Written by Matthew Rasmussen, Founder, CEO & President
A former CEO asserted privilege over 1,355 documents pulled from his company-issued devices and iCloud accounts. The court rejected the claim. He had not broken any rule. The employee handbook permitted personal use of company systems, and there was no evidence the company had ever monitored anyone. He lost because the handbook said users had no legitimate expectation of privacy on company systems, he had signed an agreement to follow company policy, and the court found he knew or should have known what that policy said.
That is U.S.A. v. Chu, decided in the Southern District of New York on September 16, 2026, and summarized by Michael Berman at E-Discovery LLC. Berman is right that the decision does not break new ground. That is exactly why it matters. Courts have been applying this analysis for two decades, and organizations keep arriving at it unprepared.
The part worth sitting with is not that the company won access. It is what the company, and every organization reading this, is supposed to do with that access once it has it.
What the court actually looked at
The Chu court applied four questions that courts in the Second Circuit have used since In re Asia Global Crossing to decide whether an employee can reasonably expect privacy in personal communications on an employer system:
- Does the company have a policy banning personal use?
- Does the company actually monitor employee use of its systems?
- Do third parties have a right to access the systems?
- Did the company notify the employee of its use and monitoring policies, or was the employee otherwise aware of them?
Two of those questions cut in the CEO’s favor. Personal use was allowed, and nobody was monitoring. He lost anyway, because the policy spelled out specific reasons the company could retrieve communications without notice, including compliance with legal and regulatory requests, and because he had signed on to that policy. The court also noted that he had once negotiated a narrower search during an internal review, which proved he knew his personal communications on company systems could be reached.
Policy language, not monitoring practice, decided the outcome.
For legal, compliance, and IT teams, the lesson on the policy side is simple. A clear, specific use-and-access policy that employees acknowledge does real work in front of a judge. A vague one, or one nobody can prove the employee saw, does not.
Winning access is where the trouble starts
Here is the problem. The right to reach a device is not the same as a reason to take everything on it, and the two get confused constantly.
When an organization establishes broad access rights and then runs a full-image or untargeted collection, it pulls in precisely the material most likely to generate a fight: personal messages, family photos, medical and financial content, and conversations with personal counsel. Even when the organization will ultimately win the privacy argument, as Tricolor did, it has now taken custody of thousands of records it never needed, each one a potential privilege log entry, a privacy objection, or a motion to compel in reverse. Winning the right to the data and then litigating over data that was never relevant is not a victory. It is a cost center with a court date.
Policy should decide whether the organization can reach the device. The matter should decide what it actually collects. Those are two different decisions, made at two different times, usually by two different people, and the second one is where defensibility is really earned.
Smartphones make this harder than laptops ever did
The Chu case involved corporate devices and accounts. The harder version of this problem lives on smartphones, and especially on BYOD phones that are not company hardware at all.
A single phone blends corporate messaging, personal texts, photos, location history, and privileged conversations in one place. A custodian who texts about a deal in one thread and their divorce attorney in another has a credible legal argument that the second thread stays out of discovery, and an even stronger one when the phone belongs to them personally. The business thread is unquestionably relevant. The difference between the two threads is not a policy question. It is a scoping question, and a full device image answers it the wrong way by taking both.
This is also where custodian cooperation becomes part of defensibility. Ask someone to surrender a personal phone for a week and you get resistance, delay, and sometimes a lawyer on the other side. Ask for a scoped collection of named apps, participants, and date ranges, collected remotely while they keep their device, and you get cooperation and a cleaner record of what was taken and why.
Four questions to ask before anyone touches a device
The Asia Global factors are a test for privacy expectations. They also map almost exactly onto the questions a legal team should answer before scoping any mobile collection:
- What does the policy actually permit, and did this custodian acknowledge it? This settles the access question. It does not settle scope.
- Is the device corporate-issued or BYOD? A personal phone raises the bar on both the legal basis for access and the proportionality of what gets collected.
- What does the matter require? Which custodians, which apps, which participants, which date ranges. If the answer is “everything,” the scoping conversation has not happened yet.
- What is the plan for privileged and personal content you can predict will be there? Excluding a known personal counsel thread at collection is far cheaper than logging and fighting over it at review.
Answering those four questions up front is what turns an access right into a defensible collection. Skipping them is how a clean policy win turns into a 1,355-document privilege dispute.
Where the line sits
Berman’s practical recommendation is a middle-of-the-road policy: allow routine personal use on company devices, but prohibit privileged or confidential personal communications such as legal, medical, or accounting matters. That is sound policy, and organizations that do not have language like that in place should add it.
Real people in real meetings are still going to text their spouse from a company phone, and some of them will text their lawyer. The policy sets the boundary. Scoping is what makes the boundary hold up in practice.
The defensible position is both halves together: clear use-and-access policies that preserve the organization’s legal right to reach the data, paired with targeted collection by custodian, app, date range, and conversation that takes only what the matter requires. Organizations that get both right keep the access they need and avoid the disputes they do not.
Does your access policy do the work your collection scope should be doing? If you are not sure where that line sits in your own investigations, the Internal Investigations Playbook: Mobile Evidence Edition walks through how to scope mobile collections so they hold up.