1 2 3 4 5 6 7 8 9 UNITED STATES DISTRICT COURT 10 SOUTHERN DISTRICT OF CALIFORNIA 11 12 YU YU LIM, Case No.: 3:24-cv-02284-W-AHG 13 Plaintiff, ORDER RESOLVING JOINT

MOTION FOR DETERMINATION

14 v.

OF DISCOVERY DISPUTE AND

15 EXPEL, INC.; DOES 1 THROUGH 25, GRANTING IN PART MOTION FOR

PROTECTIVE ORDER

16 Defendants.

17 [ECF No. 18] 18

19

20 21 22 Before the Court is the parties’ Joint Motion Regarding Protective Order. ECF No. 23 18. Plaintiff Yu Yu Lim (“Lim”) seeks a protective order: 1) preventing the review and 24 disclosure of data associated with her personal email address (“personal email data”); 25 2) requiring Defendant to return the personal email data and confirm that all copies of the 26 data and any forensic logs relating to the data have been destroyed; and 3) appointing a 27 digital forensic expert to ensure the personal email data has been returned and deleted. Id. 28 1 Defendant Expel, Inc., (“Expel”) objects to the request for a protective order, arguing that 2 because the personal email data was stored on a laptop owned by Expel, Plaintiff waived 3 any privacy rights associated with the data. Id. For the reasons set forth below, the 4 protective order is GRANTED in part. 5 I. BACKGROUND 6 Plaintiff brought this lawsuit against her former employer alleging race 7 discrimination, retaliation, and wrongful termination. Lim worked for Expel as a Senior 8 Governance Risk Compliance and Privacy Analyst for approximately 18 months. The 9 instant dispute concerns Expel’s request to review personal email data that Defendant 10 found on Lim’s company-issued laptop after her termination. 11 During her employment, Expel issued a laptop to Lim for work purposes. ECF No. 12 18-3 at 2. In June 2022, Lim added her personal Gmail account to the Mail account on the 13 laptop. ECF No. 18-7 at 2. This allowed Lim to access her personal email account from the 14 laptop. Id. Expel’s Employee Handbook allows employees to use company-issued 15 equipment for incidental personal purposes: 16 Company property refers to anything owned by Expel: physical, electronic, intellectual, or otherwise. Employees may use Company property only for 17 business purposes. You may use Company property for incidental personal 18 reasons only if this use doesn’t: interfere with others’ ability to work, place undue burden on Expel, or violate confidentiality . . . [A]t all times, equipment 19 assigned to you remains the property of Expel, and is subject to reassignment 20 or use by Expel without your prior notice or approval. This includes without limitation computer equipment and data stored thereon, voicemail, records, 21 and employee files. 22 ECF No. 18-4 at 5 (emphasis added). Lim believed that her personal email account was 23 “password-protected and separate from any work platform.” ECF No. 18-3 at 2. The 24 personal email data—spanning more than 15 years—includes sensitive, private 25 information such as attorney-client communications, medical and financial records, and 26 home security images, some depicting her minor children. ECF Nos. 18-2 at 4; 18-3 at 2. 27 When Expel terminated Lim’s employment in 2023, it immediately revoked her 28 1 access to the laptop. ECF No. 18-3 at 2. Lim asked for the opportunity to retrieve personal 2 files from the laptop, but Expel told her that was not possible and that her laptop would be 3 “wiped” and restored to factory settings. ECF No. 18-6 at 3. Expel’s General Counsel 4 confirmed in a declaration that although the standard company practice is to wipe a laptop 5 for reuse by another employee, Expel retained the laptop because Lim had made allegations 6 of retaliation. ECF No. 18-9 at 2. There is no indication that Lim was aware that the 7 personal email data existed on the laptop, or that Expel continued to retain it on the laptop, 8 until this dispute arose.1 9 In March 2025, Expel sent the laptop to a forensic consultant, Control Risks, for 10 examination in connection with this action. ECF No. 18-7 at 2. Control Risks “discovered 11 numerous emails had been downloaded from Ms. Lim’s Google email (“gmail”) account 12 and stored on the company laptop’s hard drive.” Id. Control Risks has limited its review of 13 the personal email data to date/time stamps and sender/receiver information. Id. at 3. It has 14 not reviewed the contents of the personal email data and has not shared the personal email 15 data or associated metadata with Expel’s counsel. Id. 16 The Court held a discovery conference on June 27, 2025, and issued a briefing 17 schedule. ECF Nos. 16-17. The parties filed a Joint Motion for Protective Order 18 (“Joint Motion”) on August 4, 2025. ECF No. 18. The Court took the matter under 19 submission without oral argument. This order follows. 20 II. PARTIES’ POSITIONS 21 Lim seeks a protective order prohibiting Expel from reviewing the personal email 22 data, requiring its deletion, and ordering the appointment of a forensic expert to ensure 23 compliance. ECF No. 18 at 2. Lim asserts that she did not waive any rights to privacy or 24 privilege related to the personal email data because Expel’s policy allowed her to use the 25 laptop for personal matters, did not explicitly state that personal email data on the laptop 26

27 1 Lim’s request to retrieve personal files from the laptop appears to be related to specific 28 1 would become the property of Expel, and did not notify employees that personal email data 2 could be monitored by the company. Lim further contends that to the extent Expel’s 3 policies are ambiguous, they should be construed in her favor. 4 Expel argues that it has the right to review the personal email data in its entirety to 5 ascertain whether it contains relevant information because Plaintiff waived any right to 6 privacy or privilege by storing the data on a company-owned laptop. Id. at 26 (“[A]s 7 Defendant is already physically in possession of the emails in question, simply permitting 8 Defendant to review them is proportional to the needs of the case.”) (emphasis in original). 9 Expel does not propose any alternative procedures that would allow Plaintiff to review the 10 data in the first instance to ensure that only information pertaining to her claims would be 11 produced and reviewed by Expel. Instead, Expel contends that requiring Defendant to 12 perform a “lengthy and costly ESI search” of the personal email data to identify relevant 13 material would not be workable. Id. The only restriction Expel concedes as to its use of the 14 personal email data is that it can be labeled under the existing protective order as 15 “Confidential.” 16 III. LEGAL STANDARD 17 A federal court exercising diversity jurisdiction applies state law to questions of 18 privilege, including those involving the privilege of privacy. See Liew v. Breen, 640 F.2d 19 1046, 1049 (9th Cir. 1981); see also Fed. R. Evid. 501 (“[I]n a civil case, state law governs 20 privilege regarding a claim or defense for which state law supplies the rule of decision.”). 21 Under Article I, Section I of the California Constitution, the right to privacy protects 22 individuals from “business interests . . . collecting and stockpiling unnecessary information 23 . . . and from misusing information . . . to serve other purposes or to embarrass us.” Cal. 24 Const., art. I, § 1; Hill v. Nat'l Collegiate Athletic Assn., 865 P.2d 633, 642 (1994). When 25 a discovery request implicates this constitutional right, a court may not compel disclosure 26 “simply upon a showing that the [] test for relevance has been met.” Williams v. Superior 27 Ct., 398 P.3d 69, 86 (2017). 28 1 To establish a prima facie privacy claim, the party asserting protection must show: 2 (1) a legally protected privacy interest, (2) an objectively reasonable expectation of privacy 3 under the circumstances, and (3) a threatened intrusion that is serious. Id. at 84 (citing Hill, 4 865 P.2d at 633). California recognizes two categories of privacy interests: informational 5 privacy, which safeguards sensitive and confidential information, and autonomy privacy, 6 which protects personal decision-making and intimate activities. Id. at 654. “Information 7 is private when [] social norms recognize the need to maximize individual control over its 8 dissemination and use to prevent unjustified embarrassment or indignity. Id. “Such norms 9 create a threshold reasonable expectation of privacy in the data at issue.” Id. The party 10 seeking disclosure must then demonstrate countervailing interests sufficient to justify 11 intrusion. Williams, 398 P.3d at 84 (citing Hill, 865 P.2d at 633). 12 To uphold the right to privacy, the Federal Rules authorize courts, for good cause, 13 to “issue an order to protect a party from annoyance, embarrassment, oppression, or undue 14 burden.” FED. R. CIV. P. 26(c)(1)(A). To show good cause, the moving party must 15 demonstrate specific prejudice or harm that would result absent protection. Phillips ex rel. 16 Estates of Byrd v. Gen. Motors Corp., 307 F.3d 1206, 1210–11 (9th Cir. 2002). “The court 17 has wide discretion to determine what constitutes a showing of good cause and to fashion 18 a protective order that provides the appropriate degree of protection.” Grano v. Sodexo 19 Mgmt., 335 F.R.D. 411, 414 (S.D. Cal. 2020); see Seattle Times Co. v. Rhinehart, 467 U.S. 20 20, 36 (1984) (interpreting Rule 26(c) as conferring “broad discretion on the trial court to 21 decide when a protective order is appropriate and what degree of protection is required.”). 22 IV. DISCUSSION 23 The central question before the Court is whether Expel’s proposed review of the 24 personal email data would violate Lim’s constitutional right to privacy. The Court applies 25 the three-pronged test set forth in Hill to determine whether Lim has established a prima 26 facie case of invasion of privacy. 865 P.2d at 654. 27 // 28 // 1 A. Legally Protected Privacy Interest 2 Lim possesses a legally protected privacy interest in the personal email data. The 3 data includes financial records, medical information, and home security images—core 4 categories of information recognized as protected by California’s constitutional and 5 common law right to privacy. See id. (medical information); City of Carmel-By-The-Sea v. 6 Young, 466 P.2d 225 (1970) (personal finances); Valley Bank of Nevada v. Superior Ct., 7 542 P.2d 977 (1975) (personal finances and private life details); Pettus v. Cole, 49 Cal. 8 App. 4th 402, 409 (1996) (medical and psychiatric history); Hernandez v. Hillsides, Inc., 9 211 P.3d 1063, 1072–73 (2009) (autonomy and freedom from observation into one’s 10 personal activities). 11 B. Objectively Reasonable Expectation of Privacy 12 Lim has an objectively reasonable expectation of privacy in the personal email data. 13 Lim did not waive her right to privacy by accessing her personal email account on a 14 company-owned laptop.2 Expel’s policy expressly allows use of company-issued 15 equipment, such as the laptop, for incidental personal purposes. ECF No. 18-4 at 5. The 16 policy does not state that Expel has the right to review personal data on the laptop. 17 Although the policy states that data stored on the laptop belongs to Expel, the language is 18 at best ambiguous as to personal data, and that ambiguity must be construed against Expel.3 19 See Cal. Civ. Code § 1654; Restatement (Second) of Contracts § 206 (1981); Sandquist v. 20 Lebo Auto., Inc., 376 P.3d 506, 514 (2016) (“To the extent that omission creates any 21 22 23 2 It is not clear whether Lim understood that by accessing her Gmail account through her 24 work Mail account, she would be creating a copy of her entire email file on the work laptop. 25 3 Expel also required Lim to sign a Proprietary Information and Inventions Agreement that provides that company-owned equipment “is subject to inspection by Company personnel 26 at any time with or without notice.” ECF No. 18-5 at 4. This language does not negate 27 Lim’s reasonable expectation of privacy for the reasons discussed herein. It is not specific to personal data; instead, its purpose is to ensure that employees do not misuse Expel’s 28 1 ambiguity, [Defendants] [] drafted an ambiguous document and . . . cannot now claim that 2 benefit of the doubt.”) (internal quotations omitted). 3 A reasonable reading of the policy is that it is designed to ensure that the company 4 retains ownership of company data at all times and that employees cannot retain or use 5 company data for their own personal purposes. Reading the policy otherwise would lead 6 to the absurd result suggested by Expel here: that Expel is entitled to peruse more than 7 15 years of Lim’s highly personal and confidential information, including communications 8 with her attorneys, without any restrictions. Expel told Lim she could store this information 9 on the laptop for incidental personal use, but it never told her she could face such dire 10 consequences to her privacy or her ability to retain the attorney-client privilege by doing 11 so. 12 The cases relied on by Expel do not support its position. Instead, they underscore the 13 lack of notice to Lim in Expel’s policy and the inequity of allowing Expel to exploit the 14 ambiguity of that policy. In Holmes v. Petrovich Dev. Co., 191 Cal. App. 4th 1047, 1068 15 (2011), the court held that the plaintiff waived the attorney-client privilege by sending 16 emails to her attorney from a company-owned computer. Id. at 1051. Unlike Expel, the 17 company in Holmes had a written policy prohibiting use of its computers for personal 18 reasons. Id. The Holmes policy also stated that employees would not have any right to 19 privacy in any “personal information or messages” that were stored on company 20 computers, and that the company would monitor computers to ensure compliance. Id. The 21 court found that this policy foreclosed any possibility that the plaintiff could retain a 22 reasonable expectation of privacy in emails she sent to her attorney using a company 23 computer. Id. at 1069. 24 Similarly, in TBG Ins. Servs. Corp. v. Superior Court, 96 Cal. App. 4th 443 (2002), 25 the court found that an employee waived his right to privacy in data stored on a company- 26 owned computer when he used the computer in violation of company policy. Id. at 446. 27 The employee’s policy prohibited personal use of the computer, stated that use of the 28 computer would be monitored, and provided that information transmitted from the 1 computer would not be private. Id. The employee could not claim a reasonable expectation 2 of privacy in information on the computer in light of that express policy. Id. 3 Holmes and TBG are easily distinguished. Expel’s policy is the opposite of the 4 policies at issue in those cases. Expel does not prohibit use of company computers for 5 personal purposes. It expressly allows it. Permitting employees to use company-owned 6 devices does not diminish their expectation of privacy; it increases it. See Mintz v. Mark 7 Bartelstein & Assocs., 885 F. Supp. 2d 987, 997 (C.D. Cal. 2012) (“The fact that [the 8 employer] was aware of and permitted [the employee] to make personal calls increased 9 [the employee’s] expectation of privacy because he could reasonably believe that he had 10 [the employer’s] approval to use the phone for personal reasons.”); see also Militello v. 11 VFARM 1509, 89 Cal. App. 5th 602, 616 (2023) (holding that an employer’s general right 12 to inspect corporate records did not negate an employee’s reasonable expectation of 13 privacy “absent a specific policy concerning individual e-mail accounts.”). 14 The Court declines to extend the holdings of Holmes and TBG here because Expel’s 15 policy did not provide comparable or clear notice regarding the potential consequences of 16 incidental personal use of a company-owned laptop. Lim retained an objectively reasonable 17 expectation of privacy in the personal email data, even though it was stored on Expel’s 18 laptop. 19 C. Serious Intrusion 20 The Court also finds that the intrusion suggested by Expel—its unrestricted review 21 of the personal email data—is profoundly serious in its scope and potential impact. Hill, 22 865 P.2d at 655. The data contains highly private information, including medical and 23 financial records and home security images depicting minors. Expel’s position is 24 unreasonable in the extreme. Expel admits that its practice is to wipe a former employee’s 25 laptop upon termination for reuse by another employee. ECF No. 18-9 at 2. In the normal 26 course, if Lim had not expressed a concern regarding retaliation by Expel, Expel would 27 have deleted the personal email data in 2023. Expel’s only possible interest in the personal 28 email data is limited to the extent it relates to Lim’s claims. 1 Such a radical intrusion is not necessary or proportional here. The Federal Rules set 2 clear limits on discovery, prohibiting unrestricted access to information in the mere hope 3 of finding evidence. FED. R. CIV. P. 26(b)(2)(C)(i); Doherty, 2017 WL 1885677, at *2 4 (noting the “ultimate and necessary boundaries” of discovery); Rivera v. NIBCO, Inc., 364 5 F.3d 1057, 1072 (9th Cir. 2004) (“District courts need not condone the use of discovery to 6 engage in ‘fishing expedition[s]’”). Expel’s request to review data spanning more than 7 fifteen years—nearly ten times the length of her employment with Expel and beginning 8 more than a decade before her start date—is patently unreasonable and overbroad. See FED. 9 R. CIV. P. 26(g)(1)(B) (by signing the discovery request, the party certifies that it is 10 reasonable and not made for any improper purpose, such as to harass a party); Hall, 2021 11 WL 3419370, at *5 (denying motion to compel where the request was overbroad). 12 Moreover, because the parties have already had eight months to conduct fact discovery, 13 permitting Expel to review the personal email data would likely yield diminishing returns. 14 ECF Nos. 10, 22; Updike v. Clackamas County, No. 3:15-CV-00723-SI, 2016 WL 111424, 15 at *1 (D. Or. Jan. 11, 2016) (“At some point, discovery yields only diminishing returns and 16 increasing expenses . . . As more discovery is taken, the greater the delay in resolving the 17 dispute. Finding a just and appropriate balance is the goal, and it is one of the key 18 responsibilities of the court.”). 19 Finally, the existing protective order (ECF No. 14) does not adequately safeguard 20 Lim’s privacy interests. Labeling the personal email data “confidential” does nothing to 21 offset the harm to privacy caused by allowing an adverse third party to comb through more 22 than a decade of personal information that is of remote relevance, at best, given that so 23 much of the data was created even before Expel hired Lim. 24 D. Less Intrusive Measures 25 Expel has a legitimate interest in obtaining relevant discovery, but there are less 26 intrusive methods for doing so than allowing Expel unfettered review of the personal email 27 data. Expel can, and indeed has, already used traditional discovery methods to obtain 28 relevant information to prepare its case. See FED. R. CIV. P. 26(b)(2)(C)(i). 1 For example, in connection with Lim’s claim for emotional distress damages, Expel 2 served interrogatories asking Lim to identify each mental or physical condition allegedly 3 caused or aggravated by Expel (ROG 8). ECF No. 18-12 at 13-14. Lim’s response included 4 dates, medical providers, conditions, and/or diagnoses. Id. Similarly, Expel requested that 5 Lim identify all health care providers who treated her for any alleged emotional distress, 6 pain and suffering, or other non-pecuniary harm (ROG 9). Id. at 14. Lim responded with a 7 list of health care providers and dates of corresponding visits. Id. at 14-15. 8 With respect to Lim’s claimed economic damages and mitigation efforts, Expel 9 requested that Lim identify: (1) the nature and factual basis of her damages, (2) all sources 10 of income from January 2012 to the present, (3) each employer or potential employer to 11 whom she applied for work from May 31, 2022 to the date of her response, (4) for any jobs 12 she applied to, whether she received an offer, the related compensation, and any reasons 13 she turned down an offer, (5) all persons or entities for whom she performed work as an 14 independent contractor or through self-employment since May 31, 2022, (6) all efforts she 15 made to mitigate damages; and (7) any other sources of income or benefits received, 16 including the amounts and payors (ROGS 1-7). Id. at 3-13. Lim responded with the 17 amounts of her lost wages and benefits, the factual basis for these amounts, a list of 18 employers and corresponding salaries since 2011, a list of more than 20 companies and 19 corresponding roles she has applied to since the termination, and unemployment income 20 she has received since her termination. Id. 21 Likewise, with respect to Lim’s statements to or about witnesses (ROG 12), Lim 22 identified more than 40 individuals whom she believes have, or may have, knowledge of 23 facts relevant to the underlying complaint. Id. at 17-18. Once more, with respect to Lim’s 24 potentially similar claims of other employers, Expel requested all federal, state, and/or 25 agency claims made by Lim since January 1, 2012 (ROG 13), and Lim responded with 26 details on a worker’s compensation case (filed in 2014), a fair employment and housing 27 28 1 case claim related to Sarbanes Oxley (filed in 2019), and a wage claim with the California 2 Labor Commissioner’s Office (filed in 2022). Id. at 18-19.4 3 Expel also had the opportunity to obtain relevant information through depositions. 4 See Lee v. Stonebridge Life Ins. Co., No. 11-CV-43 RS (JSC), 2013 WL 3889209, at *1-2 5 (N.D. Cal. July 30, 2013) (denying motion to compel access to a personal computer given 6 Rule 26(b)(2)(C)'s limitation on unduly burdensome discovery and because the plaintiff 7 had already produced considerable data); see also Allen v. Superior Court, 151 Cal.App.3d 8 447, 449 (Ct. App. 1984) (holding that the trial court abused its discretion when it failed to 9 require less intrusive discovery, such as a deposition without production of records). And, 10 Expel served more than 50 subpoenas on Lim’s past and prospective employers and her 11 medical and health providers. Email to Chambers (Sept. 10, 2025, 4:52 P.M.). Thus, 12 existing discovery tools have provided Expel ample opportunity to obtain relevant 13 discovery without unnecessarily subverting Lim’s privacy rights. 14 V. CONCLUSION 15 Because the Court finds that Lim did not waive her constitutional right to privacy in 16 the personal email data, the Court need not reach Expel’s other arguments. The Court 17 therefore GRANTS the motion for protective order in part. ECF No. 18. Given the 18 representations made by Control Risks under penalty of perjury that it has not shared the 19 content of the personal email data or the metadata associated with it with Expel or its 20 counsel, the Court need not order the immediate deletion of the personal email data or 21 appointment of an independent forensic examiner. Instead, the Court will ORDER as 22 follows: 23

24 25 4 Expel served Lim with a Request for Admissions and Request for Production of Documents (Set One), to which Lim responded on June 27, 2025, and provided a 26 supplemental response on August 27, 2025. Expel then served a second Request for 27 Production, and Lim responded on August 27, 2025. On August 29, 2025, Lim produced a substantial set of documents (Bates-stamped PLT000481-PLT008220), followed by a 28 1 1. Neither Expel nor Control Risks may access or review the personal email data 2 || without the Court’s advance authorization upon a showing of good cause. 3 2. Within thirty (30) days following termination of this action, including any 4 || appeals, Expel and Control Risks must delete the personal email data, including any copies 5 || thereof, and certify in writing to Lim’s counsel that they have done so. 6 IT IS SO ORDERED. 7 || Dated: December 1, 2025 8 9 J doen tH. ovo UV — Honorable Allison H. Goddard 10 United States Magistrate Judge 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28