.

Finally, companies must be careful to avoid violations of the Fair Labor Standards Act and other labor laws if they explicitly or implicitly require non-exempt employees to access and reply to emails outside of clearly defined working hours. Approximately 200 police officers are arguing in an ongoing lawsuit that the City of Chicago owes them overtime pay for time spent checking email outside of work.

Most of the federal and state regulations mentioned above do not apply explicitly to BYOD practices. Yet, BYOD practices may exacerbate the risk of noncompliance, and therefore compliance should be considered when designing and implementing a BYOD strategy. Ignoring these laws could prove costly.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Pillsbury Global Sourcing Practice | Attorney Advertising

Written by:


Pillsbury Global Sourcing Practice on:

JD Supra Readers' Choice 2016 Awards
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.