Across America, corporations are allowing employees to use personal devices to perform work and access corporate networks. These initiatives, commonly known as Bring Your Own Device (BYOD) programs, are being driven by factors such as purported cost savings (companies can buy or lease fewer computers if employees use personal devices for work) and greater employee choice (rather than being forced to use a standard company-issued computer, an employee can use a personal device more suited to his work habits). However, before implementing a BYOD program, companies need to understand and address certain legal issues.

1. Employer liability

Employers may have legal liability arising out of an employee's use of a personal device in the work place, particularly if that device can access the employer's network or Internet services. For instance, if employees use their personal devices to harass fellow employees based on certain protected characteristics (e.g., race, sex, disability or age), an employer may be liable if it fails to take steps to stop the harassment. Even more concerning, one New Jersey court has ruled that an employer may have liability in connection with an employee's use of workplace technology to access child pornography.

2. Employer monitoring/Employee privacy

Since employers may have liability associated with the use of their technology systems, they have a legitimate need (and likely a duty) to monitor access to those systems, including employee access through personal devices.
Prior to implementing a monitoring regime as part of a BYOD program, employers should recognize that both federal and state laws give employees a degree of privacy in their computers and electronic communications. For instance, the federal Computer Fraud and Abuse Act criminalizes intentional, unauthorized access to computers in certain instances. Certain state laws also grant individuals a measure of privacy in their computers and electronic communications.

3. Data protection concerns

Federal data protection laws applicable to certain industries and business sectors, such as Gramm-Leach-Bliley (financial services) and HIPAA (health care), require companies to take steps to safeguard sensitive data. In addition, some states, such as California, have laws requiring businesses to maintain reasonable security procedures to protect personal information. A company needs to be mindful of its legal obligations to safeguard protected data in connection with operating a BYOD program.

4. Litigation issues

Federal and state civil procedure rules require litigants responding to discovery requests to produce information (including electronic documents) in the litigant's “possession, custody, or control.” If an employer allows its employees to use personal devices to perform work, the employer may be deemed to have “control” over documents on the employee's personal device. The employer may then have an obligation to preserve and produce those documents in litigation.

Recommendations

The above list comprises just some of the issues facing companies implementing BYOD programs. To manage these issues, companies should implement a BYOD policy and/or terms of use that employees would be required to agree to prior to participating in the program. The policy/terms of use would, among other things, inform the employee that:

• The employee cannot use her device to harass or discriminate against others or engage in criminal conduct
• The employee should not store company proprietary data or data regarding customers or fellow employees on her device
• The employee must cooperate in any legal proceedings or investigations, and such cooperation may include preserving and producing files located on the employee's device
• The employee's personal device may be monitored if it is used to access the company's network

In addition to having a robust BYOD policy and/or terms of use, a company should consider implementing technology solutions that limit an employee's ability to either store sensitive data on his personal device or to use that personal device to access sensitive database systems that contain data covered by federal or state data protection laws.