There is a constant tug of war in some industries between employees who want to decide for themselves what electronic devices to use for their work, and employers that are uncertain whether allowing such an option would be good for the employer. The use by employees of their own personal electronic devices, such as PCs, laptops, iPads, and phones that can send and receive email, may make for happier employees and lower an employer’s equipment overhead. But there are many other issues that should be considered. A handful are addressed in this article.
At the risk of stating the obvious, where the employee is allowed to use his or her own device for work, the person who will actually use the device will be the person who decides what to buy. Consumer choice is often good. The jury is still out, however, as to whether this ability to choose will result in a happier, more loyal or more productive employee.
If an employee is to be allowed to use his or her own device(s) for work in lieu of or in addition to devices the employer owns, it will be wise to address the issues identified below when the employee commences the use of his or her personal device for work. With certain employees who may be storing sensitive information on their personal devices, a written agreement governing the relationship may be essential if the employer wishes to avoid difficulties recovering and protecting the information at a later date. Similarly, addressing these issues at the outset may give the employee peace of mind, especially as to the financial and privacy issues addressed below.
Who Pays for the Use of the Device if the Employee Owns It?
If the employee owns the device, the employee purchases it with his or her own money. But who pays for the use of the device? An item of the employee’s compensation could be reimbursement of the cost of the business use of the device, such as reimbursement of a portion of the cost of a data plan for a smart phone, or reimbursement of a portion of the cost of home Internet access. The employer and employee may need to establish a formula for determining what percentage of the cost of using the device will be reimbursed, perhaps by making assumptions regarding the proportion of business use to overall use of the device. Depending of the employee’s usage patterns, the development of a fair reimbursement formula may be a more complex task than the old routine of having the employer reimburse the cost of long distance telephone calls itemized on the employee’s cell phone bill.
Who Retains the Data When the Employee Departs?
If the employee owns the device, obviously the employee will take the device with him or her upon moving on to other employment. If that happens, the employer will need to evaluate its right to gain access to and/or require removal of whatever business information may be stored on the device. There are two issues with regard to this information:
(1) Will the employer have the right to the information stored on the employee’s device if it is not also stored on a server or other medium that is owned or controlled by the employer? In other words, if the information is only stored on the employee’s personal device, and nowhere else, will the employer have any right to it at all once employment is terminated? (Hand in hand with this issue will be the issue of how the employer will even be able to determine whether any business information is stored exclusively on the employee’s personal device.)
(2) Is the information proprietary or a trade secret, such that the employer may have the right to require its removal from the employee’s personal device once the employee is no longer affiliated with the employer?
These issues should be addressed in an employment agreement at the beginning of the employment. If the issues are only addressed at the end of the employment, it may be too late for the employer to assert any such rights without negotiating an agreement with the soon-to-be former employee.
What Happens in Discovery?
An employee’s personal device that he or she routinely uses for work likely will be searchable in discovery during any litigation involving business activities in which the employee may have been involved. This means that, where the employee is still an employee when the discovery request is received, the company potentially will have a duty to search the employee’s devices for responsive records. Employers may want to consider giving employees notice of this possibility – either in a written policy governing the use of personal devices for work or in an employment agreement. And employees likely will appreciate knowing of this possibility in advance.
Depending on the employee’s position in the company and the nature of the industry, it is possible that the employer may need to preserve a contract right to access the employee’s device for discovery purposes even after the employment concludes. This is a 21st Century variation on the currently common practice of requiring departing executives to agree to be available if needed to assist with any litigation involving the employer. This area of the law is still emerging, and it is likely that more courts will examine this issue soon.
What About Security During the Employment Relationship?
If proprietary information or trade secrets are stored on the employee’s personal device with the employer’s permission, it may be more difficult for the employer to argue that the employee is not authorized to have the information. Employers must therefore be diligent about setting ground rules for the use of personal devices to access and/or store proprietary information and trade secrets, and employers must carefully monitor employee compliance.
