Possession, Custody, and Control of Third-Party Personal Devices Determined by Information Governance Policies

Sports Rehab Consulting LLC v. Vail Clinic, Inc., 2025 WL 1144559 (D. Col. Apr. 18, 2025),  has a “tortuous procedural history….”  The case turned on allegations of a monopoly over physical therapy services.  Both sides objected to a report and recommendation of a special master.

In the portion of the decision pertinent to this blog: “Plaintiffs demand that Vail Health produce text messages from the personal devices of three individuals who are not parties to this action: Michael Shannon, who formerly served on the board of Vail Health; Doris Kirchner, a former CEO and Executive Director of Vail Health; and Will Cook, the current CEO of Vail Health.”

The Sports Rehab court found that the personal devices were not in Vail Health’s possession, custody, or control and that the proper procedure would have been for plaintiffs to issue subpoenas. The court wrote: “Plaintiffs could have issued such subpoenas years ago, but the record makes evident that they deliberately elected not to avail themselves of that readily-available procedure for obtaining third-party discovery.”

Two points that are worth noting at the outset are:

• In its discovery responses, “Vail Health objected to producing ‘information that is not in Vail Health’s possession, custody or control and which is more properly obtained from third persons.’”
• “Judge Martinez ‘took extreme umbrage at Plaintiffs’ disparaging statements’ about Judge Gallagher, whom Plaintiffs accused of being “not well grounded in the basic principles of antitrust law[.]’ Id. at 6; see also id. (observing that ‘Judge Gallagher felt forced to end one discovery conference in this case early due to Plaintiffs’ counsel’s unprofessional conduct; specifically, Plaintiffs’ counsel was not listening to Judge Gallagher, would not stay silent, and came perilously close to contempt of court’).”

Turning to the BYOD devices, the Sports Rehab court wrote  that “Vail Health has neither a legal right nor a practical ability to obtain these third-party materials.”  It appears that the court applied the legal right standard as a two-part test:

• “Documents are deemed to be within the possession, custody, or control if the party has actual possession, custody, or control or has the legal right to obtain them on demand.”
• “That legal right must also be coupled with a practical ability to obtain the documents from the third party.” [cleaned up; citations and quotations omitted].

In making this determination, “the Court must consider several factors, including whether the employer issued the devices, whether the devices were used for business purposes, and whether the employer had a legal right to obtain communications from the devices.” [cleaned up].

On the facts presented, Vail Health had not issued the cell phones to the employees.  They were personally owned.  Further, plaintiffs did not contend that any of the three employees “use their cell phones exclusively (or even primarily) for business purposes.”

As to the legal right:

The Director of Risk Management and Patient Safety for Vail Health averred in a sworn declaration that she has “no knowledge of any agreements or policies that give Vail Health the legal right to require Doris Kirchner, Mike Shannon, or Will Cook to turn over their personal cellular devices for inspection or collection of text messages,” nor is she “aware of any instance in which Vail Health has ever had possession, custody, or control over the personal electronic devices” of those three individuals.

Plaintiffs pointed to certain agreements between the employer and employee; however, the Special Master found that “none of these agreements cover personal devices or provide Vail Health the enforceable right to collect and produce these individual’s personal devices and text messages for use in this case.”

Two of the employees had retained separate counsel, “emphasizing, in an explicit way, their separation from Vail Health….”  As to the third, there was no evidence that Vail Health could compel him to turn over his phone.

Quoting a Texas case, the Sports Rehab court wrote:

Requiring an employer to produce an employee’s phone for inspection or retrieval of documents, without further indicia of control, could well jeopardize the employee’s privacy. If the phone is searched by the employer, the opposing party, or even an independent reviewer, all of the messages—including those that have nothing to do with the case—will be exposed. Even if the employee is the sole canvasser of the phone, privacy interests may be implicated, as even business-related messages may contain personal information. Employees might well feel comfortable sending such hybrid messages to their fellow employees or even outside customers and clients, yet shudder to think that they would be shared with total strangers, now in litigation with their company.

The employer-directed document request also implicates the employee’s property rights. Devices and the information they contain are reasonably understood to constitute the property of those who purchased the devices and operated them. Allowing opposing litigants to invade and compromise this domain through a document request directed to the employer erodes that sense of ownership.

