Lawsuit: Did company spy on former user’s iPhone?

When an employee links a personal account to a company iPhone, who is responsible for removing it when the user leaves the company? A court recently weighed in.

The facts of the case: Santiago Victor worked for Sunbelt Rentals, Inc., and was given a company iPhone and iPad for work and personal use. He set up a personal Apple account linked to both devices.

Victor later informed his employer that he had accepted an offer with a rival company and gave his two-week’s notice. Sunbelt dismissed him instead, and Victor turned in his iPhone and iPad.

New iPhone, same account

Victor’s new employer also provided him with an iPhone, which he registered to his same personal Apple account. He used the phone for several weeks before noticing that his account was still synced to the phone he turned in to Sunbelt. Therefore, for several weeks his text messages and data from his new employer’s phone were also being transmitted to the old phone at Sunbelt.

Victor claims that around this time, Sunbelt began “investigating Victor’s post-employment acts, conduct and communications,” and “intentionally accessing Victor’s private electronic communications and data,” including text messages.

When Sunbelt sued Victor for breach of contract and misappropriating trade secrets, among other counts, Victor counter-sued for privacy violations and intercepting electronic communications.

Court weighs in

The court dismissed Victor’s claims, saying he couldn’t show that Sunbelt had either intercepted or ready any of his text messages or violated his privacy.

On the first claim, the court ruled:

Victor has failed to allege facts sufficient to establish that Sunbelt “intentionally intercepted” any of his text messages. By Victor’s own account, the text messages appeared on his Sunbelt iPhone as a result of Victor’s act of syncing his new iPhone to his Apple account without first un-linking his Sunbelt iPhone … In other words, Sunbelt did not intentionally capture or redirect Victor’s text messages to the Sunbelt iPhone—the transmission of those messages was entirely Victor’s doing.

The privacy violation claims failed in part because when Victor had synced his account to his new company’s phone, he didn’t unsync it from Sunbelt’s iPhone. In other words, it was his responsibility to make sure his Apple account was de-synced from the Sunbelt phone.

Narrow case, broad implications

This kind of situation may not be as rare as it would seem. While lawsuits involving company-owned or BYOD phones might not make it to court frequently, confusion around the responsibilities of users and employers when employment ends abounds.

Winding up on the wrong end of one of these disputes could prove costly. Here are some keys to avoiding legal trouble with your mobile strategy, BYOD or otherwise:

  • Spell out rights. As Venkat Balasubramani of the Technology and Marketing Law Blog observes,  a clear waiver signed by the employee could have likely prevented this in the first place. Having policies and procedures in place for handling disputes internally could help prevent having to defend your company in court.
  • Have a decommissioning process. Make sure there’s a standard policy on removing personal information from phones once an employee quits or is terminated. You may want to make it a two-step process – first having employees remove their own info, then doing a second wipe once the device is turned in. That way, you can show there was consent.
  • Watch for outside accounts. While removing information from devices is fairly straightforward, keep in mind some cloud accounts may still be linked on the user’s end. Walk employees through the steps they’ll need to take to remove these links.
  • Consult with HR as needed. It’s still possible you may find some personal information coming through on a device after it’s been taken out of service. In this case, consult with your HR department to make it known you weren’t looking for any information, then delete it if you are able to.

Make Smarter Tech Decisions

Get the latest IT news, trends, and insights - delivered weekly.

Privacy Policy