Employer App on Phone - Compulsory?

Sounds unreasonable.
Easy way way out, you don't have a smart phone, or if you do there isn't any space for apps, like my old 16gb iPhoneSE.
The phone worked fine but no room for apps beyond a handful.

Royal Mail App, or Agency?

What are you worried about?

Sounds suspiciously like the Royal Mail are wanting to monitor your every move with a digital device... I guess that the CEO is blissfully unaware of this, judging by his answers to questions from a Parliamentary Select Committee. I would be disabling the app. Phone battery was flat, left phone at home, turned it off so that you were not interrupted during work time, reception is rubbish in the Highlands and Islands. Plenty of reasons that they don't see any data from you!

I would say that unless they pay for the phone they can't compel you to install anything. What would happen if you said your phone was a Nokia 3310?

Of course, with the bonfire of workers rights going on at the moment they can probably do what they want without repercussions, unfortunately.

The app is from the agency, not RM. Already use an RM hand-held device for scanning parcels etc but much of its functionality isn’t used - there is evidence they use data to monitor ‘stoppage’ time. Quite a few signal black spots on my round, but I’d rather not have to switch my phone off in case someone’s trying to get hold of me. The agency are pretty terrible and I’m waiting to be made ‘permanent’ by RM - I suspect the agency just want to spam me for other jobs, even though I live on an island. I’m interested to know whether they have any grounds considering it’s my personal phone.

What does the app do?

Install the app but switch off the setting that allows it to run in the background?

I don't think they can force you,but if you don't want to rock the boat,just install it and set it to disabled , and every now and again let it run.

Or just tell them it's installed,but don't actually install it

🤣🤣
Aside from your labor your may not have a lot of bargaining power for this nonsense.

My move would be similar to those earlier: the agency can put its app on the phone they provide me with; my phone’s too full/awful to use it.

Does the app come from the Apple App Store? Or Google’s? Or do they need to install it via a profile?
If the former then you might need to suck it up. Though it sounds like a terrible imposition. Just as well you use airplane mode to conserve battery life in those poor signal areas?
If the latter then NO WAY would I install it.

FWIW I get given a work phone that has to have a profile and various apps installed on it for data security reasons. That’s fine. I would not opt to install these on my own phone despite the transparency over what they and the profiles do.

Whilst you are at work and getting paid, you're obviously where you should be and not hiding, so should be no worries there. Turn it off when you finish work

I'd imagine you are the 1 in 4, but my (fairly extensive) experience of agency workers is roughly 1 in 4 are actually competent and willing. The other 3, I wouldn't pay in washers. Take from that what you will

(for balance - I've worked through an agency in the past)

That would be a big no from me. Aside from the likelihood of excessive monitoring and data grabbing, most have a function where the phone can be wiped remotely if IT cocks up or decides to do it if you leave/lose the phone/do something they think is naughty. I’d get them to provide a work phone or grab the cheapest device I could that would run their app.

https://learn.microsoft.com/en-us/mem/intune/user-help/reset-device-company-portal-android

Whilst you are at work and getting paid, you’re obviously where you should be and not hiding, so should be no worries there. Turn it off when you finish work

I’d imagine you are the 1 in 4, but my (fairly extensive) experience of agency workers is roughly 1 in 4 are actually competent and willing. The other 3, I wouldn’t pay in washers. Take from that what you will

My experience of developers is that I would trust 1 in 4 to write software that I actually trust (that number is being generous, I just used it because it lined up nicely with what you said).

Sure, this app might be fine and pose no risk to the OP's security or to the phone itself but why should he have to take the risk? If the agency feels it is important then they can supply a phone with the app installed.

But seriously, if you've got nothing to hide you have nothing to fear? Come on, does anyone still believe that for a second?

But yes, in the modern UK the OP's options are most likely limited and they'll probably just have to suck it up.

