Yu Yu Lim v. Expel, Inc.; Does 1 Through 25

Opinion

YU YU LIM, Case No.: 3:24-cv-02284-W-AHG Plaintiff, ORDER RESOLVING JOINT MOTION FOR DETERMINATION v. OF DISCOVERY DISPUTE AND EXPEL, INC.; DOES 1 THROUGH 25, GRANTING IN PART MOTION FOR PROTECTIVE ORDER Defendants.

[ECF No. 18]

Before the Court is the parties’ Joint Motion Regarding Protective Order. ECF No. 18. Plaintiff Yu Yu Lim (“Lim”) seeks a protective order: 1) preventing the review and disclosure of data associated with her personal email address (“personal email data”); 2) requiring Defendant to return the personal email data and confirm that all copies of the data and any forensic logs relating to the data have been destroyed; and 3) appointing a digital forensic expert to ensure the personal email data has been returned and deleted. Id. Defendant Expel, Inc., (“Expel”) objects to the request for a protective order, arguing that because the personal email data was stored on a laptop owned by Expel, Plaintiff waived any privacy rights associated with the data. Id. For the reasons set forth below, the protective order is GRANTED in part. Plaintiff brought this lawsuit against her former employer alleging race discrimination, retaliation, and wrongful termination. Lim worked for Expel as a Senior Governance Risk Compliance and Privacy Analyst for approximately 18 months. The instant dispute concerns Expel’s request to review personal email data that Defendant found on Lim’s company-issued laptop after her termination. During her employment, Expel issued a laptop to Lim for work purposes. ECF No. 18-3 at 2. In June 2022, Lim added her personal Gmail account to the Mail account on the laptop. ECF No. 18-7 at 2. This allowed Lim to access her personal email account from the laptop. Id. Expel’s Employee Handbook allows employees to use company-issued equipment for incidental personal purposes: Company property refers to anything owned by Expel: physical, electronic, intellectual, or otherwise. Employees may use Company property only for business purposes. You may use Company property for incidental personal reasons only if this use doesn’t: interfere with others’ ability to work, place undue burden on Expel, or violate confidentiality . . . [A]t all times, equipment assigned to you remains the property of Expel, and is subject to reassignment or use by Expel without your prior notice or approval. This includes without limitation computer equipment and data stored thereon, voicemail, records, and employee files. ECF No. 18-4 at 5 (emphasis added). Lim believed that her personal email account was “password-protected and separate from any work platform.” ECF No. 18-3 at 2. The personal email data—spanning more than 15 years—includes sensitive, private information such as attorney-client communications, medical and financial records, and home security images, some depicting her minor children. ECF Nos. 18-2 at 4; 18-3 at 2. When Expel terminated Lim’s employment in 2023, it immediately revoked her access to the laptop. ECF No. 18-3 at 2. Lim asked for the opportunity to retrieve personal files from the laptop, but Expel told her that was not possible and that her laptop would be “wiped” and restored to factory settings. ECF No. 18-6 at 3. Expel’s General Counsel confirmed in a declaration that although the standard company practice is to wipe a laptop for reuse by another employee, Expel retained the laptop because Lim had made allegations of retaliation. ECF No. 18-9 at 2. There is no indication that Lim was aware that the personal email data existed on the laptop, or that Expel continued to retain it on the laptop, until this dispute arose.1 In March 2025, Expel sent the laptop to a forensic consultant, Control Risks, for examination in connection with this action. ECF No. 18-7 at 2. Control Risks “discovered numerous emails had been downloaded from Ms. Lim’s Google email (“gmail”) account and stored on the company laptop’s hard drive.” Id. Control Risks has limited its review of the personal email data to date/time stamps and sender/receiver information. Id. at 3. It has not reviewed the contents of the personal email data and has not shared the personal email data or associated metadata with Expel’s counsel. Id. The Court held a discovery conference on June 27, 2025, and issued a briefing schedule. ECF Nos. 16-17. The parties filed a Joint Motion for Protective Order (“Joint Motion”) on August 4, 2025. ECF No. 18. The Court took the matter under submission without oral argument. This order follows. Lim seeks a protective order prohibiting Expel from reviewing the personal email data, requiring its deletion, and ordering the appointment of a forensic expert to ensure compliance. ECF No. 18 at 2. Lim asserts that she did not waive any rights to privacy or privilege related to the personal email data because Expel’s policy allowed her to use the laptop for personal matters, did not explicitly state that personal email data on the laptop

