Privilege, the Personal Laptop, and the Manager Who Already Asked
You are general counsel of a 900-employee payments company in Austin, Texas. On 4 March a data-loss-prevention alert showed that a senior backend engineer, R.T., copied 4,200 customer records - names, partial card numbers and bank routing data - to a personal Dropbox account six days before his resignation took effect. His manager had already messaged him on Slack: 'Did you take customer data? We know you did. Explain.' R.T. replied: 'It was for testing.' The board wants a written report by 21 March. You retain outside counsel and a forensic firm; the engagement letter is signed by you 'in anticipation of litigation and regulatory inquiry.' Two days later the firm emails its draft findings to you and copies the company's VP of Engineering. R.T.'s personal laptop, which was used for the Dropbox sync, is at his home. The acceptable-use policy, signed at hire, authorizes monitoring of company devices and says nothing about personal devices.
1. What should you do to maximize the chance that the forensic findings and any R.T. interview stay protected, and what damage has the Slack exchange already done?
Read the worked answer
Issue. Whether the forensic work product, the interview and the Slack messages can be withheld from regulators and future plaintiffs.
Rule. Attorney-client privilege protects confidential communications between counsel and client, including communications with employees interviewed at counsel's direction about matters within the scope of their employment (Upjohn). Work product protects materials prepared in anticipation of litigation. Two limits matter here: facts are not privileged, only communications; and disclosure to a third party outside the privileged circle waives the privilege. Courts generally treat a forensic firm as inside the circle only if retained by counsel to assist the legal analysis (Kovel) rather than to perform ordinary IT remediation.
Application. The engagement letter is a good start. Copying the VP of Engineering is not: it puts a business person in the distribution chain, and a plaintiff will argue waiver. Route everything through counsel, or split the work - a non-privileged business remediation report and a privileged legal analysis that incorporates the findings by reference. The Slack exchange predates the retention, was conducted by a manager in the ordinary course, and is therefore almost certainly discoverable. It does not waive the later investigation, but the manager's 'we know you did' becomes Exhibit A for the plaintiff on pre-termination knowledge.
Action. Let outside counsel lead the interview, give an Upjohn warning, keep a privilege log, mark every document 'Privileged and Confidential - Prepared at the Direction of Counsel,' and issue a written litigation hold today.
2. The Texas attorney general's office asks for a copy of the forensic report 'informally, to assist our review.' What are your options and their consequences?
Read the worked answer
Issue. Whether producing the report to a regulator waives privilege against private litigants, and what alternatives exist.
Rule. Most US courts reject 'selective waiver': producing a privileged document to a government agency waives the privilege as to everyone else (see, e.g., In re Columbia/HCA Healthcare Litigation). A confidentiality agreement with the regulator may reduce the risk but generally does not prevent waiver as to third parties. Opinion work product - counsel's mental impressions - receives stronger protection, but the 'because of litigation' standard (In re Grand Jury, 2023) can still be lost through disclosure.
Application. The report almost certainly blends factual findings (discoverable) with counsel's analysis and remediation judgments (core work product). Handing over the whole document gives the plaintiffs' bar a roadmap and creates a credibility weapon: any later inconsistency between the report and the company's public statements will be exploited. On the other hand, cooperation with the AG's office can meaningfully reduce penalties.
Options. (1) Offer an oral briefing plus a factual report prepared by the business, not by counsel. (2) Provide the underlying data under a protective order without adopting the analysis. (3) If production is effectively compelled, log the privilege, object on the record and reserve all rights. (4) Have the board sign off on the trade-off between regulatory credit and private litigation exposure. Never produce 'informally' by email - that is still a production.
3. Can the company image or remotely wipe R.T.'s personal laptop? Analyze the available lawful routes and the risks of each.
Read the worked answer
Issue. Whether an employer may access or destroy data on an employee's personally owned device used for work.
Rule. Authority over a personal device comes from consent, contract or legal process, not from the employment relationship as such. The acceptable-use policy covers company devices; it says nothing about personal devices, so it supplies no consent. The Stored Communications Act governs providers, not an employer reading its own systems, but a personal Dropbox account is a third-party service, and unauthorized access to it risks liability under the CFAA and Texas computer-crime and privacy statutes. A remote wipe through mobile device management on a personal device can destroy evidence and invite a spoliation sanction, even if the wipe was technically authorized.
Application. R.T. is a departing employee and a likely defendant. A polite request will not produce a forensically usable image, and the company should not log into his Dropbox with credentials it was not authorized to use.
Lawful routes. (1) Issue a litigation hold today covering the laptop, Dropbox, personal email and phone, and serve a preservation demand on Dropbox. (2) Negotiate a consent agreement for imaging by a neutral examiner, with hash verification. (3) If he refuses, seek a subpoena or court order in the anticipated suit. (4) Explicitly instruct IT not to trigger any remote wipe. (5) Document the chain of custody from the first moment the device is imaged.