Legal Risks of Using Personal Devices for Work
In the modern working environment employees often run business activity on their own laptops, phones and tablets, which is convenient for the company but turns into a serious legal risk when clear rules are absent: both corporate communications and business information, and data about employees and their contacts, migrate to personal devices. Such processing falls within the scope of the personal data protection legislation of Georgia, so the organisation must know in advance which principles and which legal bases apply to this process. This is precisely why a bring-your-own-device policy is written — a document that gives the regulation a practical shape and avoids conflicting situations in advance, before an incident or a regulator's question makes the gaps visible.
Data Processing Principles as the Foundation of the Policy
The principles established by law form the skeleton of any policy: data must be processed lawfully, fairly, transparently for the data subject and without violating the subject's dignity; collected only for specific, clearly defined and legitimate purposes; processed only to the extent necessary and proportionate to the aim; kept accurate, with inaccurate data corrected or erased without unjustified delay; and stored only for the period necessary for the legitimate purpose, after which the data must be erased, destroyed or kept in depersonalised form. A separate emphasis lies on security: for the purpose of data protection, such technical and organisational measures must be taken as adequately ensure the protection of data, including from unauthorised or unlawful processing, accidental loss, destruction or damage. For personal devices this requirement is particularly strict, because the device escapes the company's direct control and travels into every environment of the employee's life.
Legal Bases of Processing in the Employment Context
Processing is admissible only where a basis provided by law exists, and this list must be analysed when drafting the policy: the data subject's consent; performance of an obligation under a contract with the data subject or steps preparatory to such a contract; processing provided for by law; performance of duties imposed on the controller by legislation; public availability of the data; protection of vital interests; significant public interest; tasks of a sphere of public interest; legitimate interests of the controller or a third party; and processing necessary for considering the data subject's application. In the context of personal devices the boundary between consent and legitimate interest arises most often: what the employer may do under its own interest and what requires the employee's separate consent. Selecting and substantiating the basis falls on the controller, which is why this step is the principal filter against unlawful processing.