I work part-time via an agency for Royal Mail. Agency are now telling me that I have to install their app on my phone as a condition of employment. I already log my hours online. I’ve never been given a written contract of employment, I just get an email confirming who I work for and how much I get paid.

Sounds unreasonable.
Easy way way out, you don’t have a smart phone, or if you do there isn’t any space for apps, like my old 16gb iPhoneSE.
The phone worked fine but no room for apps beyond a handful.

Royal Mail App, or Agency?

What are you worried about?

Sounds suspiciously like the Royal Mail are wanting to monitor your every move with a digital device… I guess that the CEO is blissfully unaware of this, judging by his answers to questions from a Parliamentary Select Committee. I would be disabling the app. Phone battery was flat, left phone at home, turned it off so that you were not interrupted during work time, reception is rubbish in the Highlands and Islands. Plenty of reasons that they don’t see any data from you!

I would say that unless they pay for the phone they can’t compel you to install anything. What would happen if you said your phone was a Nokia 3310?

Of course, with the bonfire of workers rights going on at the moment they can probably do what they want without repercussions, unfortunately.

The app is from the agency, not RM. Already use an RM hand-held device for scanning parcels etc but much of its functionality isn’t used – there is evidence they use data to monitor ‘stoppage’ time. Quite a few signal black spots on my round, but I’d rather not have to switch my phone off in case someone’s trying to get hold of me. The agency are pretty terrible and I’m waiting to be made ‘permanent’ by RM – I suspect the agency just want to spam me for other jobs, even though I live on an island. I’m interested to know whether they have any grounds considering it’s my personal phone.

What does the app do?

Install the app but switch off the setting that allows it to run in the background?

I don’t think they can force you,but if you don’t want to rock the boat,just install it and set it to disabled , and every now and again let it run.

Or just tell them it’s installed,but don’t actually install it

🤣🤣
Aside from your labor your may not have a lot of bargaining power for this nonsense.

My move would be similar to those earlier: the agency can put its app on the phone they provide me with; my phone’s too full/awful to use it.

Does the app come from the Apple App Store? Or Google’s? Or do they need to install it via a profile?
If the former then you might need to suck it up. Though it sounds like a terrible imposition. Just as well you use airplane mode to conserve battery life in those poor signal areas?
If the latter then NO WAY would I install it.

FWIW I get given a work phone that has to have a profile and various apps installed on it for data security reasons. That’s fine. I would not opt to install these on my own phone despite the transparency over what they and the profiles do.

Whilst you are at work and getting paid, you’re obviously where you should be and not hiding, so should be no worries there. Turn it off when you finish work

I’d imagine you are the 1 in 4, but my (fairly extensive) experience of agency workers is roughly 1 in 4 are actually competent and willing. The other 3, I wouldn’t pay in washers. Take from that what you will

(for balance – I’ve worked through an agency in the past)

That would be a big no from me. Aside from the likelihood of excessive monitoring and data grabbing, most have a function where the phone can be wiped remotely if IT cocks up or decides to do it if you leave/lose the phone/do something they think is naughty. I’d get them to provide a work phone or grab the cheapest device I could that would run their app.

https://learn.microsoft.com/en-us/mem/intune/user-help/reset-device-company-portal-android

Whilst you are at work and getting paid, you’re obviously where you should be and not hiding, so should be no worries there. Turn it off when you finish work

I’d imagine you are the 1 in 4, but my (fairly extensive) experience of agency workers is roughly 1 in 4 are actually competent and willing. The other 3, I wouldn’t pay in washers. Take from that what you will

My experience of developers is that I would trust 1 in 4 to write software that I actually trust (that number is being generous, I just used it because it lined up nicely with what you said).

Sure, this app might be fine and pose no risk to the OP’s security or to the phone itself but why should he have to take the risk? If the agency feels it is important then they can supply a phone with the app installed.

But seriously, if you’ve got nothing to hide you have nothing to fear? Come on, does anyone still believe that for a second?

But yes, in the modern UK the OP’s options are most likely limited and they’ll probably just have to suck it up.

I would say that unless they pay for the phone they can’t compel you to install anything.

this sounds like zero hours contract ad hoc labour type stuff?  In which case the OP also can’t compel them to offer him any work!

if he’s willing to not work for them then ask for their privacy notice and data protection impact assessment.  Don’t expect the ICO to do anything if neither are forthcoming or totally inadequate!

