In Episode 116, our CEO, Kelly Twigger discusses how actions taken by an employee on his company issued laptop after his termination resulted in spoliation and sanctions for failure to preserve, and what it means you need to do when an employee exits the company in McLaughlin v. Lenovo Global Tech. (U.S.) Inc.
Introduction
Welcome to this week’s episode of our Case of the Week series brought to you by eDiscovery Assistant in partnership with ACEDS. eDiscovery Assistant is a platform that helps lawyers and legal professionals leverage the power of ESI as evidence by reimagining how to conduct research for ediscovery, as well as training in ediscovery.
My name is Kelly Twigger. I am the CEO and founder at eDiscovery Assistant, as well as the principal at ESI Attorneys. Each week on our Case of the Week series, I choose a recent decision in ediscovery and talk to you about the practical implications of that judge’s ruling, what it means for you, your practice, and for your clients, and how to do the discovery of ESI better.
Unlike any other substantive area in the law, the constantly evolving landscape of technology means that trial courts, on both the federal and state level, are regularly issuing new opinions on parties’ obligations around ESI. Because the bulk of our learning in ediscovery comes through case law, diving into the details of those decisions and what our practical takeaways are is one of the best ways to understand the issues and details we need to focus on in planning and executing any discovery.
Before we dive in, if you haven’t yet had a chance to grab our 2022 Case Law Report, you can download a copy of that to see the landscape of decisions. Each of the decisions in eDiscovery Assistant is a public link, meaning that you can link to those decisions in your writing. You can also review the full text of the decision without having a subscription to log in.
Background
This week’s decision comes to us from the case of McLaughlin v. Lenovo Global Tech. (U.S.) Inc. This is a decision from July 18, 2023, written by United States Magistrate Judge Judith Dein. Judge Dein has seven decisions in our database, and as always, we tag each of the decisions in our database with our proprietary issue tagging structure. This week’s issues include exclusion of evidence, failure to produce, bad faith, spoliation, adverse inference, default judgment, metadata, and forensic examination.
Facts
We are before the Court today on a motion for sanctions for spoliation. The plaintiff, McLaughlin, was an account executive for Lenovo for about four years from 2016 until April 14th, 2020, when he was terminated. You’ll know that in April 2020, that was right when COVID started. At the time, McLaughlin worked remotely for Lenovo using a company issued laptop. At the start of his employment, McLaughlin signed an agreement to return the laptop to Lenovo at the conclusion of his employment, “whether or not it contained confidential information, including without limitation equipment, storage media, and other types of documents or property of any kind or description.”
Lenovo set up the laptop for McLaughlin so that it would automatically put any archived information from overflow of McLaughlin’s email inbox and his calendar into a PST file that would be stored directly on McLaughlin’s laptop. That .pst file was only stored locally on the laptop; it was not maintained on the company’s servers. Lenovo employees, including McLaughlin, were instructed back in 2016 to archive email from their inboxes, including calendar entries, to that .pst on the C drive of the user’s laptop.
When McLaughlin got his laptop, he used the laptop for personal work online in addition to his company work, and he partitioned the laptop to change the directory where the company data was stored from the C drive to the D drive. We don’t see a ton of relevance as to why that partitioning comes into play, except you’re going to find that when he downloaded the information from his laptop, it did not contain all of the data that should have been included, including a .pst file. Because McLaughlin used his computer for business, one of the arguments that he made was that he believed that the personal use resulted in cookies and other digital files that contained information about his private usernames and passwords being saved to the C drive of his laptop. That is one of the reasons for which McLaughlin gives for actually wiping the laptop.
After his termination, McLaughlin claimed that Lenovo owed him unpaid commissions on sales and more than a hundred thousand dollars in unpaid business expenses. He submitted those business expenses on May 11th, 2020, and they were denied the exact same day by Lenovo as untimely. The bulk of the data that McLaughlin had to support his claims for these commissions and unpaid expenses lived on his company issued laptop. Despite the company policy requiring McLaughlin to return the laptop, he did not do so and instead downloaded the entire contents of the laptop to two SD cards and then wiped the hard drive. Despite multiple demands from Lenovo after his claim was denied, he did not produce the laptop or the SD cards to Lenovo for more than a year until June 2nd, 2021.
