eDiscovery Issues: Possession, Custody or Control in the Electronic Age

This is another article in a series about electronic discovery or “eDiscovery.” In this article we will discuss some of the issues that arise when one overlays the general standard of “possession, custody or control” on electronically stored information (“ESI”).

Courts across the country have essentially universally held that information within the “possession, custody or control” of a party must be produced in discovery if the party has actual possession, custody or control.¹ Importantly, the terms “possession,” “custody,” or “control” are examined in the disjunctive, and thus only one of these requirements need be met.² However, many court decisions, including Illinois decisions, are not clear about these disjunctive requirements and routinely mix together all three concepts. In that regard, many opinions use the term “possession, custody and control” when in fact any one of the three will be sufficient to trigger the test.

“Possession” and “custody” are simple enough terms. One generally possesses or has custody of something if they “have it,” whether or not they own it. Where the party is in actual “possession” or “custody” of the requested information, the obligation is fairly straightforward – the party will likely be obligated to preserve and produce the information subject to relevancy, burden and protectable interests, such as privacy of information. This includes, for example, not only ESI owned by the party in its possession, but also ESI that belongs to someone else, such as a client or customer, that is within the party’s custody.

The more difficult issues arise when looking at “control.” “Control” is broadly construed to include not only the possession of information, but also the “legal right” to obtain information upon demand. The legal right to obtain the information can arise from contract or any other device granting a legal entitlement to information. For example, statutory obligations may also provide evidence that a party has control of information, such as where a party had an obligation to produce information maintained by its third-party benefits administrator pursuant to certain record keeping obligations under the ERISA statute.³ Similarly, a party may be required to produce documents not in his possession where the party has a statutory right to obtain the documents, such as tax records.⁴

In interpreting the “control” element, some courts have expanded “control” beyond a legal right to obtain information to require “production of documents not in a party's possession…if a party has the practical ability to obtain the documents from another, irrespective of legal entitlements to the documents.”⁵ This broader standard enables a party seeking discovery to require production of information beyond the actual possession or custody of a party if such party has retained “any right or ability to influence the person in whose possession the documents lie.”⁶ Importantly, the Seventh Circuit has rejected the practical ability test; a legal right to obtain the information is required.⁷

Some courts and commentators have attempted to articulate a number of “control” factors, including: (1) who had access to the materials were employed and how they were used; (2) whether the materials were generated, acquired, or maintained with the party’s assets or the party; (3) the extent to which the materials serve the party’s or non-party’s interests; (4) any formal or informal evidence of a transfer of ownership or title; (5) the ability of the party to the action to obtain the documents when it wants them.⁸ Courts do not assign any particular weight to any one factor, but rather consider whether there is on balance a sufficiently close connection to justify a finding of control.

The electronic age puts the concept of “possession, custody or control” to the test in a variety of ways. In the case of an individual, if “Bob” stores his information on his personal computer and on his own hard drive, the issues are only slightly more complicated than they would have been in the days when discovery focused on paper productions and the issue of “possession, custody or control” will likely never arise.¹¹ With increasing regularity, however, information is no longer stored on the individual computer workstation that is actually owned by the individual party. For example, when Bob becomes a party to a lawsuit, he may have relevant information in his personal email account (often maintained by an internet service provider such as Gmail); his social networking pages (maintained by another internet provider such as Facebook); and his word processing and other documents (potentially stored “in the Cloud” such as Google Docs). Some of this information may be maintained in old or closed accounts that Bob no longer accesses regularly or for which he no longer remembers the passwords. In these examples, both Bob and the internet service provider are likely in “possession, custody or control” of the information. Bob may have control insofar as he “owns” and has access to the information and the internet service provider has possession of the information.

As suggested above, the most common and most sought after ESI for individuals today is probably email, which is often accessed from home computers and smart phones whether at the local library or a coffee shop. Many civil litigants, in the belief that their opponent may have relevant email, will seek the email from the internet service provider (e.g. Gmail, Yahoo!, etc.) by issuing a civil subpoena to that provider. In this instance, while the information may be in the “possession, custody or control” of the internet service provider various federal statutes will come into play, such as the Stored Communications Act¹² and the Electronic Communications Privacy Act,¹⁴ which make it improper to utilize a civil subpoena to obtain the “content” of email. Instead, a party must seek to obtain that information directly from the other party by either: (1) obtaining the party’s “consent” to obtain the email from the service provider; or (2) utilizing that party’s “control” over the email and to produce it as responsive to a discovery request.

