Three Data Protection Issues Arising From Personal Mobile Use in the Workplace in the UK

Summary

• Employers remain responsible under the UK GDPR and Data Protection Act 2018 for securing personal data accessed on employees’ personal mobile devices.
• A lack of device control, mixing of personal and work data, and employee privacy concerns are the three key data protection risks arising from personal mobile use at work.
• Businesses can mitigate these risks through clear BYOD policies, mobile device management software, and written procedures for lost or stolen devices.
• This article is a plain-English guide for business owners in the UK on data protection issues arising from personal mobile phone use in the workplace.
• LegalVision, a commercial law firm, specialises in advising clients on data protection and privacy compliance.

Tips for Businesses

Implement a written BYOD policy setting clear boundaries for personal device use, deploy mobile device management software to separate work and personal data, and establish procedures for securing or wiping work data when devices are lost or employees leave.

Summarise with:

ChatGPT Gemini Perplexity Microsoft Copilot

Open now

---

On this page

• 1. Lack of Data Control
• 2. Mixing Personal and Work Data
• 3. Employee Privacy Issues
• What Should a BYOD Policy Include?
• Key Takeaways
• Frequently Asked Questions

Personal mobile phones in the workplace create real data protection risks for employers. When staff use their own devices to access work emails, files and applications, businesses lose direct control over how that data is stored and secured. This article will outline three key data protection issues arising from using personal mobiles in the workplace, so your company can take practical steps to protect its interests.

1. Lack of Data Control

One data protection law issue arising from using personal mobiles in the workplace is employers’ lack of control over the device.

Your business is responsible for securing personal data under data protection legislation (primarily the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018). Therefore, if an employee uses their smartphone to access work-related information, you remain responsible for protecting that data.

Additionally, the GDPR sets out strict requirements for the processing of personal data, which include:

• processing personal data lawfully and fairly;
• ensuring that personal information is obtained and stored proportionately and transparently; and
• putting appropriate security measures in place to protect personal data.

Any failure to comply with GDPR rules can result in hefty financial penalties from the Information Commissioner’s Office (ICO) of up to £17.5m.

2. Mixing Personal and Work Data

Another data protection issue arising from using personal mobiles in the workplace is mixing personal and work-related data. When employees use their personal mobiles to access work-related data, it can be difficult to separate it from personal data stored on the device.

Mixing personal and work data can lead to data protection issues. If the device is lost or stolen, it may be challenging to determine which information is personal and which is work-related, making it difficult to assess the scope of any potential breach. When an employee makes a subject access request under the UK GDPR, separating their personal data from work data becomes complicated. Your business may have different retention obligations for work data compared to personal data, making compliance difficult when the two are mixed.

However, some employees feel that MDM software is intrusive and is a potential invasion of privacy. This means that it is not a one-size-fits-all solution.

3. Employee Privacy Issues

Using personal mobiles in the workplace can also raise issues with staff privacy. Companies have a responsibility to respect the privacy of their staff, including the confidentiality of personal data stored on their smartphones.

One issue is that when staff use their personal smartphones to access work-related data, there is a potential overlap whereby your business may access personal data on that device. This could include private emails, text messages and photos unrelated to work.

You can seek to manage this risk through written policies that outline the circumstances under which your company can access personal data on an employee’s smartphone. You should communicate these policies to employees, who should be allowed to consent for personal data access in specific circumstances.

A commonly written policy is a bring-your-own-device (BYOD) policy. A BYOD policy seeks to set boundaries on using personal devices for work purposes. Additionally, it outlines security rules, such as ensuring strong passwords and encryption use.

What Should a BYOD Policy Include?

A BYOD policy should cover several practical areas. At minimum, it should address:

• which types of work data employees can access on personal devices;
• minimum security requirements, such as screen locks, encryption and software updates;
• what happens if the device is lost, stolen or compromised;
• whether the employer can remotely wipe work data from the device;
• how work data will be removed when employment ends; and
• employee responsibilities for reporting security incidents promptly.

You should review your BYOD policy regularly to reflect changes in technology and working practices. Staff should sign an acknowledgement confirming they have read and understood the policy. This creates a clear record that expectations were communicated.

Key Takeaways

Using personal smartphones in the workplace is a common practice in the UK. However, this practice raises several data protection issues, including a lack of control over work-related data and a potential invasion of staff privacy. You can address these issues through effective written policies and mobile device management software. Many business owners obtain expert legal advice to ensure that personal data is kept secure and their company fully complies with all relevant data protection requirements.

If you need help ensuring safe personal mobile use in the workplace, our experienced Data, Privacy and IT lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.  

Frequently Asked Questions