An additional security concern is the possibility that the employee will allow others to use the personal device(s) on which the sensitive information is stored. While employers commonly limit the use of company owned devices to company employees, an employer can’t bar an employee from allowing others to use his or her own device. Although an employer can require that its proprietary information and trade secrets be subject to password protection, the employer will have little ability to monitor compliance with such a requirement.
Even if the employee has no intention of compromising the employer’s security, using a personal device for work outside of the protections of the employer’s firewall or other security systems can put at risk not only the employee’s own device(s) but also the employer’s information. And, if the employee owns the device, the employee will determine what software to load – including anti-virus protection as well as any risky programs – unless an employment agreement specifies otherwise. Again, it is wise to develop a policy addressing this risk at the beginning of the use of the device, rather than waiting until something goes awry with either the relationship or the information.
What About Security and Privacy When the Employee Prepares to Depart?
As is noted above, where information is stored only on a departing employee’s personal device, there may be issues over (1) whether the employer can even access the information, and (2) whether the employee can be required to remove the information from his or her device. These are emerging issues that the courts will have to tackle over the next several years. But, in general, the analysis seems likely to track the traditional analysis of trade secrets and confidentiality agreements under the laws of the individual states.
In Georgia, if the information qualifies as the employer’s trade secret, the employer likely will be able to enjoin the employee’s use of the information after leaving the company even if the information is stored on the employee’s personal device. But, if the information is stored on the employee’s device, there may be a threshold issue over whether the employer took adequate steps to preserve the confidentiality of the information. In Georgia, information cannot be deemed to be a trade secret if the owner has failed to take adequate steps to preserve the confidentiality of the information. So, if a judge were to conclude that the employer had failed to take adequate steps to preserve the confidentiality of the information by allowing it to reside on the employee’s personal device, then the Georgia definition of trade secret would not be satisfied, and protection would likely be denied to the employer. And all of this analysis presupposes that the employer can even prove that the information resides on the employee’s personal device – which may only be determined by obtaining a court order allowing a search of the device. Addressing these types of potential issues at the outset of the relationship will be much easier than litigating over them at the conclusion of the employment.
If the information stored on the employee’s personal device is regarded as proprietary and not a trade secret, in Georgia the enforcement of protections will depend on the existence of a written agreement with the employee designating the information as proprietary. Since the agreement has to be drafted anyway, it makes sense to take the extra step of specifying in the agreement that at the conclusion of the employment the employee must deliver to the employer – and then delete – all proprietary information stored on the employee’s personal devices.
Since it may be easier to steal proprietary information and trade secrets that are stored electronically than to steal paper copies of such information, employers may wish to consider reserving (again, at the outset of the employment) the right to inspect the employee’s personal devices to verify removal of proprietary information and trade secrets at the conclusion of the employment. It is also common for employers to require the departing employee to certify under oath that the information has been removed with no copies being retained.
What About the Privacy of Other Users?
If the employer searches the employee’s personal device to verify compliance with any of the policies discussed above, the employee’s right to maintain the privacy of non-work related information stored on the device will be invaded. That possibility can be addressed in a written agreement at the commencement of the use of the device.
The issue is more difficult when third parties also have information stored on an employee’s personal device. As is noted above, if the employee owns the device, the employer will have no right to bar the use of the device by others. What happens if others store information on the device? The employer will invade the privacy rights of others while searching the device to verify compliance with any of the potential policies that are discussed above. And the employee cannot waive the third party’s privacy rights in an employment agreement. The courts will have to provide guidance on this issue.
Action items
It should be clear from this article that the use of personal electronic devices by employees is a potential minefield. Although there may be many reasons that an employer chooses to allow employees to use their personal electronic devices for work, an employer should approach such a decision thoughtfully and only proceed after implementing a carefully drafted written policy. Counsel can assist with drafting such a policy that has been tailored to the specific needs of the business and the employee.
The analysis set forth in this article is provided for general understanding only and should not be considered legal advice. Counsel should always be consulted for advice regarding a specific situation.
