> Do you feel that [...] is a flashing neon sign?

Yes it is, but it doesn't say anything about the company wiping the phone negligently because someone in IT screwed up.

Also, it's rather like holding up a flashing neon sign saying "I'm about to beat you up" before you beat someone up. You might have made them aware of the problem, but that doesn't mean your actions are either justified or legal.

> What I find odd is that a company allows people to keep confidential company information on a personal device at all.

Exactly. If the data is sensitive, it should be controlled properly by the company using company equipment. That has been my argument all along.

> There are many reasons to require this, including insider information, or other legally-required barriers, as well as company-protected information.

To require what? If you mean an arbitrary wipe of a personal device that is not limited to company information, which is what this whole discussion is about, then I'm starting a new club for posters telling me about how there may be legal requirements that necessitate such a facility without actually saying what those requirements are, what laws impose them, or in what jurisdiction. Please take a membership form and join the queue. :-)

There is not going to be a law requiring a company wipe an employee's personal phone.

To the extent that this is covered by law, and I am not a lawyer, it will be under something like "a company covered by this regulation will use industry standard practices to protect customer data on mobile devices".

One of the industry standard practises is remote wipe of the whole device in the event of theft. Personal or not, the distinction is idealistic and not realistic.

It is not in any way an industry standard to allow employees to use personal devices to access sensitive corporate data. In fact, doing so would automatically fail a security audit in a lot of large businesses.

And it would be perfectly fine at any number of other large businesses, including some of the country's largest law firms, some of the largest financial services companies in the world, and several health information providers.

Indeed, and I've never claimed otherwise. (Obviously I personally disagree with such a policy, but that is immaterial to this debate.)

Please remember that the question here is whether some sort of generic laws or regulations might implicitly require an employer to have the power to compromise their employees' personal phones and wipe their personal data, given that none of the people arguing on legal/regulatory grounds has ever come up with any citation that makes this requirement explicit.

In his post, jodrellblank mentioned "industry standard practices" as an example of such generic legal wording. The fact that many large businesses accept the policy of using employees' personal devices does not make it an industry standard. The fact that many more do not does mean that it is not an industry standard.