Companies facing legal repercussions in supporting personal devices

Many companies are operating in a legal black hole by supporting personal mobile devices without considering the legal or financial disclosure ramifications, according to Forrester Research.

A report by the analyst house found that over half of nearly 1,000 companies surveyed in the US and Europe provide some kind of support for personal mobile devices in the workplace.

An average of nine per cent of companies provide full support, rising to 11 per cent in Europe, but there is very little legal guidance on the issue.

Chenxi Wang, principal analyst for security and risk at Forrester, told V3.co.uk that many organisations and individuals had not considered the full implications of this strategy.

"If sensitive corporate data is going onto these devices, you have to consider the implications if there is a problem," she said.

"For example, devices may be subpoenaed in legal cases. But in many cases existing privacy law means that enterprises cannot enforce this unless they have warned users in advance."

The American Bar Association is studying the issue to formulate guidelines, after earlier legal cases produced mixed verdicts, Wang said.

Meanwhile, EU Digital Agenda commissioner Vivian Reding is formulating new privacy and data sharing legislation to apply to all member states.

Wang urged companies to limit the use of corporate data to approved applications, and to make employees aware that they are responsible for confidential information, and that the device is not used for anything illegal.

In addition, security systems such as remote wiping capability and password protection should be installed as standard.

The Forrester survey also highlighted differences in employee attitudes in the US and Europe. European companies are more polarised in support for personal devices, providing a lot of help or none at all. In the latter case concerns over privacy laws are the chief deterrent to management, Wang said

In the US, however, companies are generally more aware of the legal implications of personal device support, and staff are more accepting of restrictions.

"There is an absolute difference in the two areas. In the US, employees are willing to give up a level of privacy in order to gain access to enterprise resources. The European workforce thinks privacy is a God-given right," she said.