1 Lim’s request to retrieve personal files from the laptop appears to be related to specific would become the property of Expel, and did not notify employees that personal email data could be monitored by the company. Lim further contends that to the extent Expel’s policies are ambiguous, they should be construed in her favor. Expel argues that it has the right to review the personal email data in its entirety to ascertain whether it contains relevant information because Plaintiff waived any right to privacy or privilege by storing the data on a company-owned laptop. Id. at 26 (“[A]s Defendant is already physically in possession of the emails in question, simply permitting Defendant to review them is proportional to the needs of the case.”) (emphasis in original). Expel does not propose any alternative procedures that would allow Plaintiff to review the data in the first instance to ensure that only information pertaining to her claims would be produced and reviewed by Expel. Instead, Expel contends that requiring Defendant to perform a “lengthy and costly ESI search” of the personal email data to identify relevant material would not be workable. Id. The only restriction Expel concedes as to its use of the personal email data is that it can be labeled under the existing protective order as “Confidential.” A federal court exercising diversity jurisdiction applies state law to questions of privilege, including those involving the privilege of privacy. See Liew v. Breen, 640 F.2d 1046, 1049 (9th Cir. 1981); see also Fed. R. Evid. 501 (“[I]n a civil case, state law governs privilege regarding a claim or defense for which state law supplies the rule of decision.”). Under Article I, Section I of the California Constitution, the right to privacy protects individuals from “business interests . . . collecting and stockpiling unnecessary information . . . and from misusing information . . . to serve other purposes or to embarrass us.” Cal. Const., art. I, § 1; Hill v. Nat'l Collegiate Athletic Assn., 865 P.2d 633, 642 (1994). When a discovery request implicates this constitutional right, a court may not compel disclosure “simply upon a showing that the [] test for relevance has been met.” Williams v. Superior Ct., 398 P.3d 69, 86 (2017). To establish a prima facie privacy claim, the party asserting protection must show: (1) a legally protected privacy interest, (2) an objectively reasonable expectation of privacy under the circumstances, and (3) a threatened intrusion that is serious. Id. at 84 (citing Hill, 865 P.2d at 633). California recognizes two categories of privacy interests: informational privacy, which safeguards sensitive and confidential information, and autonomy privacy, which protects personal decision-making and intimate activities. Id. at 654. “Information is private when [] social norms recognize the need to maximize individual control over its dissemination and use to prevent unjustified embarrassment or indignity. Id. “Such norms create a threshold reasonable expectation of privacy in the data at issue.” Id. The party seeking disclosure must then demonstrate countervailing interests sufficient to justify intrusion. Williams, 398 P.3d at 84 (citing Hill, 865 P.2d at 633). To uphold the right to privacy, the Federal Rules authorize courts, for good cause, to “issue an order to protect a party from annoyance, embarrassment, oppression, or undue burden.” FED. R. CIV. P. 26(c)(1)(A). To show good cause, the moving party must demonstrate specific prejudice or harm that would result absent protection. Phillips ex rel. Estates of Byrd v. Gen. Motors Corp., 307 F.3d 1206, 1210–11 (9th Cir. 2002). “The court has wide discretion to determine what constitutes a showing of good cause and to fashion a protective order that provides the appropriate degree of protection.” Grano v. Sodexo Mgmt., 335 F.R.D. 411, 414 (S.D. Cal. 2020); see Seattle Times Co. v. Rhinehart, 467 U.S. 20, 36 (1984) (interpreting Rule 26(c) as conferring “broad discretion on the trial court to decide when a protective order is appropriate and what degree of protection is required.”). The central question before the Court is whether Expel’s proposed review of the personal email data would violate Lim’s constitutional right to privacy. The Court applies the three-pronged test set forth in Hill to determine whether Lim has established a prima facie case of invasion of privacy. 