In Episode 171, Kelly Twigger discusses the latest decision on whether an employer has possession, custody or control over data in its employees’ personal devices in Allergan, Inc. v. Revance Therapeutics, Inc.
Introduction
Welcome to our Case of the Week segment of the Meet and Confer podcast. My name is Kelly Twigger. I am the Principal at ESI Attorneys, a law firm for ediscovery and information law, and the CEO and founder at Minerva26, where we take the insights from our practice and provide a strategic command center for you to leverage the power of Electronically Stored Information (ESI). Thanks so much for joining me today.
This week’s decision on our Case of the Week comes to us from the case of Allergan, Inc. v. Revance Therapeutics, Inc., and it is a critical one for in-house counsel to know about, because it deals with whether personal mobile devices used for work-related activities are under the possession, custody or control of the employer for purposes of discovery in litigation where the employer is a party. This decision follows the reasoning from Magistrate Judge Hildy Bowbeer’s decision in In re Pork Antitrust Litig., which we covered on Episode 72 here on our Case of the Week, and is contrary to District Judge Jane Boyle’s decision in Miramontes v. Peraton, Inc. that we covered on Episode 117 on Case of the Week.
Today’s decision is from a March 17, 2025, ruling from the Special Master, who was appointed by Magistrate Judge Jeffrey Frensley in this case. Now, if you’re familiar with Minerva26, you know that we add issue tags to all of the case law in our database, and the issues for today’s decision include mobile device, possession, custody or control, privacy, Special Master and ESI Protocol.
Let’s dive in.
Facts
The facts of this case involve a misappropriation of trade secrets in which Allergan alleges that Revance stole information related to Allergan’s popular products of Botox and Juvéderm. They did so allegedly by hiring Allergan employees away and encouraging those employees to take trade secrets with them. The parties did negotiate and enter an ESI protocol to govern the matter, but it did not include any provision regarding the production of data from mobile devices or address whether personal mobile devices would be included.
We’ll discuss later whether that’s something you should or would want to include in your ESI protocols. We had some great discussion on our panel at the Masters Conference in DC last week, where Manfred Gabriel from Holland & Knight specifically stated that he prefers to have a really narrow policy and just include form of production and what’s key, not include larger things like data sources that you’re going to provide from. And so there’s a debate, I think, among a lot of practitioners, as to what is appropriate to include in your ESI protocol. But here it’s something to note that the parties did have a protocol. They did include a number of provisions about data sources, but did not include anything about mobile devices. Had they done that, that would have likely changed the analysis here in this decision as to whether or not they were entitled to that information.
On this motion, the parties are before the Special Master on Allergan’s request to compel the search of the personal mobile devices of four individuals in response to requests for production from Allergan. All four individuals worked for Allergan and then worked for Revance. All four also used their personal devices while working for Revance, pursuant to Revance’s bring your own device policy, and we’re going to talk about what that policy entails. That’s going to be very critical to the analysis of what you take away from today’s decision and how you’re going to advise your clients on BYOD and the use of personal mobile devices.
Allergan argues that Revance’s BYOD policy, taken together with key language from Revance’s employee handbook, support compelling Revance to search the personal devices. Revance, of course, argues that it does not have possession, custody or control of the devices as required by Rule 34 of the Federal Rules of Civil Procedure.
The pertinent part of Revance’s employee handbook allows Revance to inspect all company-owned property. Company-owned property, as you might suspect, includes all company-owned items, and the handbook notes that there’s no expectation of privacy in any company-owned property. The handbook also contains a section on electronic and social media, which defines electronic communications as including “email, text messages, telephones, cell phones and other handheld devices and electronic information, as any information created by an employee using computers or any means of electronic communication, including but not limited to, data, messages, multimedia data, and files.” So from that language from the employee handbook, we know that Revance is considering text messages and other types of data that would be created on a mobile device to be part of “electronic information”. Both of those those definitions that I just gave you — electronic communications and electronic information — suggest that data created on a mobile device would be covered.