Just as well you use airplane mode to conserve battery life in those poor signal areas?

just a shame that the developer was ahead of you on that one (because many people don’t have data turned on when wandering the streets) and caches all the data for background upload when wifi is restored!

I don’t like the idea but nothing you can do. You want to work, agency say for us to give you work you must use our app. You say no. They say we won’t give you any work.
With the greatest respect to you the agency will survive if you are not working for them so the only person who suffers will be you with no work.

What sort of phone do you have, iOS or Android?

With either model you can view and/or change access to what information the app will have access to and, if the app is in the App/Play store, you can get information on what it will ask for before you install it.

If it is not an app store app, I strongly recommend against installing it. That’s just a tinge of paranoia with foundations in that removal of part of the security model of both operating systems. If you have an iPhone, you should only be able to install apps from the App Store in any case.

GDPR is still valid in the UK (as I understand it) so you could request information on both the GDPR compliance of the app and the information it collects from you, and the company’s information security policy, including how they update and maintain the app securely. Again, a big company should have something akin to ISO27k1 or CIS in their development process which would make things like updates more secure, but some random app might not have anything like that. That question might be a bit heavy for them, but they _should_ have this information.

Otherwise, 10 quid feature phone from Tesco and a PAYG SIM. “App? Oh, you mean SMS?”

Ask them for their privacy notice for what they will be using the data for. This should be provided up front with full disclosure of what they are tracking, why they are doing it, and what their legal basis is.

If they refuse, report them to the ICO. Companies hide behind the fact that people are too apathetic and reluctant to hold them to account for the use of their personal data.

Are they going to pay you for the data it uses?

It’s a private phone so it’s a no from me. If they want to monitor you, they should provide you with the means to do that, i.e. a company phone

It depends what the app is for. I’ve Microsoft Authenticator for work stuff, Teams (but that’s switched off – only used if I need it) and a ‘sports app’, where we get points for exercising – rack up loads by cycling to work, and we get free stuff.

I would install, then disable all permissions especially location services and of course notifications in fact have it installed but disabled. You’d be fulfilling the requirement 😉

JeZ

also , as others above have said, if the app is the only means for the agency to notify you that they have work for you to perform, then you’ve kind of got no choice in the matter if you want to work through them.

Does the potential app link directly to your pay or, you getting paid? What does it actually do?

Taking a negative stance may backfire, so try the old “confirm and evade” (as it’s called in the MOD) tactic. Agree to do it, then don’t actually do it / delay (its there but not working) / obfuscate for a while until you get made perm by RM.

As a salaried worker, its easy for me to say no to such a demand.
I’m getting paid anyway, and I have a hard rule where I don’t install any company required software on my phone.

(Soft rule really, I do have teams on it, but it has no permissions other than mobile data, and then not while in the background. But this was my choice and it’s app store not MDM)

If this is going to result in them not giving you the hours, it’s not a hill I would choose to die on, but Id certainly have a battle. The best suggestions are the ones where your phone runs an OS the app doesn’t work on / you don’t have a AppleDroid phone etc. Just make it a completely impossible condition. Alternatively the privacy angle is good ‘I control my personal information closely, please provide details of what data is gathered about me, how that is stored, who has access and what it is used for. I would also be keen to understand your data retention policy and how you would enact my right to be forgotten’.

I’ve got an iPhone, the agency don’t do anything except I tell them my hours and they pay me – work is dictated by RM, there’s a shortage of posties here and no one else knows the run apart from the person I job share with. I’m waiting for RM to make my role permanent – small pay cut but I have more security and I get paid a daily rate rather than just hours. The agency only every message me by text or voicemail but the only way of contacting them is for me to call them. You can download via the Apple App Store but it gets rubbish reviews – all it seems to show is a work calendar and job alerts neither of which are any use to me as RM sets the roster and sends it to me by Whatsapp.

Install it and turn off any location tracking or alerts !

They should get their IT department to do it when they provide you the phone and in any case that app doesn’t run on your old “insert here” phone anyway.

Got an old phone? Install on that, leave in bedside drawer. Sorted.

Or hand them a Nokia brick to put it on, and wish them good luck.

If they want their app on a phone, they can supply the phone.

I’ve got an iPhone, the agency don’t do anything except I tell them my hours and they pay me – work is dictated by RM, there’s a shortage of posties here and no one else knows the run apart from the person I job share with. I’m waiting for RM to make my role permanent – small pay cut but I have more security and I get paid a daily rate rather than just hours. The agency only every message me by text or voicemail but the only way of contacting them is for me to call them. You can download via the Apple App Store but it gets rubbish reviews – all it seems to show is a work calendar and job alerts neither of which are any use to me as RM sets the roster and sends it to me by Whatsapp.

in that case – just install and then disable it and get on with your life, or install on an old phone and get on with life.