I would say that unless they pay for the phone they can’t compel you to install anything.

this sounds like zero hours contract ad hoc labour type stuff?  In which case the OP also can’t compel them to offer him any work!

if he’s willing to not work for them then ask for their privacy notice and data protection impact assessment.  Don’t expect the ICO to do anything if neither are forthcoming or totally inadequate!

Just as well you use airplane mode to conserve battery life in those poor signal areas?

just a shame that the developer was ahead of you on that one (because many people don’t have data turned on when wandering the streets) and caches all the data for background upload when wifi is restored!

I don't like the idea but nothing you can do. You want to work, agency say for us to give you work you must use our app. You say no. They say we won't give you any work.
With the greatest respect to you the agency will survive if you are not working for them so the only person who suffers will be you with no work.

What sort of phone do you have, iOS or Android?

With either model you can view and/or change access to what information the app will have access to and, if the app is in the App/Play store, you can get information on what it will ask for before you install it.

If it is not an app store app, I strongly recommend against installing it. That's just a tinge of paranoia with foundations in that removal of part of the security model of both operating systems. If you have an iPhone, you should only be able to install apps from the App Store in any case.

GDPR is still valid in the UK (as I understand it) so you could request information on both the GDPR compliance of the app and the information it collects from you, and the company's information security policy, including how they update and maintain the app securely. Again, a big company should have something akin to ISO27k1 or CIS in their development process which would make things like updates more secure, but some random app might not have anything like that. That question might be a bit heavy for them, but they _should_ have this information.

Otherwise, 10 quid feature phone from Tesco and a PAYG SIM. "App? Oh, you mean SMS?"

Ask them for their privacy notice for what they will be using the data for. This should be provided up front with full disclosure of what they are tracking, why they are doing it, and what their legal basis is.

If they refuse, report them to the ICO. Companies hide behind the fact that people are too apathetic and reluctant to hold them to account for the use of their personal data.

Are they going to pay you for the data it uses?

It's a private phone so it's a no from me. If they want to monitor you, they should provide you with the means to do that, i.e. a company phone

It depends what the app is for. I've Microsoft Authenticator for work stuff, Teams (but that's switched off - only used if I need it) and a 'sports app', where we get points for exercising - rack up loads by cycling to work, and we get free stuff.

I would install, then disable all permissions especially location services and of course notifications in fact have it installed but disabled. You'd be fulfilling the requirement 😉

JeZ

also , as others above have said, if the app is the only means for the agency to notify you that they have work for you to perform, then you've kind of got no choice in the matter if you want to work through them.

Does the potential app link directly to your pay or, you getting paid? What does it actually do?

Taking a negative stance may backfire, so try the old "confirm and evade" (as it's called in the MOD) tactic. Agree to do it, then don't actually do it / delay (its there but not working) / obfuscate for a while until you get made perm by RM.

As a salaried worker, its easy for me to say no to such a demand.
I'm getting paid anyway, and I have a hard rule where I don't install any company required software on my phone.

(Soft rule really, I do have teams on it, but it has no permissions other than mobile data, and then not while in the background. But this was my choice and it's app store not MDM)

If this is going to result in them not giving you the hours, it's not a hill I would choose to die on, but Id certainly have a battle. The best suggestions are the ones where your phone runs an OS the app doesn't work on / you don't have a AppleDroid phone etc. Just make it a completely impossible condition. Alternatively the privacy angle is good 'I control my personal information closely, please provide details of what data is gathered about me, how that is stored, who has access and what it is used for. I would also be keen to understand your data retention policy and how you would enact my right to be forgotten'.

I’ve got an iPhone, the agency don’t do anything except I tell them my hours and they pay me - work is dictated by RM, there’s a shortage of posties here and no one else knows the run apart from the person I job share with. I’m waiting for RM to make my role permanent - small pay cut but I have more security and I get paid a daily rate rather than just hours. The agency only every message me by text or voicemail but the only way of contacting them is for me to call them. You can download via the Apple App Store but it gets rubbish reviews - all it seems to show is a work calendar and job alerts neither of which are any use to me as RM sets the roster and sends it to me by Whatsapp.

Install it and turn off any location tracking or alerts !

