Employees routinely use personal phones to send emails, exchange texts, and conduct business. When litigation arises, opposing counsel increasingly seek access to information on those devices. Whether an employer must search and produce data from employees' personal phones often turns on two issues: (1) whether relevant information is likely to exist on the device; and (2) whether the employer has sufficient "control" over the device under the Federal Rules of Civil Procedure. A recent decision from the Middle District of Tennessee highlights how carefully drafted bring-your-own-device (BYOD) policies can help employers successfully resist such requests.
The Threshold Question: Is Relevant Evidence on the Device?
Relevance is the first hurdle. Under Federal Rule of Civil Procedure 26(b)(1), a party seeking information from employees' personal devices must do more than speculate that responsive data exists. The requesting party must identify evidence, such as testimony, documents, or metadata, showing relevant information is likely located on the device.
For employers whose policies require business communications to occur through company-managed systems, this threshold alone may defeat requests to search personal devices.
The Legal Framework: Who "Controls" a Personal Phone?
If relevant information may exist on a device, the next question is whether the employer has "possession, custody, or control" of that information under Rule 34(a).
Courts generally apply one of two standards:
- The legal right test: Whether the employer has a legal right to obtain the information on demand through a policy, agreement, or other authority.
- The practical ability test: Whether the employer can obtain the information as a practical matter, even without a formal legal right.
Courts do not apply these standards uniformly. Outcomes often depend on the jurisdiction, policy language, the employer's practices, and the facts of the case. Employers operating in multiple jurisdictions should expect varying approaches.
Applying the Framework
A 2025 decision from the Middle District of Tennessee illustrates how these principles operate in practice. In a trade secrets dispute, the plaintiff sought to compel an employer to search the personal phones of employees who used their devices for work under a BYOD policy. The court declined to require the search, finding the employer lacked the necessary control over the devices under both the legal right and practical ability standards.
The court focused on several key provisions of the employer's BYOD policy:
- Limited inspection rights: The policy permitted device inspections only to confirm compliance with information security requirements, not to access personal data.
- Company communications through company systems: Employees were required to conduct business through company email accounts and approved applications. Because those systems had already been searched, no broader device search was warranted.
- Remote wipe authority: The employer's ability to remotely wipe devices in limited circumstances was viewed as a security measure, not evidence of control over personal data.
- Definitions of company property: The handbook's references to company property and computer systems applied to company-owned equipment, not employees' personal devices.
The court also found no evidence that the employer routinely accessed personal-device data, that employees had previously produced such data for the company, or that the employees had a personal financial interest in the litigation. Taken together, those facts weighed against a finding of control.
What This Means for Employers
The decision provides a useful roadmap for employers. Clear, narrowly tailored policies that distinguish company systems from personal devices can help limit discovery obligations. By contrast, policies that grant broad rights to inspect or access employees' personal devices, or that define company property too expansively, may support arguments that the employer controls those devices for discovery purposes.
Although outcomes will continue to depend on the policy language, facts, and jurisdiction involved, reviewing BYOD policies now may help employers avoid costly discovery disputes later.
Important Note: A well-drafted BYOD policy may help an employer avoid a Rule 34 obligation to search employee-owned devices, but it does not make those devices immune from discovery. Opposing parties may still seek information directly from employees through Rule 45 subpoenas. Employers should be prepared to address that possibility.
Practical Guidance for Employers
- Adopt a clear, narrowly drafted BYOD policy that limits inspection rights to security and compliance purposes.
- Require employees to conduct business communications through company email systems and approved applications.
- Define terms such as "company property," "company data," and "company IT assets" carefully to avoid encompassing personal devices or personal data.
- Evaluate reimbursement and subsidy programs for personal devices, which may support arguments that a device functions as company equipment.
- Consider issuing company-owned devices to employees in sensitive or high-risk roles.
If you have questions about your BYOD policy, employee handbook, or discovery obligations involving employee devices, please contact a member of Baker Donelson's Labor & Employment Group.