Legal pulls an employee’s personal email from a BYOD device into eDiscovery without a protocol separating work from private messages. What risk does this highlight?
Select an answer to reveal the explanation.
Short Explanation
Lawsuit hold is not a free pass to vacuum someone’s private inbox off a personal phone. Scope the collection, minimise what you take, and use a protocol. BYOD eDiscovery still has privacy brakes.
Full Explanation
Legal pulling an employee’s personal email from a BYOD device into eDiscovery without a protocol separating work from private messages highlights that litigation holds on BYOD still require personal-data minimisation and careful protocols so purely private content is not collected beyond necessity. Lawsuits do not create a free vacuum cleaner for private life on a personal phone. Saying any BYOD device may be fully imaged without limits once litigation is imaginable fails proportionality and minimisation. Claiming personal email on BYOD is automatically employment data with no privacy boundary fails the work/private distinction. Asserting eDiscovery always excludes GDPR considerations by special litigation privilege fails—preservation duties must still be reconciled with data-protection principles. Exam caveat: legal privilege and discovery rules vary, but EU practice still expects scoped collection, documented legal bases, and safeguards when devices mix personal and corporate data. Operational check: define BYOD collection protocols with targeted search terms, exclude obvious personal spaces where feasible, involve privacy counsel, log custodianship, and avoid blanket full-file dumps as the default.