McLaughlin’s counsel also failed to inform Lenovo on multiple occasions that the laptop had been wiped. Following production of the SD cards and the computer, Lenovo learned that McLaughlin had wiped the laptop clean. A forensic examination of the laptop showed that it had been wiped clean or contained a completely new hard drive, and Lenovo provided expert affidavits attesting to the fact that the company was, “unable to determine whether any of the documents on the SD cards belatedly returned by plaintiff were originally created on the laptop, or instead were originally Lenovo documents that plaintiffs saved onto the laptop.”
Expert forensic testimony also showed that there was no .pst file on the SD cards that might have contained the email and calendar entries that McLaughlin wanted to rely on for his claims. McLaughlin argued that all of the required discovery was produced on the SD cards and that Lenovo could reproduce the relevant emails from its servers. Lenovo denied that it had all of the information from the laptop and argued that it could not verify many of McLaughlin’s statements without the hard drive and alleged that some of the documents may have been modified after McLaughlin’s termination. It also contended that the archived files were to be kept on individual laptops and that it cannot recreate all of the correspondence. Lenovo then moved for sanctions, seeking an entry of judgment against McLaughlin, essentially a dismissal, an exclusion of evidence of any documents from the laptop or calendar to provide his unpaid commissions and expenses. If the case does go to trial, Lenovo requested an adverse inference instruction, and Lenovo also requested their attorneys’ fees and costs on the motion.
Analysis
With those facts in front of us, what is the Court’s analysis here? The Court begins by stating that, “The record is clear that the plaintiff improperly wiped the company’s computer and then provided constantly evolving explanations for his action without ever persuasively explaining why he did not return the company’s computer with the information contained thereon as he was contractually required to do. What is less clear is the scope of the harm his actions caused.”
The first question that the Court looks to under Rule 37 is whether the duty to preserve had been triggered when McLaughlin wiped his laptop shortly after his termination on April 14th, 2020, but before he submitted his claims to Lenovo on May 11th. McLaughlin argued that he did not know that there would be a dispute about the unpaid monies until May 11th when the claims were denied by Lenovo and that he had already wiped the laptop at that point. But the Court looked at Lenovo’s policy requiring reimbursements to be posted within five days, and that McLaughlin was seeking payments going back for three years, and rejected the notion that McLaughlin was not aware of the possibility of litigation with Lenovo on May 11th, 2020. As such, the Court found that the duty to preserve was triggered on May 11, 2020, and that McLaughlin may have triggered that duty even earlier.
The Court then looks to what information Lenovo does have in terms of what prejudice was undertaken by Lenovo. The parties have agreed that metadata on the documents on the SD cards included what is called “internal metadata”, which included the creation date, the last modified date, the author, and who last edited the document, and when it was printed. But that “external metadata”, which would have included the creation date and the last accessed date, had been lost. Lenovo argued that the loss of the “external metadata” prevented it from determining when a file was originally created on a source device and when the file was last accessed prior to copying. A lot of that’s going to be important because we’re talking about individual business expenses. We need to know when those expenses were incurred, on what dates and what the backup information is for them. That’s why that metadata is important.
Because McLaughlin wiped the laptop, Lenovo could not determine what, if anything, was on the laptop before it was erased, and whether there were materials deleted before the download. McLaughlin has not provided proof of any download prior to June 2, 2021, and did not provided any copies of data that resided on the C drive. According to the company, the C drive is where the emails and the calendar entries should have been located because of the way the computer was set up prior to being issued to McLaughlin. But when McLaughlin produced a purported copy of the D drive, it did not contain the calendar, which left it open to question of whether or not those emails and calendar entries were on the C drive or the D drive. Again, remember that McLaughlin said he partitioned to the computer so that that .pst folder would be included on the D drive. He did not want to produce the C drive because he felt there was personal information there that would be disclosed to Lenovo.
Based on all that information, though, the Court found that Lenovo had established that there may have been materials destroyed by wiping the laptop clean. The Court also found that McLaughlin acted with intent in wiping the computer’s hard drive without permission, that he provided disingenuous explanations for his actions to the company, and he made it impossible for the company to determine whether there had been additional information on the laptop before the contents were downloaded onto the SD cards. The very fact that the company had to engage in forensic examination of the computer, much less three of them, and all of the resulting confusion were all caused by McLaughlin’s improper actions. According to the Court, Lenovo met its burden of showing spoliation, and the Court rejected McLaughlin’s argument that the wiping of the drive was negligent and that even if it had been negligent, negligence was still sufficient to find spoliation here. The Court also found that Lenovo had established McLaughlin’s intent to deprive Lenovo of the information, thereby qualifying for the heightened sanctions under Rule 37(e)(2).
