The Jarden–Barrenjoey Dispute: Who Owns the Data on a Work Phone?

Employee privacy, cloned devices and the digital-forensics lessons from the latest New Zealand Employment Court proceedings

A work phone can contain years of business communications, confidential documents, client information, personal photographs, private messages and authentication records.

When an employee leaves, who is entitled to that information?

And if a dispute arises, how can an organisation preserve potentially important evidence without unnecessarily exposing an employee’s private information?

Those questions are at the centre of a broader cybersecurity issue highlighted by the continuing Jarden–Barrenjoey employment dispute.

In August, the case attracted attention because of the departure of senior executives, recruitment of other employees and allegations concerning information on workplace devices.

By October, the publicly reported proceedings had brought another issue into sharper focus: access to cloned phone data and the competing interests of employers and employees.

For New Zealand organisations, this is more than an employment-law question. It raises practical issues about device management, employee privacy, evidence preservation and the controls businesses should establish before a high-risk departure occurs.

The central lesson is straightforward:

Preserving digital evidence and having the right to examine that evidence are two different things.

What has changed in the Jarden–Barrenjoey proceedings?

Our earlier analysis of the Jarden–Barrenjoey dispute examined the insider-risk implications of senior employee departures, particularly the importance of detecting unusual data movement and preserving independent evidence.

Since that article was published in August, the legal proceedings have developed.

Jarden initially sought orders concerning devices and information associated with former executives Dan Reynolds and Silvana Schenone. Reporting from The Australian described competing arguments over information on devices, including allegations concerning erased data and the defence’s position that information had been copied to hard drives.

Those were allegations and submissions, not established findings of misconduct.

Sources: The Australian — Jarden vs Barrenjoey: Device data row heard in NZ court; The Australian — Jarden launches legal action against departing Kiwi directors.

August: the initial application was dismissed

On 24 August 2026, the Employment Court dismissed Jarden’s initial application because it concluded that it lacked jurisdiction.

That decision did not determine whether confidential information had been improperly accessed, retained, deleted or disclosed.

It was a procedural ruling, not a finding on the underlying allegations.

In September, the Court also declined media applications for access to affidavit evidence, noting the concern about publishing allegations that had not been tested in a substantive hearing.

Source: Human Resources Director — Jarden employment dispute: court blocks media access to sealed affidavits.

October: the dispute returned to the Employment Court

Further reporting in October described the matter returning to the Employment Court following a jurisdictional determination involving the Employment Relations Authority.

The renewed proceedings included disagreement over access to cloned phone data held by the former executives’ solicitors.

The reported arguments involved privacy, confidentiality and the extent to which Jarden should be permitted to inspect information associated with devices used during employment.

Sources: NZ Herald reporting summarised by News Minimalist — Jarden executives’ dispute returns to Employment Court; NZ Herald reporting indexed by KhanList — Executives resist access to cloned phone data.

The underlying factual allegations remain contested. Nothing in the reporting establishes that either organisation lacked appropriate cybersecurity controls or that any individual improperly used confidential information.

However, the circumstances illustrate a problem that many employers could encounter.

Owning the phone does not automatically settle the data question

Consider a common workplace scenario.

An employer provides a senior executive with a smartphone. The employee uses it for email, Microsoft Teams, business contacts and document access.

The employer also permits reasonable personal use.

Over several years, the phone accumulates a mixture of information:

• Corporate emails and business messages.
• Customer and client contact details.
• Documents downloaded for work.
• Personal photographs and family messages.
• Private email accounts and messaging applications.
• Authentication information and application data.

When employment ends, the organisation may reasonably need to recover its business information.

But does that mean it should have unrestricted access to every item on the device?

Not necessarily.

The New Zealand Office of the Privacy Commissioner specifically addresses this problem.

Its guidance recognises that business information gathered during employment may need to remain with the employer, while work devices can also contain personal information. It recommends clear workplace policies explaining what information an employer expects to access and what happens when employment ends.

The practical distinction is important:

Ownership of a device, entitlement to business information and authority to examine personal information are related but separate questions.

The answer depends on the circumstances, applicable law, employment arrangements, workplace policies and the purpose of the proposed access.

For cybersecurity teams, this means technical capability should never be confused with legal authorisation.

A system administrator might be able to retrieve information. That does not necessarily mean the organisation is entitled to inspect all of it.

A forensic copy preserves information. It does not decide who can read it.

The reported disagreement over cloned phone data illustrates another important distinction.

A forensic copy is intended to preserve information for potential examination.

Depending on the device, its security protections and the acquisition method, forensic techniques may capture accessible files, application data, metadata or other artefacts.

The objective is to preserve potentially relevant evidence in a controlled and defensible manner.

However, making a copy does not resolve questions about which information is relevant, which material is private or who should be permitted to examine it.

There are three separate stages.

1. Preservation

The immediate priority is to prevent relevant information from being lost or altered.

This may involve preserving devices, available forensic copies, cloud records, logs and other relevant evidence.

The preservation process should be documented, including who handled the material, when it was acquired and how its integrity was protected.

2. Review and filtering

Once information has been preserved, the organisation needs an appropriately authorised process for identifying material relevant to the investigation.

Depending on the circumstances, that could involve an independent forensic specialist, agreed search terms, date restrictions, categories of relevant business information or legal oversight.

