Does an Employer Have a Duty to Preserve an Employee’s Personal Cloud Storage

Does an employer have a duty to preserve evidence relating to a lawsuit saved in an employee’s personal cloud storage account (Box.com, Dropbox, Google Drive, etc.)? It depends on the court in which the case is pending and what rights the employer has to the information.

Some courts require employers to preserve electronically stored information (ESI) in employees’ personal accounts if the employer has the “practical ability” to obtain the information. Other courts require employers to preserve ESI saved in employees’ personal accounts only when the employer has a “legal right” to the information.

Understanding the extent of a company’s obligation to preserve information in an employee’s personal cloud storage account is imperative if the company has a “bring your own cloud” (BYOC) policy permitting employees to use personal cloud accounts in connection with their work duties. This is especially true as working from home and distributed work becomes more prevalent.

One View: Employer Must Preserve Data in Employee’s Personal Cloud Storage if it Has “Practical Ability” to Access

In Selectica, Inc. v. Novatus, Inc., Case No. 6:13-cv-1708-Orl-40TBS (M.D. Fla. March 12, 2015), Novatus hired three employees away from Selectica. One of the employees maintained a Box.com account that synced with his Selectica issued computer. After the employee left for Novatus, he returned the computer, but the Selectica data remained on Box.com. After joining Novatus, the employee offered to share Selectica’s pricing information with a member of Novatus’ senior management by sending a link to files on Box.com account.

Ultimately Selectica sued Novatus and the employee for misuse of confidential information and unlawful competition. Novatus retained counsel who advised the company of its obligation to preserve evidence and forwarded a litigation hold letter sent by Selectica. Not until a month later did Novatus discuss preservation of relevant information with the employee who owned the Box.com account. By that time he had deleted the Selectica information (which Novatus never accessed) but was able to produce a list of documents deleted from the account.

Claiming “flagrant spoliation of evidence,” Selectica sought sanctions against Novatus and its former employee. Selectica argued that without the documents and related metadata, it could not know whether Novatus engaged in unfair competition or whether it misused Selectica’s trade secrets and proprietary information.

As it related to Novatus’ control of its employee’s Box.com account, the court applied a “practical ability” test. Under that test, a party controls information if it has the “authority or practical ability to obtain the materials sought on demand.” In re: NASDAQ Market-Makers Antitrust Litigation, 169 F.R.D. 493, 530 (S.D.N.Y. 1996). The court believed that an employment relationship may satisfy the “practical control” test and that Novatus had practical control of the information in the Box.com account.

The court pointed out that Novatus knew the employee was a key figure in the case and that he possessed Selectica information in the Box.com account. The court believed that the employee was willing to cooperate with Novatus in obtaining the information because offered to share it with Novatus management.  As a result, the court concluded that Novatus had access and the ability to produce information in the Box.com account and therefore had an obligation to instruct the employee not to delete it.

Despite finding an obligation to preserve the information, the court ultimately declined to impose sanctions because the information was not crucial to the case.

“Practical Ability Test” Has its Critics

The “practical ability” test used in Selectica is not without critics. The Sedona Conference, a “think tank” focused on complex litigation and other legal issues, is critical of the “Practical Ability” test in its “Commentary on Possession, Custody, or Control”. The Commentary points out that some courts interpret the “Practical Ability” test to require production of documents based on a possibility that the documents at issue could be obtained on demand even if the party has no legal right to them (as was the case in Selectica). Among other concerns, the Sedona group believes that the “Practical Ability” test could obligate parties to produce documents in violation of non-disclosure agreements and also believes the test is incompatible with modern technology.

Another View: No Obligation to Preserve Employee Personal Cloud if No “Legal Right” to it

There are few, if any, written court opinions specifically holding that employers have no duty to preserve information saved in an employee’s personal cloud storage account. However, guidance may be taken from opinions addressing production of information from employees’ personal email accounts. Many courts conclude employers have no obligation to produce information in employees’ personal email accounts because employers generally have no legal right to the email messages.

For instance, in Matthew Enterprise, Inc. v. Chrysler Group, LLC, Case No. 13-cv-04236-BLF (N.D. Cal. Dec. 10, 2015), the court refused to order an employer to produce work related emails found in its employees’ personal email accounts:

Documents are not discoverable under [Federal Rule of Civil Procedure 34] if the entity that holds them “could legally—and without breaching any contract—continue to refuse to turn over such documents.”. . . Chrysler points to a[n] employee handbook that instructs employees to keep “internal information” in the “sole possession” of [the employer], but this is not a contract and so does not create a legal right for [the employer] to take back any such information now stored in personal accounts. . . Chrysler has not identified any authority under which [the employer] could force employees to turn them over. The Ninth Circuit has recognized that “[o]rdering a party to produce documents that it does not have the legal right to obtain will oftentimes be futile, precisely because the party has no certain way of getting those documents.”

If you have a case in which discovery of information in an employee’s personal account is implicated, the Sedona Conference Commentary on Possession, Custody and Control is a good reference for relevant legal authority on the issue Sedona also recently released guidance on ephemeral messaging.

Other Articles on Data Retention and Legal Holds You May be Interested In:

Litigation Hold Triggers and the Duty to Preserve Evidence (2020 Edition)

Attorneys’ Duty to Implement Legal Hold Does Not End After Hitting Send

Data Retention Policies and Legal Hold Practices – Time to Revisit Because of Remote Work?