Even where statutory requirements may not prohibit a third-party service provider from responding to a civil subpoena, non-parties who are in “possession, custody or control” of other person’s electronically stored information often raise legitimate objections. The burdens and costs on a third party of preserving and producing electronically stored information can be significant. Also, third parties will rightly claim that they have no interest in the outcome of the litigation and the request is best served on Bob who is a party to the case.

In the corporate context, similar issues arise. Corporations and other organizations routinely use third-party providers to process retirement accounts and to manage their payroll, benefits, and human resources information. In each of those instances there are often two entities that are in the “possession, custody or control” of the ESI – the company itself and the third-party service provider, which will have similar objections as those noted above.

Yet another issue that arises is where an organization is a party to a case and the possibility is raised that a former employee may have retained electronic information that is relevant to the matter. At first blush it would seem apparent that company information held by a “former employee” is outside of the company’s “possession, custody or control,” and many judges have appropriately stopped the analysis there. However, some courts have pushed beyond a straightforward application of “possession, custody or control” and have required at least some inquiry and investigation to determine whether former employees have responsive relevant information. For example, one court has recognized that “[u]nder some circumstances, a court could determine that an employer has control over documents maintained by a former employee,” suggesting that an employer may have “control” over information in the possession of a former employee if that individual is still receiving economic benefits from the employer.¹⁵ Furthermore, insofar as the employer owns the information in the former employee’s possession, the employer can be said to have a legal right to the information and thus be found in “control” of the information. As with most discovery issues, the factual circumstances surrounding the particular case will guide the court’s analysis.

While these few examples are by no means all the issues that arise in the electronic age, it does reinforce that the technical aspects of how and where electronically stored information may be located raises novel issues that have not yet been litigated. For example, it is not clear whether one who can “access” their company’s data for work purposes is in “possession, custody or control” of the employer’s information if they are served with a personal subpoena. Additionally, issues may arise where one has encrypted data in their possession but does not have the password or the encryption key gain access to the information contained within. Alternatively, a party may have possession or control of data but not have access to the application or program to give that data meaning. Cases to date have simply not addressed these complexities brought about by the technical aspects of electronically stored information and parties litigating these issues must understand the technical as well as the legal aspects of the electronically stored information they seek to obtain.

---

¹ Petrik v. Monarch Printing Corp , 150 Ill App 3d 248, 258 (1982).

²Central Nat Bank in Chicago v. Baime, 112 Ill App 3d 664, 669 (1982) (“A party may be required to produce documents which are in the possession of third parties, where he has custody or control of those documents.”).

³Tomlinson v. El Paso Corp, 245 FRD 474, 476-77 (D Colo 2007).

⁴Hawkins v. Wiggins, 92 Ill App 3d 278, 282 (1980).

⁵Goodman v. Praxair Svcs, 632 F Supp 2d 494, 515 (D Md 2009) (emphasis added).

⁶Tomlinson, 245 FRD at 477.

⁷ Chaveriat v. Williams Pipe Line Co , 11 F3d 1420, 1427 (7th Cir 1993) (“[T]he fact that a party could obtain a document if it tried hard enough…does not mean that the document is in its possession, custody, or control.”).

⁸Ice Corp v. Hamiltion Sundstrand Corp, 245 FRD 513, 518 (D Kan 2007), citing Moore 's Federal Practice and Procedure § 15.16 (2007); New York v. AMTRAK, 233 FRD 259, 268 (NDNY 2006); 7-34 Moore 's Federal Practice - Civil § 34.1 (Matthew Bender 3d ed.)

¹¹ We say only “slightly more complicated” because electronically stored information does raise certain issues including but not limited to the form of production, the method by which one searches for information and the potential importance of associated metadata.

¹² 18 USC § 2701 et seq (2006).

¹⁴ 18 USC § 2510 et seq (2006).

¹⁵Cache La Poudre Feeds, LLC v. Land O’ Lakes, Inc, 244 FRD 214 (D Colo 2007) .