Jeff Bezos arrives at the Statue Of Liberty Museum Opening Celebration at Battery Park. Photo: lev radin/Shutterstock.com

High-ranking executives often use their personal phones for work and keep sensitive information on them. But when an executive's personal phone or device is hacked, the company's general counsel needs to jump in to reduce the data risk.

On Wednesday, the United Nations Human Rights Office of the High Commissioner called for an investigation into allegations that the Crown Prince of Saudi Arabia, Mohammed bin Salman, "deployed digital spyware," which enabled surveillance on Amazon.com Inc. CEO Jeff Bezos and leaked data from his phone. The report states Bezos' phone was hacked through a corrupted video sent by bin Salman in 2018.

According to media reports, Saudi Arabia's foreign minister Prince Faisal bin Farhan Al Saud called the claims "absurd." A spokesperson for Amazon did not return an email seeking comment. Amazon's general counsel, David Zapolsky, could not be reached for comment on Wednesday.

"This is not an atypical scenario," Philip Yannella, a partner at Ballard Spahr in Philadelphia, said.

Yannella said he would first expect the general counsel and CEO to have a conversation about what kind of information is on the device that was hacked. The general counsel should be made aware of any trade secrets and business strategies that were on the phone to begin the process of trying to protect the CEO and the company.

"It's quite possible that there may be information that wouldn't trigger any breach reporting requirements, but there may be sensitive business information," Yannella said.

Edward McAndrew, a partner at DLA Piper in Washington, D.C., said Wednesday there is a "blurring of the lines" when it comes to what is a personal device and work device.

"These things aren't phones; they're basically computers," McAndrew said. "We approach that like we would approach any other kind of hack, and we conduct a cyber-incident investigation."

McAndrew said that investigation should be led by the general counsel in case the hack leads to a data breach in which regulators are called on to investigate or a lawsuit as a result of any breach.

"It needs to be conducted under legal privilege," McAndrew said. "Otherwise the results of the investigation are not going to be protected."

McAndrew said often those affected will want to destroy the device so it can stop tracking the target. However, he said general counsel should team up with the company's information technology or cybersecurity department to get as much information as it possibly can without the hackers knowing. Not doing so could lead to greater exposure to the company's network.

"The device becomes just another expanding surface attack area," McAndrew said.