That section of the employee handbook also states that all electronic communications remain the sole property of the company and are to be used for company business. For example, email messages are considered company records and that “electronic information created by an employee using any computer or any means of electronic communication is also the property of the Company and remains the property of the Company.” The handbook also allows the company to inspect all company property to ensure compliance at any time. Specifically, that section states that the company reserves the right to access, review and monitor phone calls, electronic files, information, messages, text messages, email, internet history, browser-based web mail systems or other digital archives, and to access, review and monitor the use of computers, software and electronic communications to ensure that no misuse or violation of company policy or any law occurs. Email may be monitored by the company and there is no expectation of privacy. That’s the handbook.
Revance states that its BYOD policy had one purpose, and that was to outline the acceptable use of company and personal mobile devices. The policy permits Revance personnel to use their personal mobile devices, so long as they follow a set of criteria that protects the business information on their personal device. The policy also provides that employees conduct business on the device only using the Revance email system, allows for the inspection of the device for compliance and provides three instances in which the device can be remotely wiped.
Now that remote wiping suggests a fair amount of control over the device. However, in this particular case, there are no specifics in the decision here from the Special Master — and that may be because he just chose to exclude them but there are no specific facts here from Allergan about what they were seeking on these mobile devices and I think that’s going to be critical to the analysis. Nevertheless, I want you to focus on the fact that the employee handbook specifically acknowledges in a couple of different places that text messages are a type of electronic communication that it anticipates its employees will make. However, the BYOD policy specifically limits the use of personal mobile devices to work-related email from Revance. And that’s key, because email generally is not something that we collect from mobile devices and we’ll get into that.
Analysis
What’s the Court’s analysis based on this set of facts?
Well, the Court starts with the language of Rule 34(a)(1) that allows a party to serve a request for production for items within the responding party’s possession, custody or control, and it identifies the two tests that courts have across the country used to determine control under that section of Rule 34. Those two tests are the Legal Right Standard and the Practical Ability Standard. I’ll cover what those are briefly in case you’re not familiar with them or haven’t listened to our earlier episodes where we’ve gone through them.
The Legal Right Standard assesses whether the responding party “has the legal right to obtain the documents on demand from someone else”. That is understood to include the legal right to demand release from the party with the actual possession, meaning here that Revance would be able to compel production of those mobile devices so that Allergan can say to Revance, you’re required to produce the data from those four personal devices and Revance has the authority to go and get control of those devices and provide the information.
The Practical Ability Standard, on the other hand, extends the notion of control to where a party has the practical ability to obtain the documents from a non-party to the action.
Remember that the employees at issue here who have data on their personal devices are not named parties to the action. If they were named parties, it would be a completely different scenario, because they would be subject to discovery themselves. It would not necessarily have to go through the employer to provide that data.
The Special Master here goes through a very long line of cases which courts have adopted both approaches, the legal right and the practical ability standard. All of the cases which the Special Master cites to are from 2020 and before, so more than five years ago, and all before the pandemic dramatically changed the way that we work and how much we use our personal mobile devices for business. Despite several paragraphs, the Special Master comes to the conclusion that “relatively few courts have addressed whether to apply the ‘legal right’ standard or the ‘practical ability’ standard in the context of an employer’s Rule 34(a) control over its employees’ personal devices, such as cell phones or tablets.”
The Special Master does not address each of those decisions in turn. Instead, he looked to Magistrate Judge Bowbeer’s decision in the In re Pork Antitrust Litig., that I covered on Episode 72 on our Case of the Week. In In re Pork, Magistrate Judge Bowbeer elected not to apply either the legal right or the practical ability test. Instead, the court there found that Hormel’s BYOD policy did not give Hormel control over text messages on personal mobile devices at issue, because the policy did not explicitly assert ownership, control, or the ability to access, inspect, copy, image or limit personal text messages. Nor did it require any employee who uses a personally owned cell phone to use text messaging to conduct work. Of course, in reading that decision, and if you listen to my analysis of the In re Pork decision, I think the fact that you’re not telling people to use text messages even though you’re fully aware of the fact that they are using text messages is a bit of a double-edged sword there. I’m not sure that’s the proper analysis.
