The risks of BYOD policy

In the “old” days, employees took whatever their employers gave them when it came to cellphones or personal digital assistants. In most cases, companies used Blackberry products for business use, and that is what their staff carried. However, the popularity of devices such as Apple and Android smartphones prompted a backlash from staff demanding to use their product of choice. Many employers, seeing a way to reduce costs, invited employees to “bring your own device” (BYOD). Usually, there is a catch, however: the company will not buy or support the devices. Unfortunately, BYOD policies may be an example of short-term gain, without full consideration of the risk.

I will not address the potential security risks that can emerge when employees access corporate data through devices or means that may not be protected as well as they could be. What I will comment on is the fact that by relinquishing ownership of their employees’ devices, employers may unwittingly reduce their right to search the contents thereof.

While the law is not entirely clear on this issue, there is a widespread view that if an employer owns the devices that their employees use, be it a computer, tablet, smartphone or otherwise, then the employer has certain rights to inspect and search it. As such, they can see whether the employee has stored inappropriate material, copied confidential information or otherwise engaged in misconduct that might give rise to discipline.

Many readers will have heard about R. v. Cole, a recent Ontario decision involving a teacher who was found to have pornographic images on his school-issued laptop. When an IT employee doing routine maintenance discovered those images, the police were contacted and the teacher was eventually charged with various criminal offences. The trial judge decided that much of the evidence had to be excluded. Many observers interpreted this decision as a shift in the law, suggesting an employee’s privacy rights would preclude employers from searching the contents of a hard drive on a company-issued laptop.

My view, however, is that it is important to remember the context of that decision: a criminal prosecution. The issue was not whether the employer had the right to review the contents of the hard drive and respond accordingly in the context of the employment relationship. The issue was whether the police and the Crown prosecutor had the right to rely upon the images that were found on the hard drive in order to support a criminal prosecution. I remain of the view that employers do have the right to search hard drives on company-issued devices, as well as monitor Internet and email usage. I note that the Cole matter has made its way to the Supreme Court of Canada, which recently heard oral arguments but has not rendered its decision yet.

It’s always prudent to have a clearly worded policy in place setting out what the employers’ rights are and making employees aware of any potential infringement upon their real or perceived privacy rights. Employers will want to be in a position to rebut any suggestion the employee had no idea their activities might be monitored. While this is not mandatory, it is certainly helpful. In the past, it has often been compelling for an employer to justify a search by explaining that it owns the equipment or server in question. I suspect that our courts will be less receptive when the equipment is owned and maintained by the employee.

Stuart Rudner
Miller Thomson LLP