Mobile Device Security Policies for Employers – Small and Large

As a business owner, perhaps you have seen articles about setting ground rules for BYOD (a.k.a. employees bringing their own devices to work to use for work purposes).  Placing restrictions on access to Company information, however, should not be limited only to those BYOD devices.  Instead, if the Company issues Company-owned devices to employees for use on Company systems, similar ground rules should be put in place to set expectations and provide the backdrop for any disciplinary action that may be needed later if an employee misuses Company information or loses an unsecured device.

Here are some questions to keep in mind as you develop policies for Company-owned devices issued to employees:

1.     Do you have an “Acceptable Use” policy in place?  Does it apply to both Company-owned and BYOD devices?

2.     Do you restrict the employee’s use of Company-owned devices?  (E.g., to be used for business purposes only, avoid storing personal information on the device, all information on the device shall be considered “owned” by the Company)

3.     Have you retained the right to take back any equipment that an employee does not use properly?  Similarly, do you ensure that Company-owned devices are surrendered upon termination?

4.     Do you require strong passwords to secure all portable devices (both BYOD and Company-owned)?  (You should.  See, e.g., Eric Griffith, “How to Create Strong Passwords,” PC Magazine, Nov. 29, 2011, for some good tips.).  Once you require passwords, remind your employees not to tape them to the front of their devices – instead, suggest alternate ways of remembering the unique passwords they just created.

5.     What about using portable devices on public or unsecured networks? (For instance, at the coffee shop while waiting for that triple-shot latte.)  Have you provided guidelines and training to your employees to avoid disclosing Company-sensitive information across such public networks?  This is especially important if the information is mission critical or could destroy the Company’s tactical advantage if its competitor were to access it.

6.      Do you require employees to report immediately the theft or loss of a Company-owned device?  Prompt reporting allows the Company to block potentially damaging intrusion attempts or to change the affected employee’s passwords to prevent unauthorized access.  The Company’s hands will be tied if the employee does not report the loss until several days later.

7.     Do you provide rules about whether Company documents can be downloaded to external devices and under what circumstances?  Consider mobile device management software to control the downloading of Company information to the device, to track the location of Company-owned devices and to enable remote wiping if the device is lost or stolen.

8.     Who handles the system updates to the device?  The Company?  (Probably, unless it’s a BYOD device.)  The employee?  (Probably only if the device is personally owned by the employee.)  If it’s a Company obligation, then ensure that the device is accessible to the Company when needed (i.e., “on demand”) to fulfill this requirement.

9.     Will the employees’ family members be accessing the device?  (More likely if it’s the only device in the house – less likely if there are other options available to the family.)  Consider restricting use of Company-owned devices to employees only.

10.  Do you prohibit the downloading of unauthorized content to the device?  Whether it’s pornography, another company’s trade secrets or pirated videos streaming the latest (copyrighted) episode of a favorite show, none of these things belong on most companies’ business equipment and could expose the Company to liability from a third-party who owns the rights to the content.

11.  Do you require encryption or password-protection when transmitting particularly sensitive Company information to outsiders?  If not, you should.  Take everyone opportunity to protect the Company’s trade secrets and try to keep them from public dissemination.  Having a reliable system in place increases the changes that a court would conclude that the Company’s trade secrets are deserving of such protection in the event of a breach.

·       Notably, in the 2012 Target data breach, the large, well-funded entity (Target) was not the source of the leak that allowed hackers to steal thousands of customer credit card numbers.  Instead, it was the HVAC servicing company that had minimal security protocols in place and effectively acted as the front door to enable the hackers to steal the data over a surprisingly long period of time. 

12.  Does the Company have record-keeping requirements (statutory, regulatory, etc.) that would apply to an employee’s use of a portable device?  Are employees who work remotely required to keep Company records and maintain certain Company files?  If so, consider implementing rules identifying when such record keeping should occur and provide guidelines for destroying extra copies or other pages that the employee might otherwise throw out in the trash at a remote site.  (Some states have “safe destruction of documents” laws intended to reduce the likelihood of identity theft or other unauthorized access of personally-identifiable information.)

