READ: International Data Privacy Legislation Review: A Guide for BYOD Policies

CITATION
Absalom, R. (2012). International Data Privacy Legislation Review: A Guide for BYOD Policies.


Long article that focused on various countries (localities) and the BYOD trend in general with some helpful tips.  The focus is on privacy laws and the report offers guidance concerning privacy laws in 8 major geographic markets along with suggested mobility policy to help ensure compliance.  Here are some useful pieces:

• Enterprise mobility strategy must account for parameters set by local data privacy laws
• Legal advice should be sought when implementing a policy that may require monitoring an employee's mobile device
• Requiring employees to sign up to a mobile policy is the best way of ensuring both data security and legal compliance according to the author
•  There are differences in data privacy laws in different countries but two themes are fairly consistent
• Individuals must give full consent to their device being monitored
• Organizations accessing sensitive personal data must provide for encryption, secure channel, and strong PIN
• BYOD as many do not like to carry two devices
• Employees find ways to get around limitations and use their own devices
• In 2011, 80% of vertical markets reported employees using personal devices at work
• Most organizations are unlikely to have the required tools and expertise to manage and secure corporate data across all these disparate operating systems, applications, and devices
• 
  

Allowing BYOD leaves an organization in danger of breaching employee's private data and potentially open the door for a lawsuit.  On the other hand, allowing employees to have organizational data such as customer information on their phones may cause a lawsuit for the organization from the customer.  So organizations are stuck between a rock and a hard place.

Typical MDM features:

• Providing encryption if not supported natively
• Remote lock and wipe
• PIN policy enforcement
• Over-the-air (OTA) device recognition and enrollment
• Device location and activity tracking

While these solutions may answer some of the technical problems, installing such software on personal devices can create further issues related to employee privacy laws.

Recommended corporate mobility policy framework:

8 different countries and their laws as they pertain to BYOD are examined.  The one country that does not have a single comprehensive piece of data protection legislation is the US!  In case of litigation, it is irrelevant in the US if the device is corporate or private; privacy does not apply.  Further, certain vertical-specific legislation does have impact on BYOD.   For instance, the provisions of Health Insurance Portability and Accountability Act (HIPPA) do not allow patient data to be stored on personally owned devices.

A case study of Unisys is described (pp. 19-20) and hailed as a good model.  Also, it is stated that International firms that are implementing a BYOD policy are seeing the benefits to recruitment.

Multinational businesses that are rolling out BYOD policies understand that it cannot be done on a corporate-wide basis but must be managed according to the privacy regulations in each country in which it operates.

This means technology alone is not enough.  Policy alone is not enough.  And even technology and policy are not enough.  The local laws must be incorporated into the overall technology/policy/regulation umbrella for BYOD. 

Recommended Reading: The BYOD Gap: Trends, Strategy, and the State of Mobile Device Management, October 2011

By: Nima Zahadat