BYOD & Personal Device Laws in Ohio: Employer Access Rights

Federal law establishes baseline protections for personal device privacy through two primary statutes. The Wiretap Act, 18 U.S.C. section 2511, prohibits intentional interception of electronic communications (including emails, text messages, and voice calls) without consent from at least one party to the communication. The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. section 1030, makes it illegal to access computer systems or networks without authorization. These federal laws apply to all employers nationwide, regardless of size.

The Electronic Communications Privacy Act (ECPA), 18 U.S.C. section 2701 et seq., provides additional protections by restricting unauthorized access to stored electronic communications and requires warrants or subpoenas for government access. Employers may monitor employer-owned devices and networks under certain conditions, but personal devices owned by employees are generally protected from employer monitoring unless the employee provides explicit, informed consent.

Federal law recognizes a distinction between monitoring business communications on employer equipment versus accessing personal communications. The "ordinary course of business" exception allows employers to monitor work-related communications, but this does not extend to purely personal messages or devices. Enforcement is handled by federal law enforcement and the DOJ.

Ohio law mirrors federal wiretapping protections and adds specific statutory language through Ohio Revised Code section 2933.52, which prohibits intentional interception of any private communication without the consent of the parties involved. This statute is broader than some other states' laws because it protects both oral and electronic communications. Ohio defines "private communication" expansively to include emails, texts, and phone calls reasonably expected to remain private, even if sent or received using an employer-provided network.

Ohio Revised Code section 2933.01 establishes that electronic surveillance of private communications is a criminal offense. Unlike some states that have carved out explicit employer monitoring exceptions, Ohio requires affirmative consent before any interception occurs. This means employers cannot rely on a general consent form or network use policy; consent must be specific to the type of monitoring and clearly inform the employee what will be monitored.

Ohio Revised Code section 2913.04 (Computer Fraud statute) applies specifically to unauthorized access to computer systems and provides criminal penalties for accessing personal devices without permission. This statute has been interpreted to protect personal devices brought onto employer premises from employer access. State law covers all employers in Ohio regardless of size, and protections apply equally to private sector employees.

Critically, Ohio law distinguishes between monitoring and accessing. An employer may have a legitimate policy requiring employees to disclose devices on the network, but this does not automatically grant access rights. If a personal device connects to the employer's network, the employee retains privacy rights in the device itself under Ohio law. Remedies for violations include criminal prosecution, civil lawsuits for damages (including emotional distress), and injunctive relief. Employees can also file complaints with the Ohio Attorney General's office.

Ohio law provides limited exceptions to personal device privacy protections. The primary exception is that employers may monitor work-related communications on employer-provided equipment when proper notice is given in writing. However, this exception does not extend to personal devices, even if connected to the employer's network or used during work hours.

Another narrow exception exists for communications that are not reasonably expected to be private. For example, if an employee is using a shared computer in a common workplace area and does not take steps to protect privacy (such as using password protection), the expectation of privacy may be reduced. However, Ohio courts have consistently held that personal devices maintain privacy protection regardless of location.

Employers cannot access personal devices of employees even if the employee has violated workplace policies or is suspected of misconduct. The "business necessity" defense that might apply in some contexts does not override statutory protections in Ohio. Law enforcement may access personal devices with a warrant, but employers cannot act as proxies for law enforcement.

Union employees may have additional protections under collective bargaining agreements that explicitly restrict employer monitoring. If a CBA exists, its terms supersede general policy. Additionally, if an employee is engaging in protected activity (such as reporting illegal conduct), accessing their personal device to suppress that activity would constitute retaliation under Ohio whistleblower statutes.

One important edge case: if an employee uses personal devices to commit crimes (theft, fraud, etc.), the employer may report evidence to law enforcement, but the employer cannot conduct its own forensic examination or access the device. The employee's Fourth Amendment rights and Ohio state privacy laws still apply, and employers accessing the device would expose themselves to liability even if prosecution results.

Step 1: Document Everything. If your employer has accessed your personal phone or computer without permission, immediately document the incident in detail. Record the date, time, what was accessed, how you learned about the access, and who was involved. Save any evidence such as emails from IT staff, screenshots showing unauthorized access, witness statements, or device logs showing access from unfamiliar IP addresses. Keep personal copies of these documents separate from work systems. If you received a written personal device policy from your employer, preserve the original copy. Create a detailed timeline of any other incidents where access may have occurred.

Step 2: Understand the Internal Complaint Process. Before filing external complaints, review your employee handbook for a personal information or privacy grievance procedure. Ohio employers are not required by law to have a formal internal complaint process, but many do. If one exists, submit a written complaint to HR detailing the unauthorized access with supporting evidence. Request a written response explaining why access occurred and confirmation it will not happen again. Keep copies of all internal correspondence. However, note that internal complaints are not required to preserve your legal rights; you may proceed directly to external agencies if you prefer or if the employer retaliates.

Step 3: File a Complaint with the Appropriate Agency. For computer fraud or unauthorized access violations, file a complaint with the Ohio Attorney General's Cybercrime Unit at www.ohioattorneygeneral.gov. You can file online through their victim complaint form or call 614-466-4986. For wiretapping violations, you may also contact the FBI's Internet Crime Complaint Center at www.ic3.gov or your local FBI field office. The Ohio Attorney General's office typically initiates investigation within 30 days if the complaint involves criminal violations. You do not need an attorney to file these complaints, though having one strengthens your case.

Step 4: Understand the Investigation Process. Once filed, the Ohio Attorney General's office or law enforcement will assess whether criminal charges are warranted under Ohio Revised Code sections 2933.52, 2933.01, or 2913.04. Investigations typically take 60 to 180 days, depending on complexity. You may be contacted for an interview providing additional details. If the investigation determines violations occurred, law enforcement will prosecute the employer or individual responsible. You will have the option to participate in prosecution but are not required to be the prosecutor; the state handles that role. Investigation outcomes are not guaranteed; prosecutors have discretion to decline cases.

Step 5: Consult an Attorney and Consider Civil Action. Contact an employment law attorney in Ohio specializing in privacy law or computer fraud. Initial consultations are often free. An attorney can advise whether you have a civil lawsuit claim for invasion of privacy, intentional infliction of emotional distress, or breach of contract. Many Ohio attorneys work on contingency for strong privacy violation cases. Civil lawsuits can result in damages for emotional distress, lost wages, attorney fees, and punitive damages. You do not need to wait for criminal prosecution to file a civil suit; these are parallel processes. Your attorney can also send a cease-and-desist letter to your employer, which often stops unauthorized access immediately and strengthens a later claim.