A few closing thoughts – take every precaution to keep Company data secure.  Always require the installation and use of anti-malware/anti-virus and other security tools to limit a potential thief’s ability to misuse the Company’s data or to leave code behind that continues to collect the data even after the potential thief has appeared to withdraw. 

The more conscientious you are about keeping Company data secure, the more likely you are to avoid severe consequences (or at least reduce them) in the event of a data breach – whether the breach is caused by the concerted efforts of outsiders or by wrongful conduct of your own employees or by unintentional mishaps (such as the employee leaving the device in the back of a cab during a hectic business trip).  Watching the doors is always worthwhile.

Copyright (c) 2016, Christina D. Frangiosa, All Rights Reserved.

Why Privacy Policies Must be Personalized

(This was cross-posted.)

 

The best argument for why companies should never simply copy and paste the text of another entities' privacy policy onto their own website can be found in the recent announcement by the FTC of a settlement reached with Snapchat – relating to misrepresentations contained in the Privacy Policy, among other things. (Snapchat is not alleged to have used someone else's Privacy Policy as its own; however, its mistakes in its public statements about its products illustrate fully that companies should say what they mean, and mean what they say in their privacy policies!)

 

The FTC's Complaint Against Snapchat

On December 31, 2014, the Federal Trade Commission (FTC) announced its approval of a final order settling charges against Snapchat for deceptive trade practices in the form of:

 

1) Snapchat's misrepresentations to consumers that images or videos shared through Snapchat would actually disappear within the timing set by the consumer (and in no event more than 10 seconds after shared);

2) False promises that if a recipient were to take a screenshot of the image, the sender would be notified; and

3) Misrepresentations about the nature and scope of the data actually collected from a user's phone the Snapchat's Find Friends tool.

 

See also "FTC Approves Final Order Settling Charges that Snapchat Deceived Users," Bloomberg BNA, Social Media Law & Policy Report (Jan. 5, 2015); see also In re Snapchat, Inc., FTC No. 132-3078, Final Order (Dec. 23, 2014).

 

In addition to these claims about Snapchat's misrepresentations about its data collection and use, the FTC also alleged that Snapchat failed to secure its Find Friends feature, which failure resulted in a security breach in December 2013 relating to a database of 4.6 million Snapchat usernames and phone numbers. FTC Press Release, "Snapchat Settles FTC Charges That Promises of Disappearing Messages Were False; Snapchat Also Transmitted Users' Location and Collected Their Address Books Without Notice or Consent" (May 8, 2014).

Settlement with the FTC

On December 23, 2014, following the public comment period, the FTC formalized its complaint and gave final approval to the settlement, which requires Snapchat to:

1. Implement a comprehensive privacy program that will be monitored by an independent privacy professional (a third-party whom Snapchat has to pay) for the next 20 years;
2. Hire this independent privacy professional to conduct a follow up review every two years and provide a compliance report to the FTC;
3. Conduct this two-year review until December 23, 2034;
4. Revise Snapchat's privacy policy, product descriptions, advertising and any other public statements to disclose accurately the following:
   • The extent to which a message is deleted after being viewed by the recipient;
   • The extent to which Snapchat or its products/services are capable of detecting or notifying the sender when a recipient has captured a screen shot or saved a message;
   • The categories of personal information that Snapchat actually collects; and
   • The steps taken to protect against misuse or unauthorized disclosure of covered information.
5. Maintain records for at least five (5) years of the following types of documents:
   • Every communication to consumers about the extent to which Snapchat "maintains and protects the privacy, security and confidentiality of any covered information";
   • All consumer complaints directed at Snapchat, or forwarded to Snapchat by a third party, that relate to the conduct prohibited by this order and any responses to such complaints;
   • Any documents that contradict, qualify, or call into question Snapchat's compliance with this order; and
   • All materials relied upon to prepare the required Assessment, "including but not limited to all plans, reports, studies, reviews, audits, audit trails, policies, training materials, and assessments, for the compliance period covered by such Assessment."

