4 ms·

My employer and I are bound by a working agreement negotiated through my union. The contract has privacy protections for many different types of personal inform

My employer and I are bound by a working agreement negotiated through my union. The contract has privacy protections for many different types of personal information and data that could potentially be accessed or collected by the company. Think location data, data at rest on both personal and company devices, and network traffic. Here’s the big issue I still have even with all of these ‘legal’ protections. The definitions are not highly technical and thus open to interpretation. Also, to my knowledge none of the clauses have been tested in the real world. How in the world am I supposed to feel secure that a legal agreement stops them from doing what is still technically possible? Even if they can’t use the data collected against me as admissible evidence in a disciplinary action what’s to stop them from collecting data anyway and then if they find something they don’t like they harass me in other ways? The issue is in MDM systems. Until we design them in a way preventing access to certain classes of information through technical means then no type of agreement or ethical code is safe. The device must be treated as hostile. We can’t simply rely on ‘ethics’ because, as we’ve seen play out time after time in America, corporations lose no sleep over saying one thing and doing another.

closeparen 7y ago
I declined corporate MDM on my personal phone. I’m confident that abuse of my data would be against policy, but I don’t feel like taking the risk that our technical controls can or will guarantee adherence to policy. At the end of the day, whatever agreements are in place, someone has access. I’ll take that kind of risk with i.e. Google employees and my Google searches, because it’s fundamentally necessary to provide me good search. There is just no reason to do it with my corporate security team and personal SMS.

closeparen 7y ago

I declined corporate MDM on my personal phone. I’m confident that abuse of my data would be against policy, but I don’t feel like taking the risk that our technical controls can or will guarantee adherence to policy. At the end of the day, whatever agreements are in place, someone has access. I’ll take that kind of risk with i.e. Google employees and my Google searches, because it’s fundamentally necessary to provide me good search. There is just no reason to do it with my corporate security team and personal SMS.