Legal Intelligencer: An Employer’s Rule 34 ‘Possession, Custody and Control’ Over ESI on ‘BYOD’ Devices

The now well established “BYOD,” or “bring your own device” trend, creates turbulent waters for an employer to navigate when employees use their personal mobile devices for both business and personal purposes. Along with employee privacy and employer data security concerns, a BYOD policy may subject the data on personal devices to discovery.

An employer’s obligation to preserve or produce relevant data contained on an employee’s mobile device is a fact-specific analysis that turns on applying the appropriate standard to determine a party’s “possession, custody or control” under Federal Rule of Civil Procedure 34. Complicating the analysis is the current circuit split regarding when a producing litigant has Rule 34 “control” over third-party ESI. The Sedona Conference describes the circuit split as falling into the following three broad interpretations of Rule 34 “control:” the legal right standard; the legal right plus notification; and the practical ability standard. See, The Sedona Conference, Commentary on Rule 34 and Rule 35 “Possession, Custody, or Control,” 25 Sedona Conf. J. 1, 8 (2024). Under the legal right standard, a producing party has “control” over ESI possessed by a third party where the party has a legal right to obtain the ESI. The legal right standard plus notification imposes the additional obligation to notify the opposing party when, while having no legal right to obtain the ESI, the producing party is aware that a third party has the requested material. Under the practical ability standard, a producing party is deemed to have control over ESI when it has the “practical ability” to obtain the material, even if the party does not have a legal right to do so. Within these broad categories, there remain differences among how district courts apply these standards, and, in a few circuits, district courts have applied both the legal right standard and the practical ability standard.

District courts generally determine that employer-issued mobile devices, used by an employee for business purposes, and utilizing employer applications are under the employer’s “control” for purposes of preservation and production. However, such is not always the case when employees use their personal devices for work-related activity, and district courts are divided on when ESI on an employee’s personal device is under an employer’s “possession, custody, or control.” Determinations turn on what standard of “control” is applied by the court, and a fact-specific analysis that often involves consideration of the employer’s BYOD policy, and evidence that an employee’s personal device was used for business purposes. See, e.g., H.J. Heinz v. Starr Surplus Lines Insurance, No. 2:15-CV-00631-AJS, 2015 WL 12791338, at *4 (W.D. Pa. July 28, 2015), report and recommendation adopted, No. 2:15-CV-00631-AJS, 2015 WL 12792025 (W.D. Pa. July 31, 2015) (finding that employer had custody and control over ESI on employee-owned personal mobile devices under employer’s BYOD program.); Goolsby v. County of San Diego, No. 3:17-CV-564-WQH-NLS, 2019 WL 3891128, at *4 (S.D. Cal. Aug. 19, 2019) (“While federal courts are divided on what circumstances render an employee’s personal device subject to the “possession, custody and control” of its employer, generally the plaintiff must show that personal devices were used for business purposes.”).

In Matthew Enterprise Inc. v. Chrysler Group, the court refused to compel an employer to produce its employee’s personal email accounts used for business purposes, noting that the “Ninth Circuit has explicitly rejected an invitation “to define control” in a manner that focuses on the party’s practical ability to obtain the requested documents.” See Matthew Enterprise v. Chrysler Group, No. 13-CV-04236-BLF, 2015 WL 8482256, at *3 (N.D. Cal. Dec. 10, 2015). The court explained that even if it had ordered the production of emails from employees’ personal accounts, the movant had not identified any authority under which an employer could force an employee to turn such information over.

By contrast, applying the practical ability standard the court in Shim-Larkin v. City of New York, held that the defendant employer had Rule 34 “control” over its employees’ work-related text messages on personal mobile devices and the employer was obligated to preserve them, imposing spoliation sanctions for failing to do so. See Shim-Larkin v. City of New York, No. 16CV6099AJNKNF, 2019 WL 5198792, at *9–10 (S.D.N.Y. Sept. 16, 2019); but, see, In re Pork Antitrust Litigation, No. 18-CV-1776 (JRT/HB), 2022 WL 972401, at *4–5 (D. Minn. Mar. 31, 2022) (holding that an employer did not have “control” under either the legal right standard or the practical ability standard over text messages on the personally owned phones of employees where BYOD policy allowed employees to use their personal mobile devices for business.).

The Sedona Conference cautions that the application of the practical ability standard produces potentially unfair results as it assumes a responding party’s Rule 34 “control” without requiring that the party have legal ownership or actual possession of the subject ESI. See, The Sedona Conference, Commentary on Rule 34 and Rule 35 “Possession, Custody, or Control,” 25 Sedona Conf. J. 1, 10 (2024). While the observed unfair results extend beyond those directly impacting an employer’s obligation to preserve and produce ESI on an employee’s personal device, some speak directly to the issue. For example, an employer may find its obligations to preserve and produce ESI on a cross-border employee’s personal device runs afoul of international privacy laws. In another example, courts applying the practical ability standard may compel a corporate party to produce ESI from former employees, even if the employer lacks legal rights over such documents. For example, the court in Scovin v. Great West Life & Annuity Insurance ordered defendants to produce documents in the possession of a former corporate secretary who left the company five years prior, explaining that “If the producing party has the legal right or the practical ability to obtain the documents then it is deemed to have ‘control,’ even if the documents are actually in the possession of a non-party.” See Scovin v. Great W. Life & Annuity Insurance, No. 3:02CV1161 AWT, 2006 WL 2828428, at *3 (D. Conn. Sept. 29, 2006).

Because of these and other observed inequities, the Sedona Conference advocates for abolishing the “practicality standard” in favor of a unified, national standard that requires that Rule 34 “possession, custody or control” be established when a party has actual possession or the legal right to obtain and produce documents and ESI. See, The Sedona Conference, Commentary on Rule 34 and Rule 35 “Possession, Custody, or Control,” 25 Sedona Conf. J. 1, 11-12 (2024).

Until the circuit split regarding Rule 34 “control” over ESI possessed by a third party is resolved, determining an employer’s obligation to preserve and produce ESI contained on an employee’s personal mobile device that is used for work-related purposes will remain murky waters. As such, it is important to counsel corporate clients on the need to identify what relevant and discoverable information is potentially contained on their employees’ personal devices and evaluate their obligations to preserve and produce such ESI in litigation.

Beth Hurley is an associate at Kang Haggerty. She concentrates her practice in business litigation, class actions and commercial litigation in both federal and Pennsylvania courts. Contact her at bhurley@kanghaggerty.com.

Reprinted with permission from the October 24, 2024 edition of “The Legal Intelligencer” © 2024 ALM Media Properties, LLC. All rights reserved. Further duplication without permission is prohibited, contact 877-257-3382 or reprints@alm.com.