Id. Lest anyone mistakenly believe that these consequences are not serious because there is no monetary penalty assessed, note that Snapchat risks civil penalties of $16,000 per violation per day if it fails to abide these terms. See  Letters to Commentators, at 1 (Dec. 23, 2014) (as provided by Section 5(1) of the FTC Act, 45 U.S.C. § 45(1), as adjusted by 16 C.F.R. § 1.98(c)).

 

Also note that the preparation of each of the items identified above will "cost" Snapchat money in terms of employee, consultant and/or contractor time, and in taking these resources away from working on money-making endeavors, whether they receive salaries or some other compensation.

Similar Settlement with Maryland Attorney General

In the midst of this dispute with the FTC, in June 2014, Snapchat settled a similar complaint with the Maryland Attorney General.

 

In its Complaint, the Maryland AG accused Snapchat of collecting data from its users' electronic address books without their knowledge or consent and "knowingly collect[ing] e-mail addresses and photographs from users younger than 13." "Snapchat to Pay $100,000 in Settlement with Maryland Over Privacy of User Snaps," Bloomberg BNA Social Media Law & Policy Report (June 12, 2014); Jeff Clabaugh, "Snapchat pays Maryland $100K in settlement," Washington Business Journal (June 12, 2014).

 

The settlement agreement with the Maryland Attorney General requires Snapchat to:

1. Create and publicize mechanisms for users to report accounts that may be used by children;
2. Provide notice and affirmative consent before Snapchat could collect any address book data – and this notice must appear separately from the user's agreement to the general terms of service; and
3. Provide Maryland with annual reports for the next 10 years, documenting its compliance with the settlement.

Id.; see also Maryland Attorney General's Office Press Release, "Attorney General Gansler Secures Settlement from Snapchat, Inc.; Mobile app developer can no longer deceive consumers by claiming its photo and video messages "disappear forever"; Snapchat also alleged to have collected personal information from children under age 13 without parental consent, in violation of federal law" (June 12, 2014); cf. Snapchat, Our Agreement with the Maryland Attorney General (June 12, 2014). This settlement also requires a mandatory payment to Maryland of $100,000. Maryland Attorney General's Office Press Release.

 

CONCLUSION: Privacy Policies Must be Customized

There is no single, standard form privacy policy. Instead, privacy policies have evolved as a place where web sites disclose to users what data are collected, from which users, and how the data are then used. Privacy policies must disclose correctly how that particular site collects and uses data. See Privacy Policy, Wikipedia (last modified Jan. 10, 2015) (provides a good summary of the history of privacy policy development).

 

As a result, never simply block and copy an entity's Privacy Policy and adopt it as your own. You have no idea why the other entity included the technical and/or detail oriented promises in its Privacy Policy, and simply copying because it "looks good" is a bad idea and can subject you to enforcement liability.

 

In fact, the only promises that should appear in your Privacy Policy about what you do with data, cookies, personal information, or other data you collect from a user's device are those things you actually do.

 

Christopher Olsen, assistant director of the Division of Privacy and Identity Theft Protection in the FTC's Bureau of Consumer Protection, actually stated it best:

 

The agency [the FTC] certainly supports and encourages the development of privacy protective products, but if there is one message we want to make sure is clear today, it is that, if you make promises about privacy, you must honor those promises; otherwise you risk FTC enforcement action.

 

"Snapchat Settles FTC Accusations of Failure to Purge 'Snaps' by Senders," Bloomberg BNA Social Media Law & Policy Report (May 8, 2014).

 

Copyright (c) 2015, Christina D. Frangiosa, All Rights Reserved.

Senate Hearing Scheduled on Mobile Privacy

On April 25, 2011, the Senate Judiciary Committee announced that its Subcommittee on Privacy, Technology and the Law will hold a hearing on "Protecting Mobile Privacy: Your Smartphones, Tablets, Cell Phones and Your Privacy" on Tuesday, May 10, 2011 beginning at 10am. Chairman Al Franken will preside over the proceedings. Prior hearings of the various subcommittees of the Senate Judiciary Committee have been simulcast over the Internet, and it appears that this one will be treated similarly. The recorded webcast should also be available after the hearing, if you miss it in real time.

The witnesses have not yet been identified, but should be posted on the Senate's hearing site when available.