865 P.2d at 654. // // A. Legally Protected Privacy Interest Lim possesses a legally protected privacy interest in the personal email data. The data includes financial records, medical information, and home security images—core categories of information recognized as protected by California’s constitutional and common law right to privacy. See id. (medical information); City of Carmel-By-The-Sea v. Young, 466 P.2d 225 (1970) (personal finances); Valley Bank of Nevada v. Superior Ct., 542 P.2d 977 (1975) (personal finances and private life details); Pettus v. Cole, 49 Cal. App. 4th 402, 409 (1996) (medical and psychiatric history); Hernandez v. Hillsides, Inc., 211 P.3d 1063, 1072–73 (2009) (autonomy and freedom from observation into one’s personal activities). B. Objectively Reasonable Expectation of Privacy Lim has an objectively reasonable expectation of privacy in the personal email data. Lim did not waive her right to privacy by accessing her personal email account on a company-owned laptop.2 Expel’s policy expressly allows use of company-issued equipment, such as the laptop, for incidental personal purposes. ECF No. 18-4 at 5. The policy does not state that Expel has the right to review personal data on the laptop. Although the policy states that data stored on the laptop belongs to Expel, the language is at best ambiguous as to personal data, and that ambiguity must be construed against Expel.3 See Cal. Civ. Code § 1654; Restatement (Second) of Contracts § 206 (1981); Sandquist v. Lebo Auto., Inc., 376 P.3d 506, 514 (2016) (“To the extent that omission creates any 2 It is not clear whether Lim understood that by accessing her Gmail account through her work Mail account, she would be creating a copy of her entire email file on the work laptop. 3 Expel also required Lim to sign a Proprietary Information and Inventions Agreement that provides that company-owned equipment “is subject to inspection by Company personnel at any time with or without notice.” ECF No. 18-5 at 4. This language does not negate Lim’s reasonable expectation of privacy for the reasons discussed herein. It is not specific to personal data; instead, its purpose is to ensure that employees do not misuse Expel’s ambiguity, [Defendants] [] drafted an ambiguous document and . . . cannot now claim that benefit of the doubt.”) (internal quotations omitted). A reasonable reading of the policy is that it is designed to ensure that the company retains ownership of company data at all times and that employees cannot retain or use company data for their own personal purposes. Reading the policy otherwise would lead to the absurd result suggested by Expel here: that Expel is entitled to peruse more than 15 years of Lim’s highly personal and confidential information, including communications with her attorneys, without any restrictions. Expel told Lim she could store this information on the laptop for incidental personal use, but it never told her she could face such dire consequences to her privacy or her ability to retain the attorney-client privilege by doing so. The cases relied on by Expel do not support its position. Instead, they underscore the lack of notice to Lim in Expel’s policy and the inequity of allowing Expel to exploit the ambiguity of that policy. In Holmes v. Petrovich Dev. Co., 191 Cal. App. 4th 1047, 1068 (2011), the court held that the plaintiff waived the attorney-client privilege by sending emails to her attorney from a company-owned computer. Id. at 1051. Unlike Expel, the company in Holmes had a written policy prohibiting use of its computers for personal reasons. Id. The Holmes policy also stated that employees would not have any right to privacy in any “personal information or messages” that were stored on company computers, and that the company would monitor computers to ensure compliance. Id. The court found that this policy foreclosed any possibility that the plaintiff could retain a reasonable expectation of privacy in emails she sent to her attorney using a company computer. Id. at 1069. Similarly, in TBG Ins. Servs. Corp. v. Superior Court, 96 Cal. App. 4th 443 (2002), the court found that an employee waived his right to privacy in data stored on a company- owned computer when he used the computer in violation of company policy. Id. at 446. The employee’s policy prohibited personal use of the computer, stated that use of the computer would be monitored, and provided that information transmitted from the computer would not be private. Id. The employee could