They should get their IT department to do it when they provide you the phone and in any case that app doesn't run on your old "insert here" phone anyway.

Got an old phone? Install on that, leave in bedside drawer. Sorted.

Or hand them a Nokia brick to put it on, and wish them good luck.

If they want their app on a phone, they can supply the phone.

I’ve got an iPhone, the agency don’t do anything except I tell them my hours and they pay me – work is dictated by RM, there’s a shortage of posties here and no one else knows the run apart from the person I job share with. I’m waiting for RM to make my role permanent – small pay cut but I have more security and I get paid a daily rate rather than just hours. The agency only every message me by text or voicemail but the only way of contacting them is for me to call them. You can download via the Apple App Store but it gets rubbish reviews – all it seems to show is a work calendar and job alerts neither of which are any use to me as RM sets the roster and sends it to me by Whatsapp.

in that case - just install and then disable it and get on with your life, or install on an old phone and get on with life.

Not worth having an argument over, I like the "confirm and evade" phrase - not heard that before.

Similar but slightly different - I was asked to install remote management software on my (personal) laptop I use with one client to allow me to access their systems. I refused, and stated that I already had a similar piece of software from another client and there could only be one installed at a time (I then said the same to the other client, so in the end neither forced me to install an intrusive bit of software that among other things could wipe my device remotely....)

It would depend for me. In general no however I do have some apps installed for 2FA but they are not an agency app and just produce a matching hash.

I would try saying you have no smart phone. Approach royal mail supervisor or whoever you know is connected to the agency in royal mail and ask about becoming perm. Then keep blocking installing the app. Log what they are asking and if dismissed see if you can take legal action.

Similar but slightly different – I was asked to install remote management software on my (personal) laptop I use with one client to allow me to access their systems. I refused, and stated that I already had a similar piece of software from another client and there could only be one installed at a time (I then said the same to the other client, so in the end neither forced me to install an intrusive bit of software that among other things could wipe my device remotely….)

Good move! The other thing in this situation is a VM. Pretty good idea if you work for multiple people anyway, some form of containerisation.

Also last resort is old phone that you leave at home. No data.

I knew you lot were out of touch with reality - I didn't realise how little so many of you appreciated about zero hours / agency type employment.  No wonder there's little political momentum to fix it.

The only real negotiating power the OP has is that he's on Mull and knows the route.  I'm sure in the current climate and at this time of year within a month the agency will have someone else on Mull that can cover this route.

its entirely possible that the agency is not sophisticated enough to do anything nefarious with the data (I'm not suggesting they are morally good enough not to - but more that they aren't set up in a way to do it), so just want the efficiency of everything in one place.  If I ran the agency - I'd want you all using my app too, much simpler to have all admin and data in one place; bits and pieces by text/whatapp/email/voicemail sounds a nightmare.  The fast royal mail on mull might be a special case would be of little interest unless making those sort of customers happy was going to win me higher value less awkward work.   Of course its also possible they want their own records so if RM say "Dovebiker is always late for work, or disappears mid morning," they have evidence that their employee was fulfilling their contract.  And then they might be doing something more sophisticated like working out who is slacking, or if RM are manipulating their people to get 6 minutes a day extra work out your for free etc.  I imagine for other contracts there's probably clever stuff you can do to ensure that the most helpful/responsive employees get the best work and those who read then ignore offers of work are deprioritised next time etc.

I knew you lot were out of touch with reality – I didn’t realise how little so many of you appreciated about zero hours / agency type employment. No wonder there’s little political momentum to fix it.

I and several others said, 'This is what we would do if the UK wasn't a basket case country with little to no protections for employees but in all likelihood you're just going to have to suck it up.'

If I ran the agency – I’d want you all using my app too, much simpler to have all admin and data in one place; bits and pieces by text/whatapp/email/voicemail sounds a nightmare.

No need for a phone app for this, just a portal for the manager

I and several others said, ‘This is what we would do if the UK wasn’t a basket case country with little to no protections for employees but in all likelihood you’re just going to have to suck it up.’

