19

I encountered a situation in the past which was very uncomfortable for me and I am not sure how to handle this/act if I get into something similar in the future. For my work it was necessary to confirm crucial actions with a transaction authentication number (TAN) procedure, without this confirmation I couldn't do my job.

From day to day our IT-department changed the TAN procedure to a mobile authenticator. My manager wanted me (and my other colleagues as well) to use our personal mobile phones to install the required app and use them for the TAN procedure. I tried to refuse this by explaining him it's my personal device and risks of possible security issues. But he insisted on using the new procedure, it would be mandatory after the transition phase and he wouldn't be able to provide us company devices so fast.

Due to the facts that I relied heavily on these TANs to do my daily work, I didn't receive much support from my other colleagues and I was a very small fish in the company I followed the directive.

So my questions are:

Can my manager make me use my personal devices (mobil phone, notebook etc.) for work, when there is allegedly no other way to do my work (even it is just for a short amount of time)?

What can I do in situations like this, when resisting/refusing could cost me my job?

Note: I was accountable for the aftermath of doing or not doing my work and due to probationary period I've could been cut off easily.

10
  • 2
    Where are you located? This question is borderline asking for legal advice and may be closed for being off-topic.
    – David K
    Jan 13, 2017 at 17:40
  • I am located in germany It's not only about "asking for legal advice", its more about how to solve situations like this in a professional way.
    – Artery
    Jan 13, 2017 at 17:41
  • 1
    This is so common that it actually has a name "BYOD" - Bring Your Own Device. Under BYOD, Employees are expected to configure their devices (usually a smart phone) to receive work emails, etc. Personally, like you, I'm not a fan of this, but it is exceedingly common. However, I don't know about the legality of this. Professions that are unionised typically have fairly clear guidelines about this stuff as well. Jan 13, 2017 at 17:43
  • In many areas/fields having your own tools is required (car, power tools, etc), and so "you must provide your own cell phone for use at work" becomes part of the job requirements. The remaining issue becomes a strictly legal one, and is complicated by the fact that it was not advertised as part of the job or likely written into the job specification. However, in principal, in most jurisdictions (especially without a union, especially if you are on probation as a new employee) there are extremely few effective protections that you can fall back on. But for you, you'll need German legal advice.
    – BrianH
    Jan 13, 2017 at 17:46
  • 2
    Why not just get a prepaid cell for like $40.
    – paparazzo
    Jan 13, 2017 at 21:46

5 Answers 5

16

Can my manager make me use my personal devices (mobil phone, notebook etc.) for work, when there is allegedly no other way to do my work (even it is just for a short amount of time)?

No

(At least not in Germany)

There certainly is some wiggle room. If the company car broke down in the middle of nowhere and the driver asked you if you could call a mechanic on your private phone because he forgot the company phone, that would be acceptable. If the company later pays the expenses. And surely we would not be here writing if that had happened, because that would indeed be a non-planned, one-time, paid-for emergency that everybody is fine with.

Installing software on a private device to do your regular work for the company because the company is either too cheap or did a shitty job planning, is in no way something you need to do. I mean why do they even assume you have a phone? You owning a private phone is not part of your contract.

What can I do in situations like this, when resisting/refusing could cost me my job?

Get a lawyer. And talk to your Gewerkschaftsvertreter if you have one. Preferably in that exact sequence. Just because you are right does not mean that you get what you want. Especially in your Probezeit your employer can fire you any day for any reason. If he fires you right after you refuse to do this, you probably still have a good case in court, but until you win that case, you are out of a job and need to pay a lawyer.

If you want to refuse, make sure you don't flat out refuse. Show alternative options. What would be the cheapest device that could do what is required? How fast could you get one? It's never good to tell some one "No". It's always better to say "Not this way, but I have another solution to the problem".

