The BYOD Commentary

Principle 1: Organizations should consider their business needs and objectives, their legal rights and obligations, and the rights and expectations of their employees when deciding whether to allow, or even require, BYOD.

Principle 2: An organization's BYOD program should help achieve its business objectives while also protecting both business and personal information from unauthorized access, disclosure, and use.

Principle 3: Employee-owned devices that contain unique, relevant ESI should be considered sources for discovery.

Principle 4: An organization's BYOD policy and practices should minimize the storage of––and facilitate the preservation and collection of––unique, relevant ESI from BYOD devices.

Principle 5: Employee-owned devices that do not contain unique, relevant ESI need not be considered sources for discovery.

• If the ESI is within the employer's possession, custody or control—a complex determination that may vary across circuits.

• Whether the ESI is both relevant and unique, or, if instead there is other ESI that is more readily available from other sources.

• Whether the discovery of the ESI is proportional to the needs of the case, especially in light of the 2015 amendments to the Federal Rules of Civil Procedure.

• The use of custodian interviews and inquiries to confirm that all relevant communications are in email messages that are preserved and available on the organization's central server, eliminating the need for copying BYOD devices.

• Ensuring that the BYOD policy incorporates “technology controls reasonably designed, with due care and in good faith,” that block the ability to store unique, relevant ESI on BYOD devices. In such instances, preservation and collection efforts should, instead, target the most accessible copies of the ESI from other sources like active email files or archives.

Conclusion