Issue 3: 10 in 10

The COVID-19 pandemic has pushed employees out of the workplace in a way never experienced before. The effect often has been indiscriminate and impacted employees who traditionally do not have access to work email while outside of the office, or at all.

Employers responding to COVID-19 have needed to act fast when managing their workforce. Government rules which open up and shut down businesses, cases of infection within open workplaces, and enhanced medical screening procedures all mean that employers now need to communicate promptly with employees, including when they are out of the office.

Unsurprisingly, many employers are looking to mobile phones as the preferred method of communication. But communicating with an employee through their mobile phone raises some complex legal issues.

Employees’ personal mobile numbers are personal data of the employees. Collecting those numbers and sending communications to them means that employees’ personal data is being processed. Data protection laws around the world are therefore implicated when an employer stores and sends communications to an employee’s personal mobile phone.

The EU’s General Data Protection Regulation (GDPR) is often the first thing that comes to mind in this context. Deciding whether or not the principles laid out in GDPR allow an employer to use an employee’s personal mobile phone means looking at the context for the use.

GDPR’s principle of data minimization means requires that the use of the mobile phone number should be limited to uses which are necessary. It requires an employer to justify why an alternative and less intrusive means of communication will not suffice.

GDPR requires an employer to have a lawful basis for communicating by mobile phone. For example, the communication must be for the purpose of furthering the employer’s legitimate interests, which must not be outweighed by the employee’s interests. Or the communication must be necessary in order to perform obligations of the employment relationship - a test that is interpreted narrowly. Texting an employee to say not to come into work because the workplace is closed for a deep clean is likely justifiable. Asking an employee by text to submit a post to the company’s wellness blog to describe what made them happy on their weekend is likely not.

Local considerations can alter the general principles. Local conditions in Germany, Spain and Italy, for example, mean that the use of an employee’s personal mobile phone number is best done with the employee’s consent. But consent as a basis for processing is potentially problematic in the EU. The guidance from regulators is that employees will often be incapable of giving valid consent in an employment context because of the power disparity in the relationship. And, to be valid, consent must be revocable at any time, leaving employers with a practical problem of what to do when an employee either does not consent or withdraws that consent.

Additional complications arise when you look outside the EU, particularly because there is no regional consistency. Korea will almost always require an employee’s consent for communications with an employee via their mobile phone whereas Singapore will not. Argentina and Mexico both require an employee’s consent but this must be opt-in in Argentina while opt-out consent will suffice in Mexico. And many Middle Eastern countries impose no obligations at all.

Employers must also be mindful of spam/direct marketing laws. Stringent requirements are usually attached to communications sent for commercial purposes, particularly when unsolicited. Even something as innocuous as sending an unsolicited text about available jobs could, depending on context, be seen as spam/direct marketing. Express consent is usually required for such communications.

Employers must also consider employment law requirements. These are idiosyncratic across the world and a detailed description is beyond the scope of this brief note. In general, issues can include: does reading/responding to texts and calls outside of work hours constitute compensable work; must an employer pay for or contribute to an employee’s expenses when their mobile phone is used for work; are instructions provided by text or voicemail legally valid (enforceable); and are employers responsible for what their managers and employees do when using their own phones for work purposes (unsurprisingly, the answer to this is often “yes”, meaning that employers need policies about what employees can and cannot do when communicating via personal mobile phones).

Mobile phones have long been used as an informal way for employees to communicate with each other. The changes in work driven by COVID-19 now give employers to opportunity to formalize how those communications should happen. Employers need to think carefully about the how, when and why they will use employees’ personal mobile phone numbers on a systematic basis. Employers should also take the opportunity to revisit their controls over their employees’ informal communications with each other via mobile phones.