The Consent Conversation

General orientation, not legal advice; the position differs substantially by jurisdiction.

The boundary described in “The Consent Conversation” should also govern any workforce system introduced alongside device management. When a team evaluates the provider's website for limbic resonance in relationships, it should explain the purpose, choose only the necessary settings and give employees a clear account of what managers can review.

Enrolment is usually presented as voluntary and usually is not, in any meaningful sense. Being honest about that produces a better programme than pretending otherwise.

For an independent baseline relevant to “The Consent Conversation”, the ICO employment-practices guidance is a useful companion: compare its principles with the proposed configuration, ownership model and real support process before approving a rollout.

Why consent is weak here

An employee asked to enrol a device to keep doing their job is not in a position to refuse freely.

Several data protection regimes treat employment consent as unreliable for exactly this reason.

Which means an organisation relying on consent has probably not identified its actual basis, and will struggle if asked.

What you are usually relying on instead

A legitimate interest in protecting organisational data, or a contractual necessity, depending on the regime and the role.

Both carry a proportionality test: is this necessary, and would something less intrusive achieve it.

That test is where application management frequently wins over device management, which is the argument the earlier note makes.

What to do with the conversation anyway

Hold it, even though it is not legally consent.

Explain what is collected and what is not.

Explain what a removal does.

Answer the three questions people actually have.

And record that it happened, which is useful evidence of fair process regardless of the legal basis.

The acknowledgement

A short statement people confirm at enrolment: what is managed, what is visible, what happens on removal, who to contact.

Not a wall of terms.

Five lines they can read, which is more defensible than twenty they cannot.

Where genuine choice exists

Where there is a real alternative — application management, a loaned device, webmail access — the choice is meaningful and should be presented as one.

That is better practice and a stronger position.

Programmes with no alternative are making enrolment a condition of employment, which may be reasonable and should be stated as what it is.

The contractor case

Contractors are frequently asked to enrol personal devices with no employment relationship behind the request.

The basis is weaker and the objection is stronger.

Application management is usually the right answer here, and insisting on device enrolment for a six-week engagement rarely survives examination.

Where consultation is required

In several jurisdictions, introducing device management triggers formal consultation with employee representatives, sometimes with a right of veto.

The test is usually capability rather than intent.

Its own note covers this, and the practical point is to start before procurement.

What to check

What is your actual legal basis, and has anybody written it down?

Is there a genuine alternative to enrolment?

Do people confirm something short and readable at enrolment?

And how are contractors handled?