Tennessee Ruling Shows BYOD Policy Wording Can Block Phone Discovery

A 2025 federal court decision from the Middle District of Tennessee declined to force an employer to search employees' personal phones in a trade secrets dispute, and the outcome turned almost entirely on the wording of the company's bring-your-own-device policy. For HR and legal teams, the ruling signals that policy language drafted today can determine discovery obligations in litigation tomorrow.

The case arose when a plaintiff sought to compel the employer to search the personal phones of employees who used their own devices for work under a BYOD arrangement. The court refused. It found the employer lacked the necessary control over those devices under both standards courts use to assess control under Federal Rule of Civil Procedure 34(a), according to an analysis by Baker Donelson attorneys Megan Sutton and Abby Parker Nix published by HR Daily Advisor on October 27.

What does the ruling change?

The decision does not make personal phones untouchable. It clarifies how a carefully drafted BYOD policy can defeat a request to search employee-owned devices before a court ever reaches the merits.

Under Rule 26(b)(1), a party seeking data from personal devices must first show that relevant evidence likely exists on them. Speculation is not enough. The requesting party must point to testimony, documents or metadata indicating the device probably holds responsive information.

If relevance is established, the second hurdle is control. Courts apply one of two tests:

• The legal right test: whether the employer has a legal right to obtain the information on demand through a policy, agreement or other authority.
• The practical ability test: whether the employer can obtain the information as a practical matter, even without a formal legal right.

Courts do not apply these standards uniformly. Outcomes depend on the jurisdiction, the policy language, the employer's actual practices and the facts of each case. Employers operating across multiple states should expect differing approaches.

Why did this employer prevail?

The Tennessee court focused on four specific provisions of the BYOD policy, the Baker Donelson attorneys wrote:

• Limited inspection rights. The policy allowed device inspections only to confirm compliance with information security requirements, not to access personal data.
• Company communications through company systems. Employees had to conduct business through company email accounts and approved applications. Those systems had already been searched, so no broader device search was warranted.
• Remote wipe authority. The employer's ability to remotely wipe devices in limited circumstances counted as a security measure, not as evidence of control over personal data.
• Careful definitions. The handbook's references to company property and computer systems applied to company-owned equipment, not employees' personal devices.

The court also found no evidence that the employer routinely accessed personal-device data, that employees had previously produced such data for the company, or that the employees held a personal financial stake in the litigation. Together, those facts weighed against a finding of control.

What should employers do now?

The ruling offers a roadmap, but the limits matter. A well-drafted BYOD policy may help an employer avoid a Rule 34 obligation to search employee-owned devices, yet it does not make those devices immune from discovery. Opposing parties can still seek information directly from employees through Rule 45 subpoenas, and employers should prepare for that possibility.

The attorneys recommend five practical steps:

• Adopt a clear, narrowly drafted BYOD policy that limits inspection rights to security and compliance purposes.
• Require employees to conduct business communications through company email systems and approved applications.
• Define terms such as "company property," "company data" and "company IT assets" carefully, so they do not encompass personal devices or personal data.
• Evaluate reimbursement and subsidy programs for personal devices, which may support arguments that a device functions as company equipment.
• Consider issuing company-owned devices to employees in sensitive or high-risk roles.

Policies that grant broad inspection rights over personal devices, or that define company property too expansively, may hand opposing counsel the argument that the employer controls those devices for discovery purposes. With outcomes still hinging on policy language, facts and jurisdiction, the attorneys advise reviewing BYOD policies now to avoid costly discovery disputes later.