Privacy: We Think an Employee Stole Company Data on His iPod; Can We Confiscate It?

We suspect an employee has stolen proprietary data from us using his iPod. We have suspicions but no hard facts. Can we confiscate the iPod? What do we do from here to protect our information? — H.F. in South Gate

You should proceed with caution and avoid confiscating the iPod unless absolutely necessary. Doing so could subject you to a civil lawsuit brought by the employee or even to a criminal charge. However, you can take a number of other steps to protect your rights without seizing the iPod.

First, if you have a computer usage policy in place that defines your employees’ rights when using company computers, you may be able to eliminate the need to confiscate the iPod by examining this employee’s computer instead. Fairly common and often among the papers new employees sign during orientation, these policies are a crucial means to protect company data. When acknowledged by employees, these policies establish an employer’s right to monitor its employees’ computer usage.

Computer usage policies are helpful because most companies store data files that keep track of the information that is copied to and from the computer. A computer forensics specialist or data security expert should be able to use these data files to quickly determine what information, if any, was copied from your employee’s computer. This approach allows you to investigate the matter without accusing your employee of wrongdoing.

400+ pages of state-specific, easy-read reference materials at your fingertips—fully updated! Check out the Guide to Employment Law for California Employers and get up to speed on everything you need to know.

If you don’t have a computer usage policy in place, you should immediately implement one to protect your information. One California court has recommended that computer usage policies should, among other things:

• make clear that “electronic communications are to be used solely for company business, and that the company reserves the right to monitor or access all employee Internet or email usage”;
• “emphasize that the company will keep copies of Internet or email passwords, and that the existence of such passwords is not an assurance of the confidentiality of the communications”;
• “include a statement prohibiting the transmission of any discriminatory, offensive, or unprofessional messages”; and
• “inform employees that access to any Internet sites that are discriminatory or offensive is not allowed.” ¹

Another alternative is to allow your employee to retain the iPod but require him to preserve all files on it while you investigate the matter. This can be done in one of two ways. The first—and easiest—is to send the employee a “litigation hold letter” stating that you are contemplating litigation against him and demanding that he preserve the iPod’s files. (You should also demand that he preserve any other documents or files you think may be relevant to his alleged wrongdoing.) A litigation hold letter can’t guarantee that the employee will not delete the files, but it does put him on notice that the iPod is potential evidence in a lawsuit. If you later discover that the employee erased the files, he could face sanctions from the court. The judge will most likely instruct the jury at trial that it may assume the deleted files would have been unfavorable to the employee.

If you do not think a letter is sufficient to preserve the files on the iPod, you can petition the court to order the employee not to delete them. This will expose your employee to much harsher sanctions if it is later discovered that he deleted the files. However, courts are generally reluctant to issue such orders. At a minimum, you will need to demonstrate to the court that 1) the iPod is likely to contain evidence that will be used in a lawsuit, and 2) the employee is likely to delete the files if an order is not issued. ²

None of the options discussed above gives you access to the iPod, but if you decide to sue your employee, you will almost certainly be able to examine its contents in some manner. If you are given access to the iPod itself, the court is likely to require you to employ a forensic expert to ensure your examination doesn’t harm the data on the iPod. In some cases, the court may even require the expert to act as an independent discovery referee to ensure that personal or confidential information on the iPod is properly protected. For this reason, it may be simpler to require the employee to produce the relevant data on the iPod—on CD or in some other electronic format—instead of the iPod itself. The drawback of this approach is it will be much more difficult, if not impossible, to tell whether the employee has deleted information from the device.

Finally, if the company information at issue is so important that you feel you have no choice but to immediately search the iPod, take the following steps to protect yourself as much as possible:

1. Make sure you have a reasonable basis for suspecting the employee of wrongdoing.
2. Conduct your search of the iPod in a reasonable manner. Allow the employee and/or his representative to be present during the search, make sure the search is conducted by an experienced computer technician so that no files are damaged, and conduct the search discreetly and confidentially.
3. Minimize your review of the employee’s personal data to the extent possible.
4. Return the iPod as soon as you have completed your search.

These four steps may not shield you from a lawsuit, but they will go a long way toward limiting your potential liability.

Michael J. Kump, Esq., is a partner at the Santa Monica law firm of Kinsella, Weitzman, Iser, Kump, & Aldisert, LLP.

¹TBG Ins. Services Corp. v. Sup. Ct. (2002) 96 Cal. App. 4th 443, 451.

²See Dodge, Warren & Peters Ins. Services, Inc. v. Riley (2003) 105 Cal. App. 4th 1414.