Can an employer remotely wipe/brick an employee's personal cellphone?

​

For companies with a "bring your own device" (BYOD) policy, there is increased concern over lost personal cellphones or former employees with sensitive and confidential company data on their devices. As a result, employers are taking what may appear to be an extreme measure to protect this data. One such measure is implementing a "remote wipe" of company and employees' personal cellphones. Certainly, the ability to wipe a company-owned cellphone would be permissible. Questions arise when the discussion turns to employees' personal cellphones and wiping both personal and company data from a device. Currently, this practice is not prohibited under state and federal regulations. However, it is important for employers to implement such policies cautiously.

The more employees use smartphones and other personal electronic devices to access company information, data and documents, the more important it is for a company to have policies and processes in place to ensure the security of its data. Cellphone-wiping provisions are typically included within a company cellphone policy or within a company property acknowledgment form, as well as part of a well-crafted BYOD policy. 

Such a policy should clearly address how IT and the company will manage employees' personal devices, including what steps will be taken when a device is lost or stolen and what will happen at the time of termination. Employers should ask employees to sign an authorization to wipe data from the phone prior to allowing them to access company data under a BYOD policy. Employers should also consider technology options that allow for the separation of personal and business data to avoid deleting personal data when possible.

As state and federal regulations struggle to keep up with new technology, an employer's ability to wipe employees' personal cellphones and devices will likely be tested through the courts. It will be important to stay up-to-date on rulings and proposed legislation. In addition, for international companies, it will be important to review the applicable laws in each country prior to implementing a remote-wipe policy or practice.