Here are Five BYOD Principles to Consider from a Highly Respected Source

Principle 1: Organizations should consider their business needs and objectives, their legal rights and obligations, and the rights and expectations of their employees when deciding whether to allow, or even require, BYOD.

One notable comment tied to this principle is that “Significant legal implications may result if the organization is unable to access its business information on employee-owned devices.” We’ve seen a lot of litigation arise regarding company trade secrets and mobile devices are often highly relevant in cases like those. It’s important to consider and develop a game plan for potential discovery of mobile devices before litigation occurs. Doing so after it occurs may be too late.

Principle 2: An organization’s BYOD program should help achieve its business objectives while also protecting both business and personal information from unauthorized access, disclosure, and use.

A notable comment here is “Organizations should consider requiring employees to agree to the terms of the BYOD policy.” This is great advice and establishes expectations with employees as to what they can expect in terms or privacy on the devices vs. the obligations to make those devices available for investigation and litigation.

Principle 3: Employee-owned devices that contain unique, relevant ESI should be considered sources for discovery.

We would add the word “always” before “should be” in that sentence. BYOD devices may not be discoverable in every case, but they should at least be considered in every case. As we discussed in the post Busting the Myths Associated with Mobile Device Discovery, text messages, files, photos, videos, phone logs, phone notes files, phone voice memos and geolocation data is all data that is typically only located on the mobile device and is often discoverable. If you’re not considering that data as a potential source of unique, relevant data in discovery, you’re making a mistake.

Principle 4: An organization’s BYOD policy and practices should minimize the storage of––and facilitate the preservation and collection of––unique, relevant ESI from BYOD devices.

This principle discusses the proactive management of BYOD devices, which we recommend. However, we’ve seen on numerous occasions a need to conduct a forensic image to uncover attempts at hiding bad acts (such as theft of intellectual property), so it’s important to remember there are cases where you’ll need to collect everything. A BYOD policy signed by employees will establish the right to do so.

Principle 5: Employee-owned devices that do not contain unique, relevant ESI need not be considered sources for discovery.

True, but in many cases, it may be necessary to conduct at least a cursory investigation of the device to confirm that it doesn’t contain unique, relevant ESI and it’s important that you work with an experienced investigator that knows where to look. Until then, you won’t know for sure whether it has unique, relevant ESI or not.