The BYOD Thicket: Some Basic Steps to Take for Businesses

One of the hot-button issues for business clients in 2012 was the advent of "Bring Your Own Device" policies. The idea behind BYOD in the workplace is that employees who are allowed to use their own cell phones, tablets, and other storage devices may be more productive. And, of course, it may cut down on technology and training expenses for the company as well.

How does BYOD relate to non-competes? Because a substantial amount of potentially relevant evidence can be found on these personal devices. An obvious example is the use of text messaging to contact or solicit customers.

It is not clear if BYOD is a fad. The numbers on data security are fairly alarming, and corporate-owned devices may be in vogue if business owners feel as though relinquishing control over devices is too much of a risk.

But, for now, at least, I have had several clients who want to implement BYOD. Below are some key features of the BYOD agreement I use:

1. Registering the Device. It is not enough for a company simply to allow an employee to use his own cell phone for business purposes. The company must know what it is to ensure the security settings and installed software are consistent with company practice.

2. Security Maintenance. A strong BYOD policy has at its core the specific security requirements the company deems necessary. These include, at a minimum: implementing password protection, updating the device with security patches, and prohibiting the installation of unapproved software.

3. Account for Cloud Storage. Employees increasingly want to back-up a device to a cloud-based storage program. This may be acceptable to the company, but if it is, the company must have a means and procedure to ensure data is removed from the program upon termination of employment.

4. Remember Federal Law. This can come up in three circumstances. First, the BYOD policy should ensure that the device is not used in a manner that could lead to discrimination or harassment suits. Second, the employer can't inadvertenly run afoul of the Fair Labor Standards Act. Specifically, non-exempt employees should not be permitted to use the device during non-working hours for work purposes. Third, with the National Labor Relations Board cracking down on the use of social media policies, a comprehensive BYOD should specifically provide that the policy does not preclude employees from discussing the terms of their employment, or anything else that can be described as concerted activity under the NLRA.

5. Confidentiality Policies Must Apply. Any employer policy, whether expressed in a handbook or agreement, must relate to personal devices. If a company implements BYOD, it should place the employee on notice that confidentiality and proprietary rights restrictions apply to covered devices as well.

Every BYOD is different and should be tailored to achieve company objectives. My personal feeling is that BYOD will remain hot for a while until companies decide that the policies are too much of a security risk. I doubt BYOD ever will be held to undercut a claim that a company takes reasonable steps to protect its trade secrets. But a strong, clearly worded policy would certainly help eliminate that risk.

Employee Handbooks Not Relevant to Whether Computer Use Was Unauthorized Under CFAA (Accenture v. Sidhu)

One of the many unanswered questions surrounding the federal Computer Fraud and Abuse Act has to do with employee policies or handbook provisions.

Put simply, lawyers have been mulling over whether an employer can demonstrate that an employee's computer use was "unauthorized" within the meaning of the CFAA if the employee signs off on corporate policies that put him or her on clear notice of what kind of computer use in the workplace is prohibited. Though policies and agreements vary, one of the central tenets of this practice is to include as an unauthorized use the downloading or transferring of corporate information to a personal e-mail account or thumb drive. Policies also can be written such that information printed or stored off of an employer's computer server may not be used for competitive purpose, and that if the employee does so, such use will be considered unauthorized.

These policies are designed to expand an employer's remedies for unfair competition. But do they?

According to one recent federal court, the answer is "no." The case of Accenture, LLP v. Sidhu deals with the impact of policies very similar to those identified above. Because the employee allegedly violated those policies, Accenture filed suit in federal court under the CFAA. (In California, this issue is critical given its long-standing policy against post-employment restraints.)

The court dismissed the claim and noted that "[t]he relevant inquiry is whether the employer allowed the employee use of the computer system, irrespective of whether the employer would have revoked permission if it understood the employees' intent, or knew about the employees' conduct." The court also noted that a carve-out exception would undermine existing precedent and, more fundamentally, graft "corporate policy into the substance of the CFAA."

Policies like those above, however, still are very useful for employers. For one, it can help establish breach of contract, may eliminate an employee's rights to severance pay, and demonstrate knowledge of wrongful conduct.

--

Court: United States District Court for the Northern District of California
Opinion Date: 11/9/10
Cite: Accenture, LLP v. Sidhu, 2010 U.S. Dist. LEXIS 119380 (N.D. Cal. Nov. 9, 2010)
Favors: Employee
Law: Federal