16 technology: byod The Bring Your Own
Device dilemma Employees are increasingly using their own personal devices for work purposes. Nadine Bhantoa of Penningtons Solicitors LLP examines the pros and cons for businesses
A Bring Your Own Device (BYOD) scheme is an attractive option for organisations looking to provide a more flexible work environment and save on the costs of maintaining employees‘ phones, laptops and tablets. However, it also exposes them to a higher risk of data protection and confidentiality breaches which need to be actively managed.
Data protection
Under the Data Protection Act 1998 (DPA), all organisations must keep personal data secure and take appropriate technical and organisational measures against ‘unauthorised or unlawful processing of personal data and against accidental loss or destruction of or damage to personal data‘.
If an employee uses a personal device to access an organisation‘s systems for work purposes, it is likely that they will also be able to access personal data for which the organisation is responsible. An employee‘s personal use of such devices increases the possibility of damage or unauthorised access to data, particularly if the user introduces a virus from downloading content or if the device is lost or stolen.
Confidentiality
If a business operates a BYOD scheme then it must be clear about what information can be accessed from a personal device. For example, it may be appropriate for a project manager working out of the office to access emails through his own device, but not for an HR employee to use a personal laptop to access payroll information.
BYOD policies
Businesses should manage these risks by implementing a policy to control the use of personal devices for work purposes. The following considerations should be taken into account:
Evaluate if it is appropriate for the BYOD scheme to apply to all
www.businessmag.co.uk
employees, bearing in mind the nature of information that will be accessible. The organisation should retain its discretion whether or not to allow the use of BYODs and should have the right to deny access to its systems at any time.
Only allow personal devices to be used for work purposes if they comply with the business‘s information security policies.
Require employees to notify the business in the event the device is lost or stolen.
Obtain employees‘ consent to the installation of software that enables remote wiping to protect against unauthorised access.
Consequences
Failure to implement appropriate security measures to protect personal data will be a breach of the DPA and could also put the business in breach of confidentiality provisions in its contracts. The Information Commissioner‘s Office has the power to impose penalties which could include fines of up to £500,000 on the business, rather than the employee at fault.
Details: Nadine Bhantoa
nadine.bhantoa@
penningtons.co.uk www.penningtons.co.uk
47% of adults use personal devices for work purposes
A survey commissioned by the Information Commissioner‘s Office (ICO) has shown many employers appear to have a ‘laissez faire‘ attitude to allowing staff to use their personal laptop, tablet computer or smartphone for work business, which the ICO claims may be placing people‘s personal information at risk.
The survey, carried out by YouGov, reveals that 47% of all UK adults now use their personal smartphone, laptop or tablet computer for work purposes. But less than three in 10 who do so are provided with guidance on how their devices should be used in this capacity, raising worrying concerns that people may not understand how to look after the personal information accessed and stored on these devices.
The news comes as the ICO published guidance explaining some of the risks organisations must consider when allowing personal devices to be used to process work-related personal information. The guidance explains how this approach, commonly known as ‘bring your own device‘ (BYOD), can be adopted safely and in a manner that complies with the Data Protection Act.
Simon Rice, group manager (Technology), said: ”The rise of smartphones and tablet devices means that many of the common daily tasks we would have previously carried out on the office computer can now be
worked on remotely. While these changes offer significant benefits to organisations, employers must have adequate controls in place to make sure this information is kept secure.
”The cost of introducing these controls can range from being relatively modest to quite significant, depending on the type of processing being considered, and might even be greater than the initial savings expected. Certainly the sum will pale into insignificance when you consider the reputational damage caused by a serious data breach. This is why organisations must act now.
”Our guidance aims to help organisations develop their own policies by highlighting the issues they must consider. For example, does the organisation know where personal data is being stored at any one time? Do they have measures in place to keep the information accurate and up to date? Is there a failsafe system so that the device can be wiped remotely if lost or stolen?”
The YouGov survey shows that email is the most common work activity carried out on a personal device, accounting for 55% of people who use their personal smartphone, laptop, or tablet computer for work purposes. This was followed by 37% who used a personal device to edit work documents and 36% to store work documents. All of these activities are likely to involve the processing of personal information.
Protect the device you love
It’s becoming increasingly commonplace for people to keep up-to-date with work when out of the office on mobile devices, checking emails and working on business correspondence on the train, tube or in a café. However, using a mobile device in a public place is fraught with visual data security issues. Whether it’s sensitive business or personal information, it doesn’t take a security expert to obtain data from a mobile device being used in a public area, as information can be unknowingly exposed to unauthorised onlookers.
To address the rising requirement for premium protection of Apple devices, diversified technology company 3M has expanded its range of screen protection films to include models for the new iPhone 5, providing a quick and instant solution to issues surrounding privacy, bad viewing conditions and everyday wear and tear.
The 3M privacy screen protector for the iPhone 5 provides privacy on the go, enabling a screen black-out past 60 degrees in the orientation of choice (portrait or landscape), to provide visual security for confidential on-screen information.
THE BUSINESS MAGAZINE – SOLENT & SOUTH CENTRAL – APRIL 2013
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36