Summary
- Under the UK GDPR, asking staff to use personal mobile phones for business purposes can constitute a data protection breach, as personal phone numbers are classed as personal data and must be handled accordingly.
- The UK GDPR does not outright ban the use of personal mobile phones for work, but it does require businesses to take steps to protect both employees’ and customers’ personal information when such devices are used.
- Businesses can achieve compliance by requiring staff to withhold their personal number when making business calls or by using an app that provides an alternative telephone number through their personal handset.
- This article is a guide to GDPR compliance and the use of personal mobile phones in the workplace for business owners operating in the UK, produced by LegalVision, a commercial law firm.
- LegalVision specialises in advising clients on data protection and UK GDPR compliance.
Tips for Businesses
Introduce a Mobile Devices policy that sets clear rules on when and how staff may use personal phones for work. Require employees to withhold their personal number or use a business calling app. Regularly review your data handling practices to ensure personal information belonging to staff and customers remains protected.
As a UK business owner, you know that data protection compliance matters. Every UK company owner knows the Information Commissioner’s Office (ICO) can fine UK organisations up to £17.5m. However, some business owners overlook that asking staff to use personal mobile phones to make business-related calls can be a data protection offence. This article will explore the potential disadvantages of asking staff to use their personal mobile phones, to help your business avoid falling foul of the General Data Protection Regulation (GDPR) and facing a potential ICO fine.
What is the GDPR?
The General Data Protection Regulation (UK GDPR) is a critical law providing data protection rules for UK businesses. The GDPR focuses on the use and handling of ‘personal data’. Personal information includes all data which you can use to identify an individual.
It is important to note that personal phone numbers and email addresses constitute personal information, meaning you must handle them according to GDPR rules.
Any business that forces staff to disclose their personal information to third parties and consumers without exceptional reasoning is likely to have breached the GDPR. For example, the ICO has not typically taken kindly to UK companies asking employees to make business calls on their own mobile phones.
Does the GDPR Ban Personal Phones for Business?
The short answer to this question is ‘it depends’.
While the GDPR does not provide an outright ban on using personal mobile phones for business purposes, it does set limits on their use. The aim of limiting personal mobile use is to achieve two things:
- avoiding employees’ personal data getting into the hands of third parties; and
- ensuring customer data and third-party information cannot be stored and saved by staff outside your computer system.
Let us explore scenarios where your business should and should not ask employees to use personal mobile devices below.
Continue reading this article below the formCall 0808 196 8584 for urgent assistance.
Otherwise, complete this form, and we will contact you within one business day.
When Can I Ask Staff to Use Personal Mobiles?
Your business will ensure compliance with data protection rules if it asks staff to use their personal mobile phones in a way that protects their information.
The most obvious example of mobile phone-related personal information is the mobile phone number itself. For this reason, many businesses ask their staff to block their number when calling individuals for business purposes. Individuals can do this within the settings of most smartphones or, where this is not possible, by calling through a specific number.
However, businesses know that many individuals do not answer calls from ‘unknown’ or ‘withheld’ numbers, so this is not always feasible. In such cases, companies can ask their staff to use an app that provides an alternative telephone number. These systems usually work by having the individual log in to another phone through their personal handset.
When Should I Avoid Asking Staff to Use Their Mobiles?
The primary rule is to ask staff to call an individual after first protecting their personal mobile number. Asking an employee to call through their own mobile phone number risks:
- the third party providing their phone number to others without their consent;
- that staff member being harassed or stalked through their phone number; or
- the third party using malicious code within messages to plant a virus or GPS location data tracking bug.
Whilst these risks can exist with company mobile phones, they occur to a lesser extent as most company phones are turned off at the end of the business day. Additionally, you can easily change company mobile numbers. In contrast, individuals usually try to keep the same mobile phone number permanently due to the inconvenience of changing it.
Key Takeaways
Ensuring staff use their personal mobile phones in limited circumstances is a good way of achieving GDPR compliance. Some business owners set limits on using staff mobiles by asking a lawyer to draft a suitable Mobile Devices policy. However, the primary GDPR rule is to ensure that personal information belonging to your staff or customers is kept safe and secure.
If you need help ensuring the safe use of personal mobile phones in the workplace, LegalVision provides ongoing legal support for businesses through our fixed-fee legal membership. Our experienced [insert data, privacy and IT lawyers help businesses manage contracts, employment law, disputes, intellectual property, and more, with unlimited access to specialist lawyers for a fixed monthly fee. To learn more about LegalVision’s legal membership, call 0808 196 8584 or visit our membership page.
Frequently Asked Questions
No, they are not mandatory, but they can help avoid confusion. For example, if an individual is unsure whether to use their mobile phone for a work task, they can check the policy.
Because, compared to twenty years ago, individuals tend to own multiple internet-enabled devices. Where an individual might have been lucky to own a mobile phone, most people now own smartphones, smartwatches, tablets and laptops.
Asking staff to call through their personal numbers risks exposing their private information to third parties, potential harassment or stalking, and malicious code attacks. These risks are greater with personal phones than company devices, which employees can easily change or switch off after hours.
You can ask staff to block their personal number when making business calls or use an app that provides an alternative telephone number. This protects employees’ personal data from third parties accessing it without their consent, reducing your risk of an ICO fine.
We appreciate your feedback – your submission has been successfully received.
