> When they showed up HR started with "But that isn't how we use it, we would never access your personal data."

So, what, was HR lying?

More to the point, Google shouldn't be putting critical business information on personal devices, that's a security risk. If they're that worried about it, they should be issuing every employee a separate phone.

"We don't trust you enough to have your own device without a rootkit, but we somehow still think it's a good idea to send sensitive company emails to somebody's random custom-ROM 3rd-party Android phone or Macbook, which might have who-knows-what 3rd-party malware installed on it."

Why would you want to put company secrets on the same device that somebody is using to play Pokemon Go, Among Us, and to connect to whatever IoT disaster that they've just been gifted for Christmas?

Google Security has a list of supported devices & OS versions that can run their rootkit. Google corporate accounts cannot sign in on other devices. When a device gets too old and rolls off the supported list, they automatically log it out and wipe any company data on it. I believe most large companies operate like this.

Google is actually more flexible than most companies: Any employee can get a company phone and employees are allowed to use their personal phones if they want (and don't mind the rootkit and spying). Surprisingly, a lot of people opt for the rootkit & spying to avoid carrying two phones. This saves the company some money on phones & mobile service contracts. And it makes those employees happy.

Why do people need company stuff on their phone anyway?

I very purposefully avoid any work email or slack or apps on my personal device.

Sure, you could interpret it as HR lying. Frequently when people speak using natural languages it is possible to interpret something in ways other than what were meant. It's clear that the HR person meant that Google's rootkit-enabled security software would make a good faith effort not to intrude on personal data. Then the person in the story proposed changing the contract wording to "May only access Google related information and no personal information." This no doubt got forwarded on to a lawyer who said "No can do, that's a legal promise that the security software is 100% bug-free." That would also require wading into the murk of what is "personal data" and what is "Google related information". Does putting your commute schedule on your personal calendar make your personal calendar "Google related"? Are chat messages in which you sexually harass your coworker "personal information"? No lawyer is ever going to sign off on this.

Also, these companies (not just Google) face the very real threat of outside groups (and nation states) attempting to infiltrate them via new hires. They need full control and detailed forensics for all authorized access devices.

This is why I'm so surprised that other commenters are surprised. If you've ever worked for a Big Serious Company (especially the defense sector, but increasingly just about everywhere), they have an IT Security department, and that IT Security department has a data loss prevention plan. Part of that plan is endpoint protection software, and that endpoint protection software has to be a rootkit, by any reasonable definition of the word.

I guess the crux of the problem is that the modified/redlined language might have made sense to the GP's friend at the time, and the HR person might have thought it made sense, but you can't tell the DLP software "no personal information" -- if there's an incident and the company needs to perform a forensic investigation, they can't be responsible for determining what they're "allowed" to look at. As other commenters have said, if you don't want your employer seeing your personal data, don't put that data on the same device as your employer's data.