Labor & Employment Law Daily Wrap Up, PRIVACY—S.D. Cal.: Employee did not waive privacy right in personal email data on company provided laptop, (Dec 5, 2025)

By Kathleen Kapusta, J.D.

The company’s request to review data spanning more than 15 years, nearly 10 times the length of her employment with the company, was “patently unreasonable and overbroad.”

A former analyst for a security operations provider who added her personal email account to her employer provided laptop did not waive her constitutional right to privacy in her personal email data, a federal district court in California ruled, granting in part her motion for a protective order. While the company has a legitimate interest in obtaining relevant discovery in the employee’s lawsuit alleging race discrimination, retaliation, and wrongful discharge, its request for an unrestricted review of the data is “profoundly serious in its scope and potential impact,” the court stated, noting that there are less intrusive methods for obtaining the relevant information (Lim v. Expel, Inc., No. 3:24-cv-02284-W-AHG (S.D. Cal. Dec. 1, 2025)).

Personal email account. The employee worked as a Senior Governance Risk Compliance and Privacy Analyst for Expel, Inc., for approximately 18 months. During that time, she added her personal Gmail account to the mail account on her work issued laptop. Company policy allowed employees to use company property “for incidental personal reasons” with certain restrictions.

The employee believed her personal email account was “password-protected and separate from any work platform.” Her personal email data spanned more than 15 years and included sensitive, private information such as attorney-client communications, medical and financial records, and home security images including images of her minor children.

When the company terminated the employee, it revoked her access to her laptop. It also denied her request to retrieve personal files, telling her that her laptop would be “wiped.” According to the company’s general counsel, it was standard practice to wipe a laptop for reuse but because the employee had made allegations of retaliation, Expel retained her laptop.

Forensic consultant. The employee subsequently sued and Expel sent the laptop to a forensic consultant, which discovered numerous emails had been downloaded from the employee’s Gmail account and stored on the company laptop’s hard drive. The forensic consultant limited its review of the data to date/time stamps and sender/receiver information and did not review the contents or share the data or associated metadata with Expel’s counsel.

Protective order. The employee then sought a protective order prohibiting Expel from reviewing the personal email data, requiring its deletion, and ordering the appointment of a forensic expert to ensure compliance. She argued that she did not waive any rights to privacy or privilege related to her personal email data because Expel’s policy allowed her to use the laptop for personal matters, did not explicitly state that personal email data on the laptop would become company property, and did not tell employees it could monitor their personal email data. For its part, Expel argued that it had the right to review the personal email data in its entirety to determine whether it contained relevant information because the employee waived any right to privacy or privilege by storing the data on its laptop.

Legally protected privacy interest. The court applied the three-prong test set forth by the California Supreme Court in its 1994 Hill v. Nat'l Collegiate Athletic Assn. decision to determine whether Expel’s proposed review of the personal email data would violate the employee’s constitutional right to privacy. Here, it easily found she possessed a legally protected privacy interest in the personal email data, which included financial records, medical information, and home security images, “core categories of information recognized as protected by California’s constitutional and common law right to privacy.”

Objectively reasonable expectation of privacy. The court next found the employee had an objectively reasonable expectation of privacy in her personal email data as she did not waive her right to privacy by accessing her personal email account on the company’s laptop. Expel’s policy allows the use of company-issued equipment for incidental personal purposes and does not provide that it has the right to review personal data on a company-issued laptop. While the policy does state that data stored on a laptop belongs to Expel, that language, the court observed, “is at best ambiguous as to personal data, and that ambiguity must be construed against Expel.”

A reasonable reading of the policy, the court continued, was that the company retains ownership of its data at all times and that employees cannot retain or use company data for their own personal purposes. “Reading the policy otherwise would lead to the absurd result suggested by Expel here: that Expel is entitled to peruse more than 15 years of [the employee’s] highly personal and confidential information, including communications with her attorneys, without any restrictions.”

Further, said the court, the cases cited by Expel were easily distinguishable as the policies in those cases prohibited employee use of company computers for personal reasons and stated that an employee would not have any right to privacy in personal information stored on a company computer. Pointing out that Expel’s policy was the opposite of the policies at issue in those cases, the court explained that “Permitting employees to use company-owned devices does not diminish their expectation of privacy; it increases it.” Thus, said the court, the employee retained an objectively reasonable expectation of privacy in the personal email data, even though it was stored on Expel’s laptop.

Serious intrusion. Turning to the third Hill factor—a threatened intrusion that is serious—the court found the intrusion suggested by Expel—its unrestricted review of the employee’s email data that included highly private information—was “profoundly serious in its scope and potential impact.” Noting that Expel’s normal practice is to wipe a former employee’s laptop upon termination, the court pointed out that its only possible interest in the employee’s personal email data is limited to the extent it relates to her claims.

“Such a radical intrusion is not necessary or proportional here,” said the court, as the “Federal Rules set clear limits on discovery, prohibiting unrestricted access to information in the mere hope of finding evidence.” Expel’s request, the court continued, to review data spanning more than 15 years, including data from more than a decade before the employee began working for the company, “is patently unreasonable and overbroad.”

Less intrusive measures. The court acknowledged Expel’s legitimate interest in obtaining relevant discovery but pointed out that there are less intrusive methods to do so, methods the company has already employed. Indeed, the court observed, among other things Expel has served more than 50 subpoenas on the employee’s past and prospective employers and her medical and health providers. These existing discovery tools, the court stated, “have provided Expel ample opportunity to obtain relevant discovery without unnecessarily subverting [the employee’s] privacy rights.”

Concluding that the employee did not waive her constitutional right to privacy in the personal email data, the court prohibited Expel and the forensic examiner from accessing or reviewing the personal email data without its advance authorization upon a showing of good cause. It also ordered that within 30 days following termination of this action, including any appeals, Expel and the forensic examiner must delete the personal email data, including any copies thereof, and certify in writing to the employee’s counsel that they have done so.

The case is No. 3:24-cv-02284-W-AHG.

Judge: Goddard, A.

Attorneys: Daniella Doern (Gruenberg Law) for Yu Yu Lim. Evelina Shpolyansky (Littler Mendelson) for Expel, Inc.

Companies: Expel, Inc.

MainStory: TopStory Privacy EvidenceDiscovery Procedure CaliforniaNews GCNNews