Suppose an email from your company’s in-house attorney instructs you to preserve all documents relating to an ex-employee who is threatening to sue for wrongful termination.  In the days before smartphones and cloud storage, this would have been a relatively limited exercise: paper documents would be set aside and files on the company server would be backed up.  But work-related data can be stored in many places today, including personal devices of employees.  Is a company required to preserve such data?

Costco Wholesale recently faced that issue in an employment discrimination and retaliation lawsuit.  See Cotton v. Costco Wholesale Corp., 2013 WL 3819974 (D. Kan. July 24, 2013).  The plaintiff asked Costco to produce text messages on the personal cell phones of two of its employees who mentioned the plaintiff or his allegations.  Costco objected on the grounds that the discovery request required it to invade the privacy of its employees, and there was no indication that the employees sent inappropriate text messages or used their personal phones for work purposes.  The court denied the request, determining that Costco did not have possession, custody, or control of the text messages.

Although the court in the Cotton case ruled that the employer had no duty to produce information stored on the personal devices of the employees in question, the outcome might have been different if the facts had changed even slightly.  Courts in other jurisdictions might also have taken a contrary approach.

The law in this area is far from clear, but following the guidelines below will help a company address e-discovery issues in their policy on personal electronic devices.  An easy way to remember the guidelines is to think of the acronym “APPS”:

• Access: Reserve the right to access personal devices that store work-related data.  Access is crucial if the company is legally required to collect and produce data residing in the personal devices of an employee.
• Permission: Clearly specify what personal devices employees are authorized to use for work-related purposes, if any.  Consider keeping a log of authorized personal devices and require employees to update the log whenever they start using a new authorized device or retire an existing one.  Your company’s document retention policy should extend to authorized devices.
• Privacy: Notify employees that they should have no expectation of privacy to data stored on a personal device if they use the device for work purposes.  This prevents the company from being liable for invasion of privacy should it need to search the contents of a personal device to respond to a discovery request.
• Segregation: If possible, segregate work-related content from personal content on personal devices.  Segregation can be implemented with software solutions, but if that is not feasible, at a minimum, instruct and train employees who use a personal device for work on how to keep their personal information separate from work data stored on the device.  For example, storage of work-related data in a personal cloud storage account should be prohibited.

Follow the above guidelines to avoid getting caught off-guard by e-discovery requests.