Redress Risk Management (post until May 31/19)
Legal Suppliers

BYOD policies a must to avoid eDiscovery disaster

Employers should prepare for the worst if they want to realize the potential savings of a Bring-Your-Own-Device (BYOD) policy, says Wendy Cole, director of project management and counsel at Heuristica Discovery Counsel.

Cole tells that both employers and employees are attracted to BYOD policies for different reasons.

“It’s obviously more convenient for workers, who only have to carry one device for both work and personal information, while businesses think they will save money by just giving an allowance towards monthly bills instead of supplying devices,” she says.

But those savings can easily be wiped out by eDiscovery problems, says Cole.

“If things go south and a company becomes embroiled in some sort of litigation or arbitration process, then the employer may have an obligation to gather that information,” she says. 

“If organizations are going to allow BYOD, it’s critical that they have policies in place, setting out who owns the data on it, and providing means to access the information if necessary.   

“Employers need to protect themselves because they open themselves up to sanctions, or compromise the defence of their case if they’re unable to get hold of it,” adds Cole, who notes that there are cases in which employees refused to hand over devices over fears their private information might be exposed.

Cole says a landmark 2012 Supreme Court of Canada decision backs up employee claims of privacy. The case involved a teacher accused of child pornography offences following a search of a work-issued laptop, and the nation’s top court acknowledged his limited right of privacy over information contained on it.

“If an employee has some privacy rights regarding an employer-owned device, then there’s going to be an even higher expectation on a personally owned one, even if it’s subsidized by the employer under a BYOD policy,” Cole explains.

Things can get even more complicated if employees rent devices from cellular providers, according to Cole, who says telecommunications companies may be unwilling to hand over data potentially compromising its customers' privacy, without some kind of agreement showing their consent.

However, she says many problems can be anticipated and accounted for in advance of litigation.  

Comment 9.c.ii of the Sedona Canada Principles touches on the issue of employee privacy, advising that “BYOD policies are essential if employees are using their own devices.”

“These policies need to set out who owns the data, and provide a means to allow the organization to gain access to that data if necessary,” it reads.

Cole says best practice is that no business information should be stored on devices, and notes that many can be set up to allow data on company servers or cloud storage systems to be viewed without being downloaded.

Meanwhile, a recent guide by the U.S. Sedona Conference organization set out five principles for meeting eDiscovery obligations involving BYOD.  

  • Consider your business needs and objectives, legal rights and obligations, and the rights and expectations of employees when deciding whether to allow, or even require, BYOD,
  • Your BYOD program should help achieve business objectives while also protecting both business and personal information from unauthorized access, disclosure, and use,
  • Employee-owned devices containing unique, relevant electronically stored information should be considered sources for discovery,
  • Your BYOD policy and practices should minimize the storage of discoverable information, but facilitate the preservation and collection of any data on the device, and
  • Employee-owned devices without unique, relevant electronically stored information do not need to be treated as a source for discovery.

To Read More Heuristica Discovery Counsel Posts Click Here
Lawyer Directory
New Media Forensics (keep up until June 30, 2019)Toronto Lawyers Association (post to 6.30.19)MKD International (post until Sept. 30/19)Feldstein Family Law (post until May 31/19)Greystones Health Jasmine Daya & Co.Grey Wowk Spencer LLPGelman & Associates