india
Personal mobile device monitoring by employer legal or not?
<p>So here is my case. I work at a company where I recently came to know that they were monitoring my personal mobile whenever I was connected to the company Wifi. No consent was taken nor was there any transparency about this. I was not told that even personal mobiles are monitored. Besides I want to know that can I sue my employer for this? Please suggest me regarding the applicable laws in India and how strong my case is because their monitoring has resulted in some personal issues which are now affecting me so I want to take them to court and sue them.</p>

<p>Having a WiFi &quot;availeable&quot; does not mean it is &quot;unmonitored&quot;. In fact, you should expect it to be monitored in all cases where you don't own the router!</p>
<p>The company is fully in their right to monitor the WiFi and might even be required to do so to shield themselves from liability from what you do. The Network architecture is basically like this: Your phone requests the company router to call a website, the router requests the website, then it sends the website to your phone. It's rather easy for the company to just maintain a log of which IP requested what site when, just like the servers you request data from are obligated to record under some cases who acces them when. But that is not <em>monitoring your device</em> it is <em>monitoring the traffic you create</em>. Which is different. The company might need to maintain these logs who of the company requested content in case that the accessed content was illegal or in case you compromised the company secrets.</p>
<p>And they told you about it: the router you use to access the network is a <em>work device</em>, so monitoring of it shall be expected.</p>
<h2>Accessing your device?!</h2>
<p>you alleged they <em>access your device</em> through the WiFi. But do you have proof they did this? Because they have the right to monitor the traffic you create that goes through their WiFi, which is not them accessing your device. If you send an unencrypted E-Mail, then it might show up in their logs, together with the text and contact address. That however is <em>not</em> them pinging your device, breaking the security that keeps the contacts n it from being read from outside and then using those.</p>
<h2>Conclusion</h2>
<p>I don't believe they illegally accessed your device in the first place. They might have monitored all the stuff you did <strong>on the internet</strong>, and that fully legally as they <strong>monitor the router</strong> that they own and that is a <strong>work issued device</strong> which they told you they monitor.</p>

<p>Regarding Indian law, the <a href="http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf" rel="nofollow noreferrer">Personal Data Protection Act, 2019</a> (text of unknown authority) was introduced in Lok Sabha, but was tabled on 11 Dec 2019. That might have added GDPR-like protection, but it's presently just an idea and not a law. However, there is an existing law, the <a href="https://en.wikipedia.org/wiki/Information_Technology_Act,_2000" rel="nofollow noreferrer">IT Act, 2000</a>, which makes unauthorized access of a computer penalizable (§43). Now the question is whether they accessed your computer without your permission. A computer is</p>

<blockquote>
  <p>any electronic, magnetic, optical or other high-speed data processing
  device or system which performs logical, arithmetic,and memory
  functions by manipulations of electronic, magnetic or optical
  impulses, and includes all input, output, processing, storage,
  computer software or communication  facilities  which  are  connected 
  or related  to  the  computer  in  a  computer  system  or computer
  network</p>
</blockquote>

<p>so probably it is a computer. What's not clear is whether <em>you</em> violated the law by accessing their wireless network. I assume you accessed it with permission: I am not sure that you are aware of the exchange of permissions that took place "behind the scenes" whereby you could access the network. Mobile device OS's often respond to network-access protocols with "yeah, whatever, just give me access", without forcing you to read the TOS and explicitly click an "Okay, I understand and agree" button. So it is possible that you "agreed" without knowing that you agreed.</p>

<p>Somewhere there is a document that constitutes the conditions under which you can use the network. It may be difficult to find that document (it may not be in a single place, e.g. might reference other documents). It is possible that you unknowingly "agreed" to let them harvest your contacts. You would need to discuss this with a lawyer, being more explicit about what company this is, what they accessed, and the lawyer could more authoritatively tell you whether they violated any clause of the agreement, or whether any clause on the agreement allowing them to do what they did is illegal given Indian case law. </p>
