BYOD - are you protected?

With a recent research by Ofcom showing that 60% of the UK population now own a smart phone and 20% a tablet, it is not surprising that there has been a significant increase in the number of employees using their personal electronic devices at work.

With a recent research by Ofcom showing that 60% of the UK population now own a smart phone and 20% a tablet, it is not surprising that there has been a significant increase in the number of employees using their personal electronic devices at work.  ‘Bring Your Own Device’ (BYOD) schemes have been increasing in workplaces across the UK. For example Transport for London (TfL) has overseen a rise of more than 500 per cent in its employees' use of mobile phones and tablets under its BYOD scheme over the past three years.

According to the experts at leading solicitors Harrison Clark Rickerbys, employers need to be aware of the risks to company data that this benefit could present, and ensure an adequate policy is in place. 

 “Despite its undoubted benefit in terms of productivity, cost saving and flexibility, BYOD schemes do carry with them a number of risks for employers, particularly in relation to how company data can be accessed via personal devices,” explains Matt Jenkin, Partner and employment lawyer at Harrison Clark Rickerbys.  “In particular, permitting devices which you do not have sufficient control over to connect to corporate IT systems, can introduce a range of security vulnerabilities and other data protection concerns if not correctly managed.  In addition the loss of a personal device containing company data presents a real danger.  This was highlighted by a recent case involving the Royal Veterinary College in which a member of the College's staff lost a personal camera.  The camera’s memory card contained the passport images of six job applicants.  The Information Commissioners Office (ICO) investigated the loss of this data, and was critical of the College for the lack of guidance that was issued to employees about BYOD.  This resulted in the ICO issuing the College with a warning.”

According to recent research by Zenprise (December 2012) only 8% of UK organisations have BYOD use-policies in place, meaning the scenario that took place at the Royal Veterinary College is sure to be repeated in many more companies across the country. 

So what can employers do to protect themselves and the company?

“Organisations that allow BYOD should take account of the Information Commissioners Office ‘Bring Your Own Device’ guidance to ensure that they don't find themselves in a similar position,” advises Matt Jenkin.  “An acceptable use policy should be put in place and clear policy on security and data transfer is essential.”

 The key BYOD recommendations from the ICO are:

• Ensure devices are secure. Devices should be locked with strong passwords and the use of encryption to store data.
• Make sure that data transfers are secure.  Transfers of personal data should be made via a secure channel.  Employees need to be made aware of the dangers of using untrusted connections such as open Wi-Fi networks in coffee shops.
• Employers need to exercise control over the device so that if the device is lost or stolen an employer can prevent any work-related personal data from being accessed.  This can be done, for example, by registering devices with a remote locate and wipe facility in the event of loss or theft.   
• Implement and maintain an acceptable use policy. Both the employer and employee should fully understand their duties and responsibilities.  The absence of such a policy is likely to leave an organisation exposed to criticism by the ICO.

For more information or assistance in drafting a BYOD acceptable use policy please contact Matt Jenkin, Harrison Clark Rickerbys on 01242 246458 or mjenkin@hcrlaw.com.