Yeah it was all the people after that saying - no way we would do it / can't make you etc.

No need for a phone app for this, just a portal for the manager

Of course, but I can see for the average zero hours contractor an app with push notification is actually not a stupid way of helping the employee know there is work available, record hours etc.  And if you need someone from 1pm today an app that lets you contact the closest people who are actually "online" is probably more responsive for your clients than - let me send out some messages and see who responds.

I’m sure in the current climate and at this time of year within a month the agency will have someone else on Mull that can cover this route.

I was the only applicant last year - there are current 4 postie vacancies here because everyone knows how rubbish RM are as an employer. Lots of businesses looking for staff but there is no long-term rental accommodation. Jobs no good for non-locals as it often finishes when the last ferry has left.

Quite where an app with push notifications helps me when I have a fixed rota and route - the agency have my work location as Oban, they are based in Glasgow. I’m just stalling until the RM job offer arrives.

We are looking at a project were an MFA app is needed. Some staff don't have company mobiles and the view is very much that we cannot compel anyone to install company software on their personal device. I suspect that this will be the case with you too.

Last place wanted us to install programs on our own personal phones, two factor authentication was one of them, in order to do our jobs. Refused to as they should be supplying the hardware, as one of the programs needed to run the 2FA
would allow IT to wipe the phones remotely, big no from me.

what the app called?
Is it something thats fairly mainstream thing or something more worrying?

An authentication app isnt really a company app, its generic and something people should be getting used to using anyway.

Hang on, we have had this discussed before in relation to using Authenticator type apps.

It's highly likely that this app falls under MAM, or Mobile App Management, where it is only the app itself that can be controlled/wiped/etc by the agency.  This is as opposed to MDM, or Mobile Device Management, where the entire phone and all apps can be controlled/wiped/etc by the agency.

If it is the former then this is a standard known thing, particularly if from the major suppliers - Microsoft, Jamf, etc, - and really doesn't represent a security risk to your personal data or phone.  I'd ask the agency if it's MAM or MDM that is in use for pushing out this app.

Im slightly biased as I am currently trying to get people to install the Microsoft Authenticator on their phones. If it is just the app then the company has no control over your phone and can not remotely wipe it.

If you are happy with the context of the app and what it does then I would say crack on and just do it. Personally, I think in this day in age it shouldn't be unexpected that you need a phone for work.

I've had people complain that they don't want their work to know personal information about them such as their mobile phone number, I have had to point out that the company has all their bank and personal details as that is how they pay them and sort out their tax.

If enough people refuse then they will just change the contract terms to say it's a requirement of work.

Hang on, we have had this discussed before in relation to using Authenticator type apps.

Which depending on the app is different. This doesn't sound like 2FA

If the app is for 2fa, then yeah it's creating a hash. If it's for managing or tracking then it's a different situation entirely l.

Personally, I think in this day in age it shouldn’t be unexpected that you need a phone for work.

In which case work should provide them.

For the OP his lack of power in this situation makes it difficult.  I'd go for the install but disable especially location / access to data- I have location off unless I am using maps anyway

You can download via the Apple App Store but it gets rubbish reviews – all it seems to show is a work calendar and job alerts neither of which are any use to me as RM sets the roster and sends it to me by Whatsapp.

I'd just install it and then uninstall it - claim your phone was reset and you forgot to add it back in - that'll mark you as "has logged in" somewhere. If it later transpires that you do need the app for actual features (ie time booking or whatever), you can put it back on your phone then.

I'd personally prefer not to have stuff like this on my phone, but I'm also willing to do stuff like this for a quiet life (especially if you're leaving soon)

Install it, be very obliging.
Then install a Faraday cage in the van.
Buy a burner phone and use this for emergency calls, texts if necessary

Why don't you want to have this app? Also, what is it used for?

I used to be like this in my last job whenever there was anything compulsory. It was because I didn't really like my job. I lett and now I'm happier. Just install the app or maybe just find a company that doesn't want you to install an app.

