[EDRM Editor’s Note: The opinions and positions are those of the Michael D. Berman.]

It is clear that Bad Things Can Happen When Company Officers Use Their Private Email Accounts for Work (May 20, 2024)(citing cases).

The recent decision in Lalwani v. Trustees of Indiana University, 2026 WL 1847881 (Jun. 26, 2026), involved three emails in which, an employee, plaintiff Mr. Lalwani, had communicated with his lawyers using the employer-defendant university’s email system. The core holding was:

Indiana University is a public institution subject to an open records law and has an IT policy providing notice to its employees (including Lalwani) that they should have no expectation of privacy in Emails stored on the University’s servers. Lalwani communicated about his highly personal matters via his employer’s email system on his own volition and to his own peril.

Id. at *5 (emphasis added).

The Lalwani court added: “Here, Lalwani seeks Court intervention to protect Emails that he himself took no efforts to protect. He chose not to identify them or to timely assert a privilege to shield them via a privilege log. Moreover, throughout the discovery process in this case Lalwani has demanded overbroad and extensive searching of other custodian email accounts; therefore, he cannot claim surprise that his own email account would also be subject to scrutiny.” Id. at *6. Further, the court warned against continuation of threats against defense counsel.

The three emails were saved on Lalwani’s University email account. The court wrote: “The Emails were neither produced by Lalwani during discovery nor inadvertently disclosed by Lalwani. Instead, the University Defendants discovered the Emails when searching their server for documents. Upon finding the Emails to be between Lalwani and lawyers, the University Defendants identified the Emails, notified Plaintiff, limited their review, and sequestered the Emails.” Id. at *1. That is, of course, the proper way to handle such a situation.

The University argued that the emails were discoverable and that plaintiff had waived any applicable privilege. “Specifically, the University Defendants contend Lalwani cannot assert attorney-client privilege over communications stored on the university server.” Id. at *1. They also argued that plaintiff had failed to provide a privilege log.

“In response, Lalwani contends the Emails are protected under the Quick Peek Order…, are outside the five-year timeframe for responsive documents as outlined in this Court’s March 4 Order…, and also are protected by both the work product doctrine and the attorney-client privilege.” Id. He sought an order compelling the University to “immediately return and destroy every document they retrieved from Dr. Lalwani’s IU custodian account.” Id. at *2.

In reply, the University asked for in camera review and an order permitting it to review and use non-privileged communications.

After in camera review, the court addressed the issues.

The Quick Peek Order provides that ‘[a] document’s disclosure as part of a Preliminary Production under the Agreement does not constitute a waiver of any privilege. Pursuant to [Federal Rule of Evidence] 502(d), this waiver protection extends to all state and federal proceedings.’” The court agreed that Mr. Lalwani’s reliance on it was “misplaced” because this was not an instance of inadvertent production. The order applied only to documents produced by Mr. Lalwani and the three emails had not been produced by him.¹

The court had established a five-year time frame for discovery. Mr. Lalwani argued that the three emails were outside of those date parameters. The court determined that this argument was also “misplaced” because, again, it governed discovery and only documents produced “in response” to the order came within its scope. Thus, the temporal limitation did not protect Mr. Lalwani.

Id. at *2.

“Lalwani also argues the work product doctrine protects the Emails, because the Emails were prepared in anticipation of litigation.” Id. at *3. That argument failed on its facts. The court wrote: “The Undersigned performed an in camera review of the Emails and determined that the Emails are not communications prepared by attorneys in anticipation of this litigation or made as part of the adversary process. Instead, the Emails are Lalwani’s own communications and concern a non-party to this case and factual events distinct from the Lalwani’s employment, i.e., of an entirely different subject matter than the present case.” Id.

Finally, the court wrote: “Lalwani contends the Emails are also protected under the attorney-client privilege. Of all the arguments Lalwani lodged in opposition to the Emails, this argument is the one that comes closest to the mark. However, some courts in our circuit have faced similar circumstances and already provided instructive analysis of the same arguments advanced here.” Id. at *3.

