An employee uses their personal phone to respond to a work email from the parking lot, even before clocking in. In the evening, they receive a text from their manager via a messaging app installed on the same device. When the employer decides to “secure” the work data that flows through this device, we enter a zone where labor law and personal data protection overlap.
Law 25 and BYOD devices: the real blind spot of internal policies
Most company policies regarding personal phones are limited to regulating usage: when it can be checked, in which areas, during what hours. The problem arises when the employer wants to go further, that is to say, access, retrieve, or delete data on a device that does not belong to them.
You may also like : Unemployment in 2024: Everything You Need to Know About New Eligibility Conditions and Your Rights
With Law 25, Quebec imposes strict governance obligations on organizations as soon as they handle personal information. However, a personal phone used for work almost always contains a mix of data: family photos, private conversations, but also work emails, client contacts, internal documents. If the employer installs mobile device management (MDM) software to protect their data, they end up with technical access to all the content on the device.
When discussing the use of personal phones for work in Quebec, the question is no longer whether the employee can scroll through Instagram during their break. The question is: who controls what on a device that belongs to the employee, and on what legal basis.
Further reading : Tips and Practical Advice for Better Managing Your Daily Budget
Quebec employer obligations regarding personal information on BYOD phones
Law 25 has strengthened several requirements that directly affect BYOD practices. Specifically, before asking an employee to use their phone for work, the organization must ensure compliance with a precise framework.
- Obtain informed and specific consent from the employee before any collection of personal information via their device, including location or usage metadata
- Document the security measures applied to the work data that flows through the personal device, and limit retention to what is strictly necessary
- Provide a procedure for deleting work data at the end of employment that does not affect the employee’s personal data
- Designate a person responsible for personal information protection within the organization, an obligation that has been in effect since the early phases of Law 25
The penalties provided by Law 25 for non-compliance can be very high. A policy that simply states “the employee agrees to use their phone” without detailing these elements is not sufficient.
Remote wiping and employee privacy
The most contentious scenario occurs during a departure. The employer activates remote wiping via the MDM to protect their data. As a result, the employee’s personal photos, messages, and applications also disappear. This type of intervention, without prior documented consent, exposes the employer to privacy infringement complaints.
The Quebec regulation on anonymization, set to come into effect in 2024-2025, adds a layer of complexity. Organizations must structure the retention and reuse of mobile device data well beyond what is covered by traditional HR policies.
Employee rights: can one refuse to use their personal phone at work in Quebec
Under Quebec law, the employer has a management power that allows them to organize work and set rules. However, this power has clear limits when it comes to imposing the use of an employee-owned asset.
No Quebec law requires an employee to provide their own phone to perform their professional tasks. If the employer requires the use of a mobile device, it is their responsibility to provide it or, failing that, to financially compensate the employee. Responses vary on this point by sector, but the principle remains the same: the obligation to provide work tools lies with the employer.
An employee who refuses to connect their personal device to an MDM system or install a work application is exercising a legitimate right. The employer cannot penalize this refusal without exposing themselves to a claim, especially if no written agreement stipulated this obligation at the time of hiring.
Surveillance and evidence: the limits of employer power
The right to privacy does not disappear at the office door. An employer who accesses personal emails, browsing history, or private messages stored on an employee’s phone exposes themselves to challenges in court. Evidence obtained through non-compliant surveillance may be deemed inadmissible.
The strongest policies clearly separate the professional space from the personal space on the device, for example through a secure container that isolates company data. This technical approach limits risks for both parties.
Drafting a BYOD policy compliant with Law 25: the non-negotiable elements
A personal phone policy at work that holds up in 2025 in Quebec is not just a paragraph in the employee manual. It must cover personal information protection as well as productivity.
- Clearly define which work data can flow through the personal device and which are excluded (health data, social insurance numbers, etc.)
- Specify the employer’s access rights: what they can see, what they cannot see, and under what circumstances
- Regulate the data deletion procedure at the end of employment with a protocol that preserves the employee’s personal data
- Provide financial compensation or a material alternative for employees who refuse BYOD
The document must be signed by the employee, updated regularly, and accessible at all times. A policy drafted in 2019, before the implementation of Law 25, is likely outdated on several points.
The boundary between management rights and privacy infringement often lies in the technical details. An employer who wants to secure their data without encroaching on their employees’ rights must think of their BYOD policy as a compliance project, not just a simple addition to the internal regulations.