The folks at Identity Theft 911 remind us of the need to be "smart" about handling smartphones. In a recent post, the company warns that the wealth of data on these devices can substantially expose an individual if his or her device(s) are not purged upon disposal. The same is true, of course, for employers with respect to the phones and other devices they make available to their employees, as well as the employees’ own devices which employers permit to access their systems.

Whether because of personal preference, workforce turnover, technological advancement, a better provider contract, or business needs generally, phones and other communications devices are updated frequently. This typically results in the disposal of old devices which can have significant amounts of data stored on them. This data may include not only the personal information of the user of the phone, but sensitive company information, as well as personal information of other employees or the company’s customers. 

Employers should be taking steps to ensure these devices are handled properly. From a technical perspective, Identity Theft 911 notes that fortunately there are a number of ways to ensure that all sensitive data are cleared from a phone’s memory before it is thrown away. They warn, however, that it may not be enough to use a handset’s option to restore it to factory settings. Rather, the phone’s SIM card(s) which stores information should also be obtained, removed, purged, and/or destroyed, as appropriate.

From an employment policy perspective, employers should consider establishing policies to better manage the use of these devices. Policies such as:

• limiting the kinds of devices that can be used,
• maintaining an inventory of the devices being used,
• controlling the information that can be stored on the devices, and
• securing/purging devices upon termination of employment,

can go a long way to minimizing risk of a data breach involving sensitive personal and company information. Of course, employers that take these steps need to be mindful of employees’ expectation of privacy with respect to personal information that may be stored together with company information.  Such policies should be a part of any Written Information Security Program (WISP).