CIPP/US Study Guide
Chapter 12: Workplace Privacy

LBS, DLP, BYOD, and Teleworking Policies

Monitoring policies must address location-based services (GPS on vehicles generally OK; tracking people themselves is more limited), data loss prevention (DLP) (powerful but privacy-invasive), BYOD (security risk plus monitoring limits on personal devices), and teleworking (home-network and household privacy issues). Each blurs the personal/professional line.

Location-based services (LBS): tracking company vehicles via GPS is generally permitted for business purposes during work hours with prior notice, but tracking employees themselves faces greater limits. Connecticut prohibits electronic monitoring without written notice ($500 first-offense civil penalty); California makes using an electronic tracking device to determine a person's location a misdemeanor.

Data loss prevention (DLP): combines security tools, employee training, and policies. Powerful endpoint features (keystroke logging, activating webcams, geolocation) raise serious privacy concerns - a privacy impact assessment is good practice.

BYOD and teleworking

BYOD shifts control to employee-owned devices, creating security gaps; the same monitoring used on work devices may be inappropriate for personal ones - disclose monitoring and consider consent, minimizing exposure of private data. Teleworking blurs home and work: secure home networks, lock screens, shred confidential papers, and remember family members may appear on video.

COIT reversal

The consumerization of IT (COIT) reversed the old adoption path: technology now often emerges in the consumer market first and is driven into the workplace by employees' personal devices and accounts.

Key terms - quick answers

What is “Location-based services (LBS)”?
Geolocation data from phones, GPS, and tablets enabling tracking of a user's physical location; tracking company vehicles is generally allowed, but tracking employees themselves faces greater limits.
What is “Data loss prevention (DLP)”?
A strategy and tools to ensure sensitive data is not accessed, misused, or lost by monitoring and controlling endpoint activities; can be highly privacy-invasive.