# Standards and Regulatory References — BYOD Privacy Policy

## Primary Legislation

### GDPR
- Art. 5(1)(c): Data minimisation — employer must collect minimum data from personal devices.
- Art. 6(1)(b): Contract performance — processing corporate data on employee devices.
- Art. 6(1)(f): Legitimate interest — protecting corporate data; must pass balancing test.
- Art. 13/14: Transparency — employees must receive privacy notice before BYOD enrolment.
- Art. 25: Data protection by design and by default — MDM must enforce privacy by default.
- Art. 32: Security of processing — appropriate technical measures for data on personal devices.

### National Labour Law
- **Germany**: BDSG Section 26; Works council co-determination Section 87(1)(6) BetrVG.
- **France**: CNIL BYOD guidance (2019); employer access limited to corporate container.
- **Italy**: Workers' Statute Art. 4; MDM monitoring requires trade union agreement.
- **Netherlands**: UAVG Art. 30; works council consent under Art. 27(1)(k)(l) WOR.

## Industry Guidance
- NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices.
- ENISA: Smartphone Secure Development Guidelines (2017).
- ICO: Employment Practices Data Protection Code, Part 3 — applicable to BYOD monitoring.
- CNIL: Questions & Answers on BYOD (2019).

## Enforcement Precedents

| Authority | Reference | Outcome | Issue |
|-----------|-----------|---------|-------|
| Autoriteit Persoonsgegevens (NL) | 2020 Investigation | Compensation order | Remote wipe of personal phone disproportionate |
| CNIL (France) | 2019 Guidance | Framework | MDM limited to corporate data |
| Garante (Italy) | 2021-0547 | Restriction | MDM accessed personal app list |
| ICO (UK) | Employment Code Part 3 | Guidance | Full device wipe on BYOD unacceptable |
| LfDI Hamburg (Germany) | 2021 Audit | Corrective measures | BYOD without works council agreement |