The Lalwani court reasoned: “Key to analysis of the treatment of the Emails here is whether a reasonable expectation of privacy can exist for emails transmitted on the university’s server.” Id. at *3. It wrote that “Indiana University… is a public institution subject to an open records act.” Id. at *4. A “core principle” of that statute is that public records are open. Id.

Further, the court looked at the University’s information governance policy. Under that policy, the court held that there was no reasonable expectation of confidentiality. Id. at *5. The policy stated that “users should be aware that because IU is a public institution, and members of the University community are engaged in institutional and academic research projects that may require access to certain de-identified user data, and because the university must be able to ensure the integrity and continuity of its operations, use of the university’s information resources cannot be completely private. For example, in addition to the types of permissible access described above, when users engage in incidental personal use of their university email accounts, the contents of their email may be subject to disclosure in response to requests under Indiana’s ‘open records’ law….” Id. at *4 (emphasis added by the court). Additionally, Indiana notified employees that they should have no expectation of privacy. Id.

The Lalwani court also ruled that Lalwani’s failure to provide a privilege log “undermines his assertion of privilege.” Id. at *5. “Lalwani’s after-the-fact production of a privilege log is too little, too late. If Lalwani intended to protect the Emails, he should have logged them on a privilege log when responding to written discovery requests to properly preserve the opportunity to argue privilege. He did not do so. Rather than recognizing that he had used his University email account to communicate about legal matters in the past and taking precautionary steps to address that with assistance from his lawyer, Lalwani waited until after he received notice of the Emails from the University Defendants.” Id. at *5. The court added:

Then, he cried foul, lodged a litany of objections and accusations against defense counsel, and demanded sanctions. Indeed, if the client cares so little for the confidentiality of the communications as to fail to take steps to insure against unintended disclosures, it is hard to justify requiring the court to take elaborate measures to protect the client against the results of his own carelessness.

Id. (cleaned up).

The court held that the three emails were not protected and denied Mr. Lalwani’s request for an order that they be returned or destroyed.

As noted above, Plaintiff made a number of attacks, including one of a motion for civil contempt and “a motion to disqualify [Defendants’ counsel’s firm]; and referral of [defense counsel’s] conduct to the Indiana Supreme Court Disciplinary Commission.” Id. at n. 2. In a stern warning about civility and cooperation, the court added:

Requiring assistance and court intervention each time an issue arises should not be the norm, nor should accusations of bad faith be lodged at every turn. More troubling, personal attacks and threats to coerce agreement have been lobbed against the University Defendants and their counsel.

To be clear: threats to report counsel to the Indiana Supreme Court Disciplinary Commission and/or to pursue efforts to punish by state court proceedings have not been supported by the record, are not well-taken, and should immediately cease. Indeed, such threats may well violate the Rules of Professional Responsibility. Further caution will not be afforded; any such future conduct will be subject to sanctions.

Id. at *7.

Note

1. In my opinion, the order was a non-waiver order, not a “quick peek” order. The term “quick peek” is found in the Advisory Committee Notes to Fed.R.Evid. 502. See Courts Cannot Order a “Quick Peek” Without Consent (Jan. 16, 2021). “Under the quick peek agreement, the parties agree that the Producing Party may produce responsive documents without first reviewing them for privileged or protected information, but specifically reserves and preserves the right to assert the privilege. The Receiving Party then reviews the documents and selects the documents it wishes to have copied. At this point, the Producing Party carefully reviews this (much narrower) universe of documents that will be formally copied and produced and withholds any documents that are privileged or protected.” Henry S. Noyes, “Federal Rule of Evidence 502: Stirring the State Law of Privilege and Professional Responsibility with A Federal Stick,” 66 Wash. & Lee L. Rev. 673, 691–92 (2009). ↩︎

Assisted by GAI and LLM Technologies per EDRM’s GAI and LLM Policy.