Not worth having an argument over, I like the “confirm and evade” phrase – not heard that before.

Similar but slightly different – I was asked to install remote management software on my (personal) laptop I use with one client to allow me to access their systems. I refused, and stated that I already had a similar piece of software from another client and there could only be one installed at a time (I then said the same to the other client, so in the end neither forced me to install an intrusive bit of software that among other things could wipe my device remotely….)

It would depend for me. In general no however I do have some apps installed for 2FA but they are not an agency app and just produce a matching hash.

I would try saying you have no smart phone. Approach royal mail supervisor or whoever you know is connected to the agency in royal mail and ask about becoming perm. Then keep blocking installing the app. Log what they are asking and if dismissed see if you can take legal action.

Similar but slightly different – I was asked to install remote management software on my (personal) laptop I use with one client to allow me to access their systems. I refused, and stated that I already had a similar piece of software from another client and there could only be one installed at a time (I then said the same to the other client, so in the end neither forced me to install an intrusive bit of software that among other things could wipe my device remotely….)

Good move! The other thing in this situation is a VM. Pretty good idea if you work for multiple people anyway, some form of containerisation.

Also last resort is old phone that you leave at home. No data.

I knew you lot were out of touch with reality – I didn’t realise how little so many of you appreciated about zero hours / agency type employment.  No wonder there’s little political momentum to fix it.

The only real negotiating power the OP has is that he’s on Mull and knows the route.  I’m sure in the current climate and at this time of year within a month the agency will have someone else on Mull that can cover this route.

its entirely possible that the agency is not sophisticated enough to do anything nefarious with the data (I’m not suggesting they are morally good enough not to – but more that they aren’t set up in a way to do it), so just want the efficiency of everything in one place.  If I ran the agency – I’d want you all using my app too, much simpler to have all admin and data in one place; bits and pieces by text/whatapp/email/voicemail sounds a nightmare.  The fast royal mail on mull might be a special case would be of little interest unless making those sort of customers happy was going to win me higher value less awkward work.   Of course its also possible they want their own records so if RM say “Dovebiker is always late for work, or disappears mid morning,” they have evidence that their employee was fulfilling their contract.  And then they might be doing something more sophisticated like working out who is slacking, or if RM are manipulating their people to get 6 minutes a day extra work out your for free etc.  I imagine for other contracts there’s probably clever stuff you can do to ensure that the most helpful/responsive employees get the best work and those who read then ignore offers of work are deprioritised next time etc.

I knew you lot were out of touch with reality – I didn’t realise how little so many of you appreciated about zero hours / agency type employment. No wonder there’s little political momentum to fix it.

I and several others said, ‘This is what we would do if the UK wasn’t a basket case country with little to no protections for employees but in all likelihood you’re just going to have to suck it up.’

If I ran the agency – I’d want you all using my app too, much simpler to have all admin and data in one place; bits and pieces by text/whatapp/email/voicemail sounds a nightmare.

No need for a phone app for this, just a portal for the manager

I and several others said, ‘This is what we would do if the UK wasn’t a basket case country with little to no protections for employees but in all likelihood you’re just going to have to suck it up.’

Yeah it was all the people after that saying – no way we would do it / can’t make you etc.

No need for a phone app for this, just a portal for the manager

Of course, but I can see for the average zero hours contractor an app with push notification is actually not a stupid way of helping the employee know there is work available, record hours etc.  And if you need someone from 1pm today an app that lets you contact the closest people who are actually “online” is probably more responsive for your clients than – let me send out some messages and see who responds.

I’m sure in the current climate and at this time of year within a month the agency will have someone else on Mull that can cover this route.

I was the only applicant last year – there are current 4 postie vacancies here because everyone knows how rubbish RM are as an employer. Lots of businesses looking for staff but there is no long-term rental accommodation. Jobs no good for non-locals as it often finishes when the last ferry has left.

Quite where an app with push notifications helps me when I have a fixed rota and route – the agency have my work location as Oban, they are based in Glasgow. I’m just stalling until the RM job offer arrives.

We are looking at a project were an MFA app is needed. Some staff don’t have company mobiles and the view is very much that we cannot compel anyone to install company software on their personal device. I suspect that this will be the case with you too.