Who owns data on a company cell phone? Does an employer own the data on a cell phone provided to its employee? If so, is there a cause of action against an employee who provides a copy of the cell phone to a third party without authorization?
An employer owns the data on a cell phone provided to its employee if the employer has made that a condition of employment. The employer might own the data independently (e.g. the employer created it). Or, the employer might own it if the employee created it in the course of their employment. It's not where the data is that determines ownership, it's who created it. It is also possible that an employee could create data on a phone which is not in the course of their employment, but was also contrary to company policy (don't put your data on our phone). If you violate company policy on use of equipment, the simplest course of action that will follow is getting fired, or losing some company benefit. Conceivably you might get sued, but that would require more than simply getting an unauthorized text message. If we assume that the phone contains company intellectual property, copying that content would be a violation of copyright or patent law, so the employee can be sued for that. If there is a specific employment-related agreement (a non-disclosure agreement), the employee could suffer other consequences including being sued for something.
What happens is the same as if you were an employee in the office, staying with the company for another few years. You are an agent for the company, and everything you do is as if the company was doing it (except for extreme circumstances). A company employee broke your laptop. It's the company's problem. They should have insurance for this kind of thing. And they told you to work from home, so if something happened because you are at home, that's the company's problem as well. It could be different if your company had told their employees not to have any fluids anywhere near their computers, and you had acted against this. Or my company doesn't allow me to take my works computer with me on a holiday; if I did without explicit permission and it got damaged, that would be my problem.
… would face and voice count as personal information under GDPR? Absolutely. Does person B have the right to erasure … No. The right to erasure only applies in certain circumstances. While the initial reason for collecting personal data was consent, once it has been incorporated into a film, the processor now has a legitimate interest in the data. The right to erasure does not apply when there is a legitimate interest.
If there's a reason to believe that your machine has data that would be relevant to a lawsuit, then yes, it is subject to inspection under Fed. R. Civ. P. 34: A party may serve on any other party a request ... to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control: ... any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form. So if there's a lawsuit where there becomes a question about what you downloaded from the network, then it's quite plausible that your device could be demanded or subpoenaed. But that's not the same thing as &quot;forfeiting&quot; your device. The normal procedure in such a case would be that the agency's lawyers would notify you of the demand, and you would take your device to an ESI expert, who would make a digital image of the device's hard drive. The parties would then fight about what portions of that image they are allowed to access, but you would have your device again while that was going on.
If your friend was a salaried W2 full time exempt employee hired by the company to, among other things, write software like this, then the fact that it was developed "off the clock" with the employee's own resources means nothing once he gives it to the company. I mean if I give you a present and it blows up and breaks your arm, I'm still liable even if we didn't have a "contract" - especially if I knew it would blow up. Your friend's position is even worse since the relationship entails the employee's having the employer's best interests in mind. If I were your friend, I'd either figure out how to fix this or take gnasher729's advice from the comments and find a country where it's easy to hide from parties public and private. Maybe buy a bunch of canned food and go live on a boat?
Maybe not. The ICO says that The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data. It might be valid to interpret the DPA / UKGDPR in a way that the relevant personal data undergoing processing in their system is the existence of the letters, but that you are not entitled to a copy of the letters. This is in line with the purpose of the right to access, that you can check what data they are processing about you and whether it is correct. If that argument holds and the data subject insists on receiving a copy of the letters, it might be legitimate to charge them a fee for these copies. But in practice: The data controller might not make this argument and just hand over the copies. It is worth a try. A right to access founded in data protection might not be the only way to receive a copy of these materials. If the letters are relevant for legal proceedings, they could perhaps be requested during the disclosure process.
If they can compel you to show your insurance paper and you don’t want to unlock your phone to do that, then you need to bring it in paper form or suffer whatever consequences there are for not showing them. “Unlocking your phone” doesn’t mean you have to hand it over. Practice how to lock your phone quickly (iPhone: Press a specific button for four second), or just one press if you set up the phone for that. Unlock the phone away from the officer, locate the insurance paper, show it without leaving the phone out of your hand.
If an employee takes home information that his or her employer considers confidential, that would be a matter of company policy. The employer could discipline or fire the employee if it learned of the incident, and chose to act. If the information is considered to be a trade secret, or part of one, disclosing it or mishandling it so as to risk disclosure could be a crime under US law. However, only in unusual cases is criminal action taken on such matters, normally it is left to civil lawsuits or internal company action. I do not know if Canada has a similar law.