I knew you lot were out of touch with reality – I didn’t realise how little so many of you appreciated about zero hours / agency type employment.

A fair comment. I once disabled a tracker on a company vehicle as it was fitted without my consent (a whole other argument).
Nothing was said as:-
1. I'd not agreed to it
2. Our industry was short of qualified people before the current even bigger shortage.

If your phone is used to store or deal with a company's data then they need to be responsible for securing it. So IF you want to use your own phone, and they agree to it, then they need to secure your phone according to their standards, which is what a lot of these 'apps' are about.

If they want you to do something with data that needs a phone, and you don't want to use your own, they need to give you a work phone.

Many "modern" non permanent staff jobs like Uber, Deliveroo, Just Eat, courier work etc. are entirely dependent on apps running on personal phones so I can see why companies have an expectation that workers will be willing to install them.

I think there are lots of reasons for concern about this including privacy, data usage etc. but I would probably be in the camp of allowing it if the app does not assume control of my device, does not burn too much data and can easily be disabled outside working hours.

Why don’t you want to have this app? Also, what is it used for?

Possibly the questions are in the wrong order there! But without knowing what it's for and how it works, it's all a bit speculative.

It might just be the temp agency's single point of contact for telling people their shifts, payslips, whatever, rather than any location and activity monitoring stuff...

I knew you lot were out of touch with reality – I didn’t realise how little so many of you appreciated about zero hours / agency type employment. No wonder there’s little political momentum to fix it.

I work zero hours and there a snowballs chance in hell an employer app would be installed on my property. A dumb phone would be proffered on request, I keep one for just such eventualities. It's very old, the battery is on it's last legs and it will need changing for something else just after I retire at Easter when 3G gets turned off. (I may have given this some thought).

Whilst you are at work and getting paid, you’re obviously where you should be and not hiding, so should be no worries there. Turn it off when you finish work

So if you want to track me then supply a device to do so. I would.no closer install work software on my personal computer than I would my phone.

Odly the company I used to work for went all through this years ago emails to personal address.
Apps on phones,calling you at unreasonable times.
One data leak later and it's instant dismissal for you if you use your personal device for anything. ( Unless your billy/sally big balls at the top then apparently it's ok)

Funny how IT systems change when the pressure is on the top level of staff and they get a day with the lawyers being told who would go to court if it went tits up.

Even now my work IT stuff gets put in the dead zone* when I'm home so no contact with the outside world it's not connecting to my wifi either.

*Kitchen cupboard that gets no 4/5g for some bonkers reason.
Personal phone is just that personal. if I was the OP it would be a new version of the Nokia 3310 for my personal phone and blag it till I left.

Oh and probably get this thread binned off

It's unreasonable and unlawfull.

I had a standoff with my previous employer as I was basically compelled to use my own PC to connect to the company VPN.
I loudly said in a team meeting.... "what if I forget to disconnect the VPN at the end of my shift and visit a naughty website?"

I was promptly provided with a company laptop, heheh!

Simply give them the option to provide you with a company phone, or a £50 per month pay rise to cover your admin and an additional phone on a contract.

Pick your fights well. This one is pointless.

Big difference between MDM, certificate installs and some crappy App that a computer says yes/no administrator at a temp agency wants you to install to get a job. Most likely it will do nothing and barely function. Worst case, track your location that you can turn off in iOS privacy settings.

Still worried, get a burner. Want to play games with them and worries they will actually try to track you. Install the App onto an iPod touch.

Had a similar thing when I was working for an agency, I resisted too as I'd heard stories of people being tracked etc from other agency workers. I just installed it on an old phone that had no GPS or sim card so that I could show the agency I had it, they never checked the phone actually worked and I never used it. In the few weeks I was with them they never checked I had it again and when I did power that phone back up once it had so many warnings for it being a dangerous app I never touched it again. But then that agency was crap so didn't stick with them for very long.

