RETURN TO NEWS & PUBLICATIONS
The E-Discovery Field Guide
The E-discovery Implications of BYOD (Bring Your Own Device) Practices
Cell phones and other personal-electronic devices encapsulate many of the challenges inherent in E-discovery. Such devices create and hold massive amounts of data—texts, e-mails, chats, posts, locations, steps, heart rates, and so on. Some of this data might be highly relevant to a lawsuit. Much of it will not be. And much of it may also be highly personal.
Cell phones often blur the lines between the professional and personal. Many workers today carry their work around in their pocket, tending to business wherever, whenever. This work is frequently performed on personally owned devices, as the days of company-issued phones have mostly passed with the Blackberry. As a consequence, many companies now have a BYOD (Bring Your Own Device) policy or practice.
But while companies benefit from having their employees buy expensive devices that they then use to perform work on at all hours, when it comes to E-discovery, personally owned devices present multiple challenges. As typical for discovery issues, this one is best addressed before it arises.
A company with a BYOD policy or practice faces an initial and unresolved question: does it have legal control over an employee’s cell phone or other electronically stored information on the personally owned device. Under the Federal Rules of Civil Procedure, a party must preserve and produce documents and information within its “possession, custody, or control.” Fed. R. Civ. P. 34(a)(1). Most federal circuit courts define these conditions as the legal right to obtain the information. Federal courts, however, are divided on when an employee’s personal device is within the “possession, custody, or control” of her employer. See Goolsby v. Co. of San Diego, No. 3:17-cv-564, 2019 WL 3891128, *4 (S.D. Cal. Aug. 19, 2019). This uncertainty will remain for the foreseeable future. There are, however, steps a company can take to minimize the chances that employee-owned devices need to be ultimately produced and ease the burden of production if required.
1.
First, as a technical matter it is important to make sure that personal devices do not create unique company-related data. For example, if all work e-mails on a cell phone are logged on a company server, the cell phone data would be merely duplicative of controllable server data, which is more readily accessible, and which may eliminate the need to search the cell phone in discovery.
2.
Second, a company BYOD policy that strictly prohibits company-related work outside of company- controlled platforms (i.e. e-mail, don’t text) could assist in any argument that the device has no unique data. Generally, it is the requesting party that must show that personal devices were used for business purposes, so an explicit policy that is directed, reiterated, and enforced, could go a long way in defeating any argument that an employer must obtain and produce data on employee’s cell phones. The contents of a BYOD policy are a different topic, but for those interested, the Sedona Conference’s BYOD commentary (available here) offers principles to consider.
3.
Finally, when litigation is reasonably anticipated, the company should make reasonable, good faith efforts to determine if unique data on personal devices needs to be preserved. Given the unsettled nature of the law, a court might determine that a company has “possession, custody, or control” of its employee’s personal device. If this determination is made years after the data has vanished on the device, then the company may face spoliation sanctions under Rule 37(e). Courts have looked favorably on verbal instructions to employees to search for and preserve evidence on their personal devices. See Goolsby, 2019 WL 3891128 at *10 (citing Alter v. Rocky Point Sch. Dist., No. 13-cv-1100, 2014 WL 4966119 at *10 (E.D.N.Y. Sept. 30, 2014)).
A BYOD company faces myriad issues from data security, privacy concerns, and data management. E-discovery adds yet another level of complexity. But addressing the e-discovery implications of the company data that workers create using their own devices up front will have great benefit if that information is requested in a lawsuit.
Meet Bernstein Shur’s E-discovery team: