Personal mobile phones in the workplace create real data protection risks for employers. When staff use their own devices to access work emails, files and applications, businesses lose direct control over how that data is stored and secured. This article will outline three key data protection issues arising from using personal mobiles in the workplace, so your company can take practical steps to protect its interests.<\/p>\n\n\n\n
One data protection law issue arising from using personal mobiles in the workplace is employers’ lack of control over the device.<\/p>\n\n\n\n
When your staff use their smartphones for work-related purposes, you have limited control over their device. If they lose their smartphone or it is stolen, your business may struggle to secure the work emails and stored data.<\/p>\n<\/div>\n\n\n\n
Your business is responsible for securing personal data under data protection legislation (primarily the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018<\/em>). Therefore, if an employee uses their smartphone to access work-related information, you remain responsible for protecting that data.<\/p>\n\n\n\n Additionally, the GDPR sets out strict requirements for the processing of personal data, which include:<\/p>\n\n\n\n Any failure to comply with GDPR rules<\/a> can result in hefty financial penalties from the Information Commissioner\u2019s Office (ICO)<\/a> of up to \u00a317.5m.<\/p>\n\n\n\n To mitigate this risk, your company should have clear written policies outlining the acceptable use of a personal phone in the workplace. In addition, these policies should include guidelines for the security of data stored on smartphones and outline the procedures staff should follow in case of a lost or stolen device.<\/p>\n<\/div>\n\n\n\n Another data protection issue arising from using personal mobiles in the workplace is mixing personal and work-related data. When employees use their personal mobiles to access work-related data, it can be difficult to separate it from personal data stored on the device.<\/p>\n\n\n\n Mixing personal and work data can lead to data protection issues. If the device is lost or stolen, it may be challenging to determine which information is personal and which is work-related, making it difficult to assess the scope of any potential breach. When an employee makes a subject access request under the UK GDPR, separating their personal data from work data<\/a> becomes complicated. Your business may have different retention obligations for work data compared to personal data, making compliance difficult when the two are mixed.<\/p>\n\n\n\n You can mitigate this risk by encouraging staff to keep personal and work-related data separate on their smartphones. Your business can achieve this through mobile device management (MDM) software, which allows employees to create different containers for personal and work-related data on the device.<\/p>\n<\/div>\n\n\n\n However, some employees feel that MDM software is intrusive and is a potential invasion of privacy. This means that it is not a one-size-fits-all solution.<\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n\n
2. Mixing Personal and Work Data<\/h2>\n\n\n\n