I'd suggest a burner phone if you're worried about it and just want them off your back. Can always use the app via WiFi and not out any personal data on that phone. Something for £20-30 from the marketplace of your choosing should suffice.

I sub contract to a company - a division of a huge French multi-national

I have asset inventory software (with GPS) on one phone and 2 laptops, Microsoft authenticator on my other phone

It helps me do my job. They don't demand I put it on my own tech, but I don't really give it a second thought

They have me a secure laptop for accessing the company servers/emails/teams etc and I sometimes use that at home via a VPN

I'm pretty certain Google is grabbing FAR more data than they are

TheArtistFormerlyKnownAsSTR

They don’t demand I put it on my own tech, but I don’t really give it a second thought

The small but IMHO important detail is the optional component here.
I don't mean that simply from a theoretical point but whilst it's optional there is little point doing invasive and questionably illegal tracking etc. or demanding an explanation why you didn't respond immediately to the notification at 2AM that they wouldn't do over auditable channels

I’m pretty certain Google is grabbing FAR more data than they are

Google are unlikely to dismiss you or just dock your pay given you don't work for them...

The line in the sand for me is - is it stipulated in your work contract that you own and provide a smart phone for the use of your employer.

If not they can whistle

Google are unlikely to dismiss you or just dock your pay given you don’t work for them…

Neither are you're employer if you are where you are supposed to be at a given time 🤷

Neither are you’re employer if you are where you are supposed to be at a given time

The OP isn't working for a division of a huge French multi-national

My previous employer used to book meetings that were impossible to do and wasn't interested how you got from A to B just that you were at meeting A at a certain time and at meeting B at another.

The clients (for example a global French multinational) would not allow their employees to even be subjected to this hence why the contract employees got it. I can remember at least 2 occasions the client HSSE has stepped in because my company were stupid enough it was the same client and someone noticed you'd need to drive at a steady 90mph and run every red light or "attend a meeting" whilst driving etc.

I've also had the opposite and been told to turn off my work phone when in a war zone and use my personal phone as they don't want any record of you being sent into the war zone in case you get shot or blown up.

I previously worked as staff for 2 French global multinationals and there is no way on earth they'd do this... nor "real" companies but the OP isn't working for one of them.

This can be done right. Android now has a 'work profile' which is a segregated virtual phone (almost) that you use for well, work stuff, and it has different settings, permissions, apps and data. I don't know if it has to be configured by your work though or if you can simply set it up yourself. If the latter, you don't really need a second phone.

I more surprised (and shocked) that people don't have MFA apps already installed on their phones - your work asking you to add an account should be no big deal, as everyone should already have multiple MFA accounts already set up.

If you don't have MFA on at least your email account, seriously, do it now!

I'm on about 15 MFA accounts on my phone across 2x MFA apps.

Neither are you’re employer if you are where you are supposed to be at a given time 🤷

You seem to be under the impression that employees are constantly on the lookout for ways to shaft their employers whilst employers treat their employees with nothing but respect and would never dream of shafting them in any way shape or form.

It sounds like we should all be working for French companies if that's how you think all workplaces (especially UK ones) operate.

Brucewee

It sounds like we should all be working for French companies if that’s how you think all workplaces (especially UK ones) operate.

TBH I think its more about the types of company (though France does have a lot of employee focused policy/laws)
I've had UK based "real" employers that wouldn't even dream of doing stuff to their own employees not take an interest in how their contractors are treated by their "employer" whereas others are 3 monkeys covering their eyes and ears.

Not UK based but I've worked with Maersk who made specific policies that contractors have to be treated as part of the company. They even had a load of mugs printed with something like "contractors are part of our family" on them and they actually audit it. I had a UK based manager intervene on a meeting I was supposed to do whilst driving for example.

As an update, I received notification that I’m being transferred from the agency to ‘permanent’. I’ve installed the app but pretty well disabled every function) Interesting debate on attitudes to employment and the generally rubbish nature of zero hours contracts - deliberate policy of not having written job offers and terms, one way communication (I can’t text or email my ‘employer’ so have no written record of conversations)