Ostensibly following In re Pork and another decision called Halabu Holdings, LLC v. Old Nat’l Bancorp., the Special Master here elected to apply the legal right standard to determine whether Revance had control over its employees’ personal devices. In doing so, he distinguished the cases offered by plaintiff that attempted to establish that Revance had a legal right to inspect the devices and found that neither Revance’s employee handbook or its BYOD policy gave it the legal right to search employees’ personal devices. The Special Master pointed expressly to the language of the BYOD policy permitting the use of personal devices ¨.
The language in the BYOD policy here in the Allergan case is really what ties this case to In re Pork. In that case, Hormel’s IT controlled certain aspects of data on personal devices but it did not control the text messages that were sought in discovery. Here, the Special Master found that the policy limiting employees to using their personal devices to access company email had the same effect as that language in In re Pork. The Special Master also went on to find that Revance did not have control under the practical ability test as well for the same reasons it did not have the legal right.
The final quote from the Special Master sums up his take here:
Without an agreement between Revance and its employees permitting Revance to search employees’ personal devices, explicit language in the policy giving Revance control over its employees’ personal-advice data, or more information about whether the subject employees actually used any other application on their personal phones for work purposes, the Special Master finds that Revance does not have Rule 34(a) control over the personal devices of employees.
I went and checked the docket to see whether Allergan objected to the Special Master’s findings and it did not. As a result, Magistrate Judge Frensley entered the Special Master’s report and recommendation on April 4, 2025. It stands to reason there’s still a bit of time left for Allergan to appeal that to the District Court if it chooses to do so.
Takeaways
What are our takeaways from today’s case?
Well, interestingly, as I mentioned, the Special Master cited to several decisions and the Sedona Conference commentary on possession, custody or control, but never touched on District Court Judge Jane Boyle’s decision in Miramontes v. Peraton, Inc. That decision, which we covered here on Episode 117, also addressed the issue of control in the context of data on personal mobile devices and rejected both the legal right and the practical ability tests, saying that while those tests have intuitive appeal, the realities of modern business require a fact-specific approach. According to Judge Boyle:
Today, many, if not most, employees use cell phones for work. And while some companies issue work devices, others … do not. Under [the defendant’s] view, a company could effectively shield a significant amount of its employees’ business communications from discovery simply by allowing its employees to conduct business on their personal phones. For these reasons, the Court agrees with other courts that have found electronically stored information on employees’ personal devices may be under the control of their employer in certain circumstances.
So what do both of those decisions tell us? Well, basically, that you need to read and understand the depth of court’s positions on this issue, both for drafting your BYOD policies and informing your employees as to whether or not mobile devices are subject to discovery. What the policy covers and how it is structured were factors for the courts in In re Pork and the Allergan decision that we discussed today, and in both of those cases the party from whom production was sought had a BYOD policy and practices to draw from factually. That was not the case in Miramontes. So it’s a different analysis.
Also, I wanted to see some discussion here from the Court about this agreement issue. The Court suggests in the opening language of its decision and I keep saying Court, but I mean Special Master, that had the parties agreed to provide data from mobile devices, that the control issue would really be irrelevant. So that’s something to consider when you’re in litigation. When you’re doing your early case planning, your strategy that we advocate for so heavily here on Case of the Week, you want to consider whether you’re going to have mobile device data and whether the other side is going to have mobile device data, and you’re going to want to make that argument out of the gate so you don’t get to this possession, custody or control issue that is so thorny.
What I didn’t see in today’s decision was any specifics about what data Allergan wanted from the devices and what evidence they had to suggest that evidence existed on those devices that otherwise wasn’t being collected. As I mentioned earlier, we don’t typically collect email from mobile devices, but from the source account — think Microsoft email, gmail, whatever your email provider is — and the parties here were in the process of producing that email. So had Allergan raised that text messages would have been relevant to their case, that might have been a different analysis, particularly as the language in the employee handbook specifically references text messages as a form of electronic communication and that the company specifically owns electronic communications made within the context of work, whether on a company-owned or a personal device.