not claim a reasonable expectation of privacy in information on the computer in light of that express policy. Id. Holmes and TBG are easily distinguished. Expel’s policy is the opposite of the policies at issue in those cases. Expel does not prohibit use of company computers for personal purposes. It expressly allows it. Permitting employees to use company-owned devices does not diminish their expectation of privacy; it increases it. See Mintz v. Mark Bartelstein & Assocs., 885 F. Supp. 2d 987, 997 (C.D. Cal. 2012) (“The fact that [the employer] was aware of and permitted [the employee] to make personal calls increased [the employee’s] expectation of privacy because he could reasonably believe that he had [the employer’s] approval to use the phone for personal reasons.”); see also Militello v. VFARM 1509, 89 Cal. App. 5th 602, 616 (2023) (holding that an employer’s general right to inspect corporate records did not negate an employee’s reasonable expectation of privacy “absent a specific policy concerning individual e-mail accounts.”). The Court declines to extend the holdings of Holmes and TBG here because Expel’s policy did not provide comparable or clear notice regarding the potential consequences of incidental personal use of a company-owned laptop. Lim retained an objectively reasonable expectation of privacy in the personal email data, even though it was stored on Expel’s laptop. C. Serious Intrusion The Court also finds that the intrusion suggested by Expel—its unrestricted review of the personal email data—is profoundly serious in its scope and potential impact. Hill, 865 P.2d at 655. The data contains highly private information, including medical and financial records and home security images depicting minors. Expel’s position is unreasonable in the extreme. Expel admits that its practice is to wipe a former employee’s laptop upon termination for reuse by another employee. ECF No. 18-9 at 2. In the normal course, if Lim had not expressed a concern regarding retaliation by Expel, Expel would have deleted the personal email data in 2023. Expel’s only possible interest in the personal email data is limited to the extent it relates to Lim’s claims. Such a radical intrusion is not necessary or proportional here. The Federal Rules set clear limits on discovery, prohibiting unrestricted access to information in the mere hope of finding evidence. FED. R. CIV. P. 26(b)(2)(C)(i); Doherty, 2017 WL 1885677, at *2 (noting the “ultimate and necessary boundaries” of discovery); Rivera v. NIBCO, Inc., 364 F.3d 1057, 1072 (9th Cir. 2004) (“District courts need not condone the use of discovery to engage in ‘fishing expedition[s]’”). Expel’s request to review data spanning more than fifteen years—nearly ten times the length of her employment with Expel and beginning more than a decade before her start date—is patently unreasonable and overbroad. See FED. R. CIV. P. 26(g)(1)(B) (by signing the discovery request, the party certifies that it is reasonable and not made for any improper purpose, such as to harass a party); Hall, 2021 WL 3419370, at *5 (denying motion to compel where the request was overbroad). Moreover, because the parties have already had eight months to conduct fact discovery, permitting Expel to review the personal email data would likely yield diminishing returns. ECF Nos. 10, 22; Updike v. Clackamas County, No. 3:15-CV-00723-SI, 2016 WL 111424, at *1 (D. Or. Jan. 11, 2016) (“At some point, discovery yields only diminishing returns and increasing expenses . . . As more discovery is taken, the greater the delay in resolving the dispute. Finding a just and appropriate balance is the goal, and it is one of the key responsibilities of the court.”). Finally, the existing protective order (ECF No. 14) does not adequately safeguard Lim’s privacy interests. Labeling the personal email data “confidential” does nothing to offset the harm to privacy caused by allowing an adverse third party to comb through more than a decade of personal information that is of remote relevance, at best, given that so much of the data was created even before Expel hired Lim. D. Less Intrusive Measures Expel has a legitimate interest in obtaining relevant discovery, but there are less intrusive methods for doing so than allowing Expel unfettered review of the personal email data. Expel can, and indeed has, already used traditional discovery methods to obtain relevant information to prepare its case. See FED. R. CIV. P. 26(b)(2)(C)(i). For example, in connection with Lim’s claim for emotional distress damages, Expel served interrogatories asking Lim to identify each mental or physical