4
  • 3
    As someone who doesn't usually carry a phone and going through this exact same thing; yeah this is a good answer, but expect even coming up with alternative solutions to be not really appreciated.
    – Erik
    Jan 14, 2017 at 10:00
  • 3
    +1 for "Why do they even assume you have a phone?" My relatives don't have smart phones and don't want them because they wouldn't really use them. If a tool is required for a job, it should be either part of their contract as something they need to have OR it should be supplied. Jan 20, 2017 at 16:53
  • In addition to that, he could offer to buy a smart phone with a prepaid simcard and get the expenses refunded by the company after the paperwork is done. It's cheap enough and if it's necessary for the work, should be no problem. Or just say your phone is broken and you are using a Windows phone for the time being. Surely the IT Department didn't develop the app for Windows phones :)
    – daraos
    Feb 16, 2017 at 7:30
  • In German Arbeitsgerich, first instance, you always pay your lawyer even if you win ;)
    – TomTom
    Oct 27, 2018 at 13:24
3

I wouldn't object, but I would request some legal groundwork be laid out.

Before installing the security application on your phone, you should ask your employer whether a written security policy for BYOD is available, outlining how to secure your device and the steps you have take, should your phone be lost or stolen outside work hours. Ask whether a 24/7 helpdesk or self-service is available to lock access to the secure application once the two-factor authentication is compromised.

Since you take your phone everywhere, while a company phone would remain on premises or at least at home when you go out on Saturday evenings, such a policy should be the minimum legal groundwork for BYOD in sensitive environments.

2

You should push back on this request. I think the responsibility of you not being able to get your work done in this case falls on the poor planning and presumptive behavior of your IT Department. They just thought they could sponge off everyone's phone? You should tell your boss about this problem and possibly someone else in charge needs to make them figure out a way around this. Your boss suffers as well when you can't get your work done.

If they can't get you a device so you don't have to use your phone, in a fast enough time, they may be able to exempt your account from this security requirement. Of course, they don't want to disclose this exception because they'll think everyone will want to do it and there will be anarchy... They always blow this stuff out of proportion.

1

As others have noted in the comments, this is a borderline legal question. I don't claim to know what the law would be on that here in the US, never mind in Germany.

But in practice, at least in the US, this is fairly common. It may be annoying, but I think you just have to take it as part of the requirements for the job.

At my present job, I develop web sites that have to look good on a smart phone. When I took the job I didn't have a smart phone, I had an ordinary voice/text message/that's all phone. So I had to buy a smart phone to do my job. The company did not offer to pay for it. I considered it annoying, but they pay me well enough that the cost of buying a smart phone just to be able to do my job is not that big a deal, and I sucked it up.

On the flip side, at my last job the company provided me with a company cell phone. I had to make a lot of company related calls and they didn't want me to have to pay for them myself. (That was a few years ago, when unlimited cell phone plans were not as common.) But this ended up being more of a pain than a benefit. Now I had to carry around two cell phones: one personal and one for work. It was just a pain. Maybe I could have used the company phone for personal calls. I never asked if that would be ok.

And think about things other than electronics. Most employees expect to drive their own cars to work, maybe even use their own cars for company business. I routinely drive between company locations for work purposes in my own car. Most employees wear their own clothes to work. Many bring their own coffee cup, pens and pencils, etc.

I think realistically, if you don't like it, you can complain to the boss and see if they're willing to make accommodations for you. If it really imposes a burden, it's likely other employees will complain and maybe they'll listen. If you're the only one complaining, the boss might just see you as a whiner. At that point the question becomes, Is this a big enough issue for you to quit over? Either by itself or in conjunction with other issues. Sounds harsh, but I think that's reality.

