I'm  not an attorney either but as far as I've seen the law seems to be written to assume that the employer owns the device the employee uses. With BYOD, obviously that's different.

You're right to an extent. The policies are primarily to protect the employer because government enforcement agencies like the Equal Employment Opportunity Commission, the National Labor Relations Board & the Department of Labor demand that employers put such policies in writing (even if employers aren't legally required to do so). In those agencies' minds, if it's not in writing, then it doesn't exist.  

I agree, Mitch.  The policy approach seems clear and simple, but confusion exists not only between devices (does a personal device become a work device when it's used for work?) but between accounts.  Policies need to get into nitty gritty detail...

That is, if they're needed at all.  I'm not an attorney, but I should have thought the law governs what employers can and can't review and respond to; a policy isn't going to change that, is it?

This isn't legal advice but, as a general rule, employers shouldn't read employees' personal emails. However, if an employee is using an employer-monitored, it's very likely that the employer will end up reading those personal emails.  

Employers shoud have a clear & easy to understand policy that if employees use company owned or operated IT, then employees should have no expectation of privacy. Moreover, if the employer learns that an employee MIGHT be using company owned/operated resources for criminal activities, those activities will be IMMEDIATELY reported to the proper authorities. Should an employer ignore possible criminal activity, it risks exposure & liability for negligence or even criminal charges; when in doubt, act right away. 

Scheduled backups could make life a lot easier for employees who practice BYOD. The data cleansing activity will still be debatable if some data is still resident on the phone. Unless, everything goes to the cloud or to corporate servers the companies will not be satisfied and will resort to remote wiping. 

BYOD solves a lot more problems than it gives rise to and as such, in my opinion should be encouraged. Employers, from what I've seen are more threatened from issues arising from the use of BYOD than the employees. whatever policy is determined, employees need to be taken into confidence before enforcing it otherwise there's risk of employees flouting it.

Mr. Roques, I expect that if employers find evidence of criminal activity they are required by law to act immediately. 

Where do employers draw the line? Should they stop people from accesing their personal email account or should they read the emails? Can they?

Also, what if they find something criminal, should they act right away?

Sandboxing has potential to solve some BYOD problems. Employers would run their apps and store data in a sandbox on the BYOD device. Or vice-versa -- employees could run their own apps and store personal information on the employer's device. 

Keeping a backup of the device is a good policy, particularly for employees who practice BYOD. 

Of course, that undercuts an employer's phone-wiping policy.