According to the Court, “there is no question that McLaughlin intentionally destroyed the content of the hard drive of the laptop with full knowledge that the laptop and the content thereon belong to Lenovo. He was advised immediately upon the termination of his employment to return the laptop, instead, he wiped it clean.”
With all of that information, the Court entered the following holding — It precluded reliance on any calendar entries by McLaughlin to support his request for commissions and expenses that were not on the Outlook calendar in Lenovo’s system, which means that it specifically excluded any calendar entries he allegedly downloaded onto an SD card because those were not provided to Lenovo. The Court also required McLaughlin to reimburse Lenovo for the cost of its three forensic examinations of the laptop. The Court declined to exclude emails located on the SD cards as there was no evidence that McLaughlin had fabricated any evidence. Recall that Lenovo had made that argument at the start, but there was simply nothing to suggest that McLaughlin had fabricated those emails that did exist on the SD cards, so the Court allowed those into evidence.
The Court did order an adverse inference instruction to the jury that McLaughlin wiped the laptop before it was returned to the company, making it impossible for the company to determine if there were additional materials on the laptop which had not been downloaded onto the SD cards provided by McLaughlin, and that the jury may, but need not, infer that the contents of documents that were erased from the laptop and not otherwise produced were unfavorable to McLaughlin. In addition to that adverse inference instruction, the Court declined to require McLaughlin to pay all of Lenovo costs because it felt that that Lenovo learned additional information that was available to it after filing the motion for sanctions.
Takeaways
It’s really important to remember the context of timing of when we’re talking about, as well as the technology implications. This case is about data that was created by an employee from 2016 to 2020. At that time, Lenovo was requiring remote workers to store archived emails and calendar entries on their local laptops that were at their home offices in a .pst file. Following the pandemic, that practice of allowing employees to store local .pst files is not nearly as widespread as it was. Many companies and organizations have made substantial efforts to move to more cloud-based applications that preclude storing data in .pst folders on desktops and laptop computers.
Quite frankly, moving to Microsoft Teams, Outlook email, Google Mail or some other email service now allows you to store a lot more email in the cloud than you could store locally in inboxes. Previous technologies limited the capacity of a user’s inbox. You had limits on a user’s inbox, and when the user reached those limits, they had to move that information somewhere else. Most of the time it was moved into local stored .pst files. For purposes of discovery, we had to go to the individual user and grab those .pst folders. Since companies have transitioned to using cloud-based applications, we no longer have to go and find those local .pst from users if companies are not allowing them. That’s a big change in technology that would impact how this case would be determined differently because the information wouldn’t have resided just locally on the laptop, it would have been on the company servers.
If your company is still having employee stored data locally, this case is one that you’re going to want to pay attention to. Lenovo had all the right policies in place and demanded the return of the laptop following McLaughlin’s termination, he just didn’t do it. There’s not a lot of company can do in that instance, short of physically showing up and demanding the computer back. Here, McLaughlin appears that it would have already been wiped even if they had shown up, but there’s no way to tell when that action was taken.
Exit strategy is key with remote employees maintaining company data to the extent you are allowing your remote employees to keep company data on their individual laptops. You do need a process in place for handling that. A procedure and process for returning data is going to be very key in today’s climate.
The Court’s analysis here as to sanctions under Rule 37 is pretty clear. Lenovo showed spoliation, intent, and prejudice. The Court declined, however, as we’ve seen and discussed on Case of the Week, to issue the ultimate sanction of dismissal, but the sanctions of excluding the evidence of calendar entries and adverse inference will hinder McLaughlin’s case dramatically.
This case does bring about one important point, and it is very demonstrative of the increased need for lawyers to understand technology or to hire experts that do. The key here was the lost external metadata when McLaughlin downloaded the data from the hard drive to the SD cards, and it took three separate forensic examinations to understand what was lost. That’s an expensive investment for Lenovo on this litigation that seems likely to be valued at less than a couple hundred thousand dollars for unpaid commissions and expenses.
Conclusion
That’s our Case of the Week for this week. Thank you so much for joining me. We’re back again next week with another decision from our eDiscovery Assistant database. As always, if you have a suggestion for a case to be covered on Case of the Week, drop me a line. If you’d like to receive the Case of the Week delivered directly to your inbox via our weekly newsletter, you can sign up on our blog. If you’re interested in doing a free trial of our case law and resource database, you can sign up to get started.
Thanks so much, and have a great week.
