The BYOD Blindspot: How Employee-Owned Devices in the Workplace Impact Investigations

There is potentially an infinite amount of collectible data on an individual’s personal device. Our personal devices, after all, play an outsized role in our daily lives; for messaging, GPS, mobile banking, calendars, photos, doomscrolling, and influencing. In today’s workplaces, there is an increasing trend of employees using their personal devices for work rather than employer-owned devices. This can lower employer overhead, require less initial technical set up, and generally be more convenient for employers and employees alike. But having employees use their own devices can lead to an intermingling of professional and personal information that creates a discovery dilemma when a workplace investigation arises.

Often, when a workplace investigation requires review of personal devices, we encounter a problem of how to preserve, access, and examine data while balancing individual rights and interests against those of the employer. The U.S. Supreme Court established the workplace exception to a Fourth Amendment search made by public employers which allows for certain employer-initiated searches on the basis of the employer’s own determination of reasonable suspicion on employer-owned devices. But they have made it clear that there is heightened protection for personally-owned devices.

For workplace investigations, ownership of the device is an essential starting point for the analysis of whether investigators may access a device for investigation purposes and protect the employer against a subsequent legal challenge (e.g., for tortious intrusion upon seclusion for private employers or violation of Fourth Amendment rights for public employers).

Employers should have a Bring Your Own Device (BYOD) policy that establishes that: (1) employees have no expectation of privacy for communications and data made on the employer’s communications platforms as well as communications made in the course and scope of employees’ work, regardless of whether they use a personal device; (2) the employer has a right to intercept and review any of those communications; and (3) the policy is based on a legitimate business purpose such as the security of proprietary and confidential information.

Employers should take the following steps to get ahead of BYOD issues in a workplace investigation:

• Develop a comprehensive BYOD policy
• Distribute the BYOD policy to employees and require confirmation that they have read and understand the policy
• Once an investigation begins, promptly notify all potential witnesses of what data collection may be within the scope of the investigation
• Develop a data collection protocol for the investigation
• Collect the devices and/or data as soon as practicable through appropriate methods

Krystel G. Becker is a member of Strassburger McKenna Gutnick & Gefsky’s team of independent investigators who can not only help employers develop strong workplace BYOD policies, but also conduct workplace investigations where an intermingling of sensitive personal and professional data is involved. The Independent Investigations team is led by Gretchen E. Moore, who holds a certificate from the Association of Workplace Investigators. We have experience investigating complaints of alleged harassment, including sexual harassment, discrimination, retaliation, bullying, fraud, and other misconduct for public, private, education, and nonprofit sector clients.

Back to News & Resources