13
  • Just saying: You wouldn't quit over this, but you wouldn't let them install the software on your phone. Then either the company finds out how to do this without your private phone, or the try to lay you off, and that will be expensive in Germany if the reason is "refuses to let us install software on his private phone".
    – gnasher729
    Jan 13, 2017 at 21:33
  • 1
    @gnasher729 As I said, I'm not sure what the legalities would be in the US, never mind Germany. But consider analogies. Like, here in the US it's common for pizza delivery drivers to use their own cars, but to put some sort of sign on the car with the pizza place's name. If an employee said, "Hey, I want a job as a delivery driver, but I refuse to put that sign on my car", whether because he thinks it ugly or is afraid it will chip the paint or whatever, I'd be surprised if a court or government agency would say, Yes, you have to hire him even though he refuses to use the sign. Etc.
    – Jay
    Jan 15, 2017 at 0:17
  • Putting a magnetic sign on your car is one thing. Putting a possible malware on your private phone is quite another. Feb 16, 2017 at 1:00
  • 1
    @jay Actually, I do not see why it couldn't have a virus - or worse, that it actually tracks the worker per intent of the employer. German companies have been caught in the past to spy on their workers (not sure whether this was ruled illegal or was actually covered). Some legal decisions about what level of privacy workers are entitled to pretty much contravened what one would think is "common sense". There is a very good reason why German society is very sensitive about data breaches - because there were indeed quite a few cases where available data were ruthlessly exploited. Cont'd. Feb 16, 2017 at 19:48
  • 1
    @Jay I do not see how I am in a different question. If your employer demands that you use personal phones to install a business software, then this looks as a potential opening towards something exactly like what you describe as "my employer is spying on my personal life". Note that OP is very uncomfortable with putting this software on their phone. While we do not know their reasons, data protection/being spied upon by bosses and others is a very common thread in discussions in Germany. Perhaps OP might want to elaborate on their qualms? I would buy a cheap alternate device. Feb 17, 2017 at 0:30
1

There are different levels of this.

The easiest is that in some cases you need two-factor authentication which just means a code is sent to your phone as a text message, and you have to enter that code somewhere (that means only the owner of the phone, which means only you, can enter that code). It means you have to have your phone with you, which I wouldn't consider a hardship.

I'm a software developer. I write software, and then I install and test it on a variety of phones. I know what the software does (I wrote it), so I don't mind using my private phone to do this (plus an old private phone, plus two device owned by the company).

In your case, they are asking you to install software that is not under your control. There may be other things that will be done to your phone. That's not really acceptable, to me it goes a bit far. Having to use your own mobile phone cannot be mandatory, and having to accept company software installed on your phone goes a bit far for my taste.

And you can buy a bunch of used phones on eBay really cheap. It's not as if you need a phone with a huge screen and a gigapixel camera, so the money should be no problem for the company.

5
  • 7
    "I know what the software does (I wrote it)" Sorry, what? At best, you know what it is supposed to do ;-) Jan 13, 2017 at 23:43
  • @DiegoSánchez: I know what it does.
    – gnasher729
    Jan 14, 2017 at 20:08
  • @gnasher729 As a professional software developer of over 25 years, no you don't. You know what it is supposed to do. You know what it has been tested to do in the environments you have tested it in. There's typically too much combinatorial complexity (and too little full branch coverage with a large enough variety of data inputs) to get much more than a feeling of what it does. Even really good suites of unit tests tend to have missed "special" inputs, and missed branches of execution due to the extreme costs of full coverage.
    – Edwin Buck
    Oct 27, 2018 at 2:35
  • @EdwinBuck We sell that software to customers. They install it on their devices. They would be very, very annoyed if it causes problems. If my own software which is sold to customers messes up my phone, that's a tiny tiny problem for me compared to me shipping the software to customers and messing up their phones.
    – gnasher729
    Oct 27, 2018 at 20:22
  • @gnasher729 I wrote power grid control systems. We tested it with resources you likely don't have available in your company. Our smallest customer paid ten million dollars for one control center. If our software failed, the result could include regional blackouts, critical care patients possibly losing power, line repair crews getting electrocuted, or millions of dollars of equipment needing replaced. Even our software had bugs in it occasionally (typically non destructive). If you told me your software was flawless, I would never hire you. Customers aren't QA, and many don't report issues
    – Edwin Buck
    Oct 28, 2018 at 20:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .