MINNEAPOLIS — To keep up with the times, companies are allowing their employees to use personal smartphones and tablet computers at work. But the trend, called "bring your own device," creates data security issues and also can lead to disputes about paying workers overtime. Teresa Thompson, a lawyer with the Minneapolis firm of Fredrikson & Byron, explains.
Q: Why are companies allowing employees to bring their own smartphones, tablet computers and other gadgets to work?
A: There are two reasons. One is they can't stop it. The other is that companies want to have increased connectivity between employees and work. Employees who are willing to use their own devices will work more and be more connected.
Q: How can companies allow employees to "bring your own device" and still maintain computer network security?
A: The company's IT folks can have security policies. They can say you must have your device password protected. They can demand that you encrypt the data on the device. Or they can do what IBM did — have the IT department put security software on the employee's device that limits access to the corporate network.
Q: Doesn't using your own gadgets for work raise the issue of overtime pay?
A: If it's an exempt employee, such as a lawyer who's supposed to work all the time, it's not an issue. But hourly workers have to be paid overtime if they work it.
There are currently class-action suits in the courts dealing with employees who used their own devices to log into work computers or to send corporate email, didn't log the work at the time, then later claimed overtime. If you don't clock the time of employees who can be paid overtime, you're looking for legal trouble.
Q: How does bringing your own device affect the legal requirements that companies maintain a historical record of their email in case there's a lawsuit?
A: If employees are using company email accounts, those emails are still maintained on the company's servers. But if the employees are using personal email for work-related communications, then you've got a problem. Electronic discovery (searching past email for information relevant to a lawsuit) is expensive, and if you have to go to Facebook or LinkedIn or a personal email account, you're going to have to pay a lot of money to experts to get that email back.
Q: Are there any benefits to companies if they let employees bring their own devices to work, such as cutting the cost of buying everyone a smartphone?
A: There are no benefits to employers. It increases risk, and while it might cut the costs of purchasing devices for employees, it increases the costs of what you have to do to get your information back if someone leaves the company.
Q: What happens to the information on an employee smartphone or tablet computer when that person leaves the company?
A: You shut down that person's computer network account when he or she leaves. But whatever is stored on that personal device is still there. And what if the employee backed up the smartphone to a home computer, as I do?
We recommend that companies have a policy that the employee agrees to let the company remove everything company-related from the smartphone or other device, and that the employee also agrees not to save that company information to any other system. Sometimes a company policy will take it further, and say the employer has the right to inspect the person's home computer.
But it's all so new that, at this point, about 75 percent of employers don't have policies or procedures to ensure that data on personal devices doesn't walk away with employees when they leave.
Q: What about the flip side —could the software already on a personal smartphone or tablet computer hurt the employer?
A: Yes. The IT department at our law firm told us not to use Siri, the iPhone personal assistant software. The problem is that information you give Siri is stored on Apple's servers. If I dictate an email to a client while Siri is activated, the content of that client communication is being stored by Apple, and I don't know what they'll do with it.