condition allegedly caused or aggravated by Expel (ROG 8). ECF No. 18-12 at 13-14. Lim’s response included dates, medical providers, conditions, and/or diagnoses. Id. Similarly, Expel requested that Lim identify all health care providers who treated her for any alleged emotional distress, pain and suffering, or other non-pecuniary harm (ROG 9). Id. at 14. Lim responded with a list of health care providers and dates of corresponding visits. Id. at 14-15. With respect to Lim’s claimed economic damages and mitigation efforts, Expel requested that Lim identify: (1) the nature and factual basis of her damages, (2) all sources of income from January 2012 to the present, (3) each employer or potential employer to whom she applied for work from May 31, 2022 to the date of her response, (4) for any jobs she applied to, whether she received an offer, the related compensation, and any reasons she turned down an offer, (5) all persons or entities for whom she performed work as an independent contractor or through self-employment since May 31, 2022, (6) all efforts she made to mitigate damages; and (7) any other sources of income or benefits received, including the amounts and payors (ROGS 1-7). Id. at 3-13. Lim responded with the amounts of her lost wages and benefits, the factual basis for these amounts, a list of employers and corresponding salaries since 2011, a list of more than 20 companies and corresponding roles she has applied to since the termination, and unemployment income she has received since her termination. Id. Likewise, with respect to Lim’s statements to or about witnesses (ROG 12), Lim identified more than 40 individuals whom she believes have, or may have, knowledge of facts relevant to the underlying complaint. Id. at 17-18. Once more, with respect to Lim’s potentially similar claims of other employers, Expel requested all federal, state, and/or agency claims made by Lim since January 1, 2012 (ROG 13), and Lim responded with details on a worker’s compensation case (filed in 2014), a fair employment and housing case claim related to Sarbanes Oxley (filed in 2019), and a wage claim with the California Labor Commissioner’s Office (filed in 2022). Id. at 18-19.4 Expel also had the opportunity to obtain relevant information through depositions. See Lee v. Stonebridge Life Ins. Co., No. 11-CV-43 RS (JSC), 2013 WL 3889209, at *1-2 (N.D. Cal. July 30, 2013) (denying motion to compel access to a personal computer given Rule 26(b)(2)(C)'s limitation on unduly burdensome discovery and because the plaintiff had already produced considerable data); see also Allen v. Superior Court, 151 Cal.App.3d 447, 449 (Ct. App. 1984) (holding that the trial court abused its discretion when it failed to require less intrusive discovery, such as a deposition without production of records). And, Expel served more than 50 subpoenas on Lim’s past and prospective employers and her medical and health providers. Email to Chambers (Sept. 10, 2025, 4:52 P.M.). Thus, existing discovery tools have provided Expel ample opportunity to obtain relevant discovery without unnecessarily subverting Lim’s privacy rights. Because the Court finds that Lim did not waive her constitutional right to privacy in the personal email data, the Court need not reach Expel’s other arguments. The Court therefore GRANTS the motion for protective order in part. ECF No. 18. Given the representations made by Control Risks under penalty of perjury that it has not shared the content of the personal email data or the metadata associated with it with Expel or its counsel, the Court need not order the immediate deletion of the personal email data or appointment of an independent forensic examiner. Instead, the Court will ORDER as follows:

4 Expel served Lim with a Request for Admissions and Request for Production of Documents (Set One), to which Lim responded on June 27, 2025, and provided a supplemental response on August 27, 2025. Expel then served a second Request for Production, and Lim responded on August 27, 2025. On August 29, 2025, Lim produced a substantial set of documents (Bates-stamped PLT000481-PLT008220), followed by a 1. Neither Expel nor Control Risks may access or review the personal email data without the Court’s advance authorization upon a showing of good cause. 2. Within thirty (30) days following termination of this action, including any appeals, Expel and Control Risks must delete the personal email data, including any copies thereof, and certify in writing to Lim’s counsel that they have done so. Dated: December 1, 2025 J doen tH. ovo UV — Honorable Allison H. Goddard United States Magistrate Judge