Although it involved third-party subpoenas, a contrary decision was reached on similar facts in Maryland Appellate Decision Permitting Limited Forensic Search of Non-Parties’ Cell Phones (Mar. 24, 2022).  There, the intermediate appellate court affirmed an order directing forensic imaging and searching of non-parties’ cell phones under a strict protocol to protect the cell phone owners’ privacy.

Sports Rehab emphasized that the court’s analysis does not immunize the personal devices from discovery.  It only meant that the wrong discovery device had been employed.  Further, here discovering counsel had been expressly informed that a subpoena was necessary.  The Sports Rehab court wrote: “The decision by counsel not to take that action two years ago does not entitle Plaintiffs to third-party texts now, two years after they were informed that Vail Health could not produce them.”  The court found no law or agreement that supported the request.

Additionally, in Sports Rehab:

The court is not persuaded that such concerns would be ameliorated because Plaintiffs claim not to “seek personal information on cell phones, but rather ‘Vail Health business records electronically stored in cellphones.’ ” … This distinction is one of mere semantics; to retrieve the “business” information Plaintiffs seek, this court must compel production of these personally-owned devices. And to obtain any “Vail Health business records” on these cell phones, the devices must not only be retrieved, but also forensically imaged. Then, some protocol must be established for segregating possible “business records” on the phones from the vast amount of purely personal information contained on them, likely with the assistance of a third-party vendor. Lastly, someone—either a Special Master or this United States Magistrate Judge—would be obliged to review any extracted information before production to Plaintiffs, to ensure both a full production of “business” information and the proper exclusion of personal information. In short, however Plaintiffs purport to cabin the information they want from these personal devices, the fact remains that they demand access to personal devices that they have not shown Vail Health has a legal right or the practical ability to obtain.

The court also agreed that the discovery motion was untimely.

Information governance policies are important.  In my view, the policies were outcome determinative in Sports Rehab.

To the same effect, in another recent case, the court  engaged in a detailed review of a litigant’s information governance policy to determine the scope of possession, custody, or control.  Motion to Compel Searching of BYOD Devices – Defendant’s Information Governance Policy Determined Outcome  (Apr. 11, 2025).

I have suggested the need for a national standard. Isn’t It Time for a Uniform National Standard on “Possession, Custody, or Control”? (Sep. 7, 2022).  “Possession, custody, or control” is an issue presented in most or all discovery responses.[1]  As suggested by The Sedona Conference, the application of varying formulations of the bedrock “possession, custody, or control” concept is often contrary to the goals of uniformity and the just, speedy, and inexpensive resolution of each action.  Id.; see also Possession, Custody, or Control – Part II (Oct. 27, 2023).

The District of Maryland and some other courts follow the “practical ability” test.  See The “Practical Ability” Standard for “Control” in Maryland  (Dec. 11, 2020); see, e.g., Goodman v. Praxair Servs., Inc., 632 F. Supp. 2d 494, 516 n. 11 (D. Md. 2009);  In re Application of CBRE Glob. Invs. (NL) B.V.,  2021 WL 2894721, at *3, 5 (S.D.N.Y. July 9, 2021); Bad Things Can Happen When Company Officers Use Their Private Email Accounts for Work (May 20, 2024)(“Several courts have rejected Defendant’s position that it has no control over the private email accounts of its Board Members even if they may have been using them to discuss Board-related matters. As one court has stated, ‘[s]uch an approach would gut Rule 34 and make it way too easy for high-level executives to hide evidence.’”).

One lesson is clear. Well-drafted information governance policies may be outcome-determinative  in this murky area.

For more on the various standards for possession, custody, or control, please see:

• Isn’t It Time for a Uniform National Standard on “Possession, Custody, or Control”?
• Possession, Custody, or Control – Part II
• The “Practical Ability” Standard for “Control” in Maryland
• “No Dog in the Fight” Analysis Applies to Scope of Subpoenas in the District of Maryland

_____

[1] For example, please see Possession, Custody, or Control of Responsive Information by States Suing Meta (Sep. 12, 2024).