Having read the Special Master’s reliance on In re Pork, though, I think the language in Revance’s BYOD policy requiring that only the use of company email on mobile devices would have had the Special Master doubling down on In re Pork and denying that Revance had control under Rule 34. So perhaps Allergan’s analysis or providing more information on what additional information was needed or what specific sources of ESI were on the mobile device that couldn’t be collected from somewhere else may have been relevant. Maybe there are text messages. Maybe there are Signal messages. Maybe there’s WhatsApp. Maybe there are other applications that would have only been able to be collected from the mobile device. But that information is not in the decision as to whether or not Allergan made that argument.
I will say here what I said after the In re Pork decision, and that is that there’s no reason why Allergan can’t subpoena the individuals as non-parties under Rule 45, the same way that the party in In re Pork did after Hormel was found not to have control.
Practically speaking here, you need to understand your client’s policies and practices in dealing with discovery. If you are in-house counsel or advising clients on this issue, look at the language of the policy, if there is one, and think about what you are trying to do. If preventing having the company exercise control over text messages and personal devices is your goal, In re Pork and today’s decision may be a blueprint for that.
My personal opinion is that District Judge Boyle’s decision in Miramontes is more in line with the realities of business and that when a business knows that its employees exchange work-related text messages or use other applications on a mobile device and that information is relevant to litigation, that information was created in the business context and would not have been created but for the employment relationship. That is the intent behind Rule 34, and it is another reason why our rules need to evolve to prevent this kind of split in the courts.
We are at the district court level in these decisions and they are rarely appealed, meaning that there is no good, clear guidance for clients on how to proceed here. So, it’s a factual determination. You need to decide what your client’s goals are in establishing policies. Establish a policy if you don’t have one, if you want one. Remember that in Miramontes there was no policy governing the use of personal mobile devices, and that was likely a factor in the Special Master’s decision.
However, I do think that the pace at which we are leveraging technology as employees, as lawyers, as anybody in the workplace knows, with a remote working environment there needs to be more and better clear authority on how we’re handling data. From a work perspective, we communicate in the way that is most effective to reach the person we’re trying to reach in a time frame that matters. I communicate with folks overseas using WhatsApp because it works better. They don’t have the same text messaging systems over there or it costs money for them to be able to get messages from the U.S. You have to understand the business practices of your employees, of your custodians, and then you need to tailor your protocol to fit those needs. And you’ve got to think about, do I want to include mobile device data here or do I not want to include mobile device data here? Do I want to include specific applications from mobile devices or do I not want to do that? It all needs to be thought out very strategically.
These cases are looking at what the parties have in place to be able to determine control. It’s a fact-based decision. There are differences between how the Court came down in Miramontes and how the Court came down here today in the Allergan case, as well as the In re Pork case, and there are lines of decisions along both interpreting those legal right and practical ability tests.
So how are we going to move forward? We’ll find an episode on Meet and Confer to be able to discuss this in more detail with some judges who have good insight as to how those tests are applied and whether they need to evolve given our use of technology.
Conclusion
That’s our Case of the Week for this week. As I mentioned two weeks ago, we’ll be moving to doing the Case of the Week every other week to make room for other content on our newly branded Meet and Confer podcast, so be sure to tune in for our next episode, whether you’re watching us via our blog, YouTube, or downloading it as a podcast on your favorite podcast platform. You can also find back issues of Case of the Week on your favorite podcast platform and be sure to subscribe, as we’ll be adding new content apart from the Case of the Week segments.
As always, if you have suggestions for a case to be covered on the Case of the Week, drop me a line. If you’d like to receive the Case of the Week delivered directly to your inbox via our weekly newsletter, you can sign up on our blog. If you’re interested in doing a free trial of our case law and resource database, you can sign up to get started.
Thanks so much. Have a great week!
