Findings
12 Personal devices monitored
Owning the network does not own the phone: the EU and UK guidance ask for private use to be kept out, the US Stored Communications Act does not let an employer into an employee's personal accounts, and the New South Wales and Victorian acts ask for the owner's consent to track a person or their own device.
For the DPO and counsel: What on the personal device is monitored, how is private use kept out, and whose consent or authorisation covers it?
Where it comes from, location by location
- Personal devicesofficial guidance, not lawTell private from business use so private information is not monitored; the employer's ownership of a device does not remove the secrecy of communications. (if personal devices are monitored) WP249 para 5.4.2(a)WP249 para 6.1 official guidance, not law
- Personal devicesofficial guidance, not lawWhen workers use their own devices, make sure private use is not captured. (if personal devices are monitored) ICO monitoring guidance para 3.11(c) Human Rights Act, Article 8, named, not quoted official guidance, not law
- Personal devicesstatutory requirementAn employer can authorise access to messages on a service it provides; that does not reach an employee's personal webmail or accounts, which need the user's authorisation. (if personal devices are monitored) SCA 2701(a)SCA 2701(c)(1)SCA 2701(c)(2)
- Personal devicesstatutory requirementTracking a person, or monitoring a computer they own, needs their consent; the employer's own devices rest on its possession or control. (if personal devices are monitored) NSW SDA s 9NSW SDA s 10
- Personal devicesstatutory requirementA camera in an employee's home or belongings needs the owner's or occupier's consent. (if personal devices are monitored) NSW SDA s 8
- Personal devicesstatutory requirementTracking a worker as a person, or through their own phone or vehicle, needs the worker's consent. (if personal devices are monitored) Vic SDA s 8