For many people today, the line between work and personal life is blurry at best. There are, of course, emails that come in during family meals and vacations interrupted by emergency calls. But there are also company laptops that are taken home for some evening Netflix viewing and company phones that host your personal emails. Some employees may even use company devices to communicate with their attorneys, as they plan to sue their employer.
Many businesses have policies giving them ownership of data on company devices and a virtually unlimited right to look at such documents. So, when attorney-client communication occurs on privacy-free devices, could that destroy privilege? Yes, at least according to a recent decision involving a suit between the international retailer Zara and its former general counsel.
Skirts, Pajamas, and an Employment Discrimination Claim
The ruling came as part of an employment discrimination case against Zara, brought by its one-time GC. If you’re not familiar, Zara is a massive Spanish chain with more than 2,000 stores in 88 countries. The chain’s focus on “fast fashion” has made its founder, Amancio Ortega, one of the richest men in Europe.
But Zara’s skirts and blouses have also landed it in the middle of political controversy at times. During the last election season, Zara sold a jean skirt that seemed to feature ‘Pepe the Frog,’ the internet meme associated with white nationalists and the alt-right. It once carried a handbag designed with swatstikas. The chain also sold striped pajamas emblazoned with a sheriff’s badge, a six-point, golden star. Some commentators thought the get-up looked much too similar to the outfits forced on Holocaust victims. Zara pulled the item, but its Hebrew-language announcement said the pajamas had been “exterminated.”
In 2015, the company’s general counsel, Ian Jack Miller, sued Zara, alleging that he'd been subject to a hostile work environment and fired for discriminatory reasons. “Zara favors employees who—like the Company’s founder and majority shareholder Amancio Ortega Goana—are straight, Spanish, and Christian,” Miller’s complaint alleged, in bold. “Mr. Miller is Jewish, American, and gay.”
After Miller’s termination, he apparently hung onto his company laptop, iPhone, and iPad, which he had been using to store both personal and work files over his seven years with the company. He continued to add files to the devices after his departure.
As the parties went back and forth over ownership of the devices, they eventually agreed to deposit the laptop with a computer forensics firm. Miller then sent that firm a list of files he wanted from the laptop, plus, according to Zara, “over 100 files that he insisted on deleting permanently from it.” Miller had used the computer to communicate with his attorney and those files, he claimed, were privileged. His list was, as Miller characterized it, “in essence” a privilege log. He then moved for a protective order to keep Zara from accessing those documents.
The Policy at Issue
For attorney-client privilege to apply, there must be an effort to protect confidential information from disclosure. But, Zara argues, by storing that information on his company device, Miller had failed to protect them. Given the company’s policies, there could be no expectation of privacy as to personal documents stored on Zara’s devices. That policy states, in part:
Any data collected, downloaded and/or created on Zara’s electronic communications resources is the exclusive property of Zara and may not be copied or transmitted to any outside party or used for any purpose not related to the business of Zara.
Employees should expect that all information created, transmitted, downloaded, received, or stored in Zara’s electronic communications resources may be accessed by Zara at any time, without prior notice.
Employees do not have an expectation of privacy or confidentiality in any information transmitted or stored in Zara’s electronic communications resources (whether or not such information is password-protected)...
Here’s the kicker. Miller, Zara says, helped create the policy.
But Miller argued that despite the policy’s wording he never waived any attorney-client privilege or work product protection. Zara had never seen or accessed his personal files, nor those of any other employee.
No Expectation of Privacy = No Attorney-Client Privilege
Miller was initially successful. The Supreme Court issued the protective order, keeping Zara away from the files. Zara appealed. (For those unfamiliar with New York State’s court system, the Supreme Court is the trial-level court of general jurisdiction. Its Appellate Division is the principal intermediate appellate court.) On June 6, the Appellate Division, First Department, sided largely with Zara.
Miller “lacked any reasonable expectation of privacy in his personal use of the laptop… and thus lacked the reasonable assurance of confidentiality that is foundational to attorney-client privilege,” the court wrote. The appellate court based its decision on the factors from In re Asia Global Crossing, Ltd., an S.D.N.Y. decision from 2005 finding that employee communication over company email is not a per se waiver of privilege. That decision turned on the employee’s expectation of confidentiality, with the court setting forth four factors for analysis:
- Does the corporation maintain a policy banning personal or other objectionable use?
- Does the company monitor the use of the employee's computer or e-mail?
- Do third parties have a right of access to the computer or e-mails?
- Did the corporation notify the employee, or was the employee aware, of the use and monitoring policies?
Under those factors, Miller’s privilege claims could not stand up, the court found. Its very brief discussion focused entirely on Zara’s company policy, which restricted device usage to business purposes and notified employees that they had no expectation of privacy in information stored on those devices.
But There’s a Twist!
That wasn’t the end of the story, however. While Miller may have waived attorney-client privilege, he may have retained attorney work product protections.
For those protections to be waived, there must have been actual disclosure. That means Zara must have not only reserved the right to view the documents, but exercised that right. That, Miller said and Zara did not dispute, never happened.
As such, the court modified the protective order, denying Miller’s motion as to attorney-client privilege, but directing him to produce all items in his privilege log for in camera review. Those documents which are in fact protected attorney work product will remain off limits.
The takeaway? Don’t email your lawyer from company devices, especially when you’re suing that company. If you do, hope that those documents are never actually disclosed. And if you’re being sued by an employee and looking for a leg up in the litigation, make sure to check the company device policy.