Personal or unrelated information should not automatically become available simply because it exists within the preserved material.

3. Analysis and disclosure

Only after the appropriate scope and authority have been established should relevant information be examined and, where justified, disclosed to those conducting the investigation.

A forensic examination might help establish whether particular files were present, accessed, copied, transferred or deleted.

But the conclusions must remain within what the evidence actually supports.

For example, evidence that a document existed on a device is not, by itself, proof that it was disclosed to a competitor.

Similarly, the absence of a file does not establish when it was removed or why.

Good digital forensics is not about collecting the maximum amount of information. It is about preserving and examining the right information through a defensible process.

Why BYOD makes the problem more complicated

Bring Your Own Device, or BYOD, introduces additional complexity.

An employee-owned phone may be used to access corporate email, files, messaging platforms and business applications.

The organisation has a legitimate interest in protecting its information, but it does not own the entire device.

That creates difficult questions when an employee resigns:

• Can the business remove corporate information without deleting personal data?
• What happens to business documents downloaded outside managed applications?
• Are personal messaging applications being used for work?
• Can relevant activity be reconstructed without taking possession of the phone?
• What access and collection rights were explained when the device was enrolled?

These questions should be addressed before an employee is permitted to use a personal device for business purposes.

The Office of the Privacy Commissioner’s guidance on information held when employment ends specifically recommends that BYOD policies explain what business information the employer expects to access and how it may be collected when an employee leaves.

For most organisations, a useful starting point is to separate corporate information from personal information as much as the technology allows.

That is where mobile application management and device-management controls become important.

What Microsoft Intune can — and cannot — do

Many New Zealand businesses already use Microsoft 365 and Microsoft Intune to manage devices and protect business applications.

These technologies can help establish clearer boundaries between corporate and personal information.

But they need to be configured deliberately.

Selective removal of corporate data

Microsoft Intune supports different actions for devices leaving organisational management.

A Retire action is designed to remove managed corporate information and settings while preserving personal data, subject to platform and configuration behaviour.

A Wipe action is different. It is intended to reset a device and remove its data and settings.

Microsoft also supports selective removal of corporate information from supported managed applications through app protection policies.

Sources: Microsoft Learn — Retire devices; Microsoft Learn — Wipe only corporate data from apps.

This distinction is particularly important for BYOD.

A business should not treat a full-device wipe as interchangeable with selective removal of corporate information.

The correct approach depends on device ownership, enrolment type, platform support and the circumstances.

Device management is not forensic preservation

There is another issue.

An action that removes corporate information from a device may be appropriate during routine offboarding.

But if the organisation anticipates an investigation or legal dispute, removing data before considering preservation requirements could complicate subsequent evidence collection.

This is why high-risk offboarding needs a documented decision process.

Before issuing a retire or wipe command, the responsible team should establish whether relevant evidence must first be preserved and whether legal advice or authorisation is required.

The objective is not to retain employee information indefinitely.

It is to avoid unintentionally destroying potentially relevant evidence while still respecting privacy, security and retention obligations.

Intune is only part of the answer

Intune can manage devices and applications, but it does not automatically provide a complete forensic record of everything a user has done.

For organisations using Microsoft 365, relevant evidence may also exist in identity logs, audit records, email, SharePoint, OneDrive and other cloud services.

A useful security assessment should therefore examine the entire environment, not simply whether devices are enrolled.

KIS’s free Microsoft 365 Secure Score Review covers device security, data protection, access controls, external sharing and audit logging.

The strongest evidence may not be on the phone

One of the most important lessons from any dispute involving workplace devices is that an organisation should not depend entirely on the physical device to reconstruct events.

A phone may be unavailable, damaged, reset or subject to access restrictions.

The organisation may still have independent information within its corporate systems.

Depending on the technology environment and logging configuration, that could include:

• Microsoft Entra sign-in and authentication records.
• Microsoft 365 audit events.
• SharePoint and OneDrive file activity.
• Email and collaboration records retained by the organisation.
• Data Loss Prevention alerts.
• Endpoint security telemetry.
• Document-management audit trails.
• Network and application logs.

Each source answers a different question.

Identity logs may establish that an account authenticated.

Cloud audit records may show that a particular file action occurred.

DLP telemetry may identify sensitive information being transferred through a monitored channel.

Endpoint records may provide additional context about device activity.

None should be assumed to contain a complete record, and the absence of an event does not necessarily prove that an action never occurred.

The value comes from combining independently preserved records into a defensible timeline.

This is the broader principle of forensic readiness: designing systems so that important events can be investigated without relying on a single device or a single source of evidence.

Our original Jarden–Barrenjoey insider-risk analysis explores how this connects to employee departure monitoring, DLP and unusual access patterns.

Employee privacy and information security should support each other

It is tempting to frame employee privacy and cybersecurity as competing objectives.

In practice, well-designed controls can support both.

An organisation that separates business information from personal information, defines access rights and preserves corporate audit records is less dependent on intrusive examination of an employee’s personal device.

That reduces uncertainty for everyone.

It also makes investigations more targeted.

Instead of asking for unrestricted access to an entire phone, an organisation may be able to identify the relevant corporate records, time periods and systems involved.

This is a more proportionate approach.

It is also easier to explain to employees.

Workplace monitoring should have a legitimate purpose, be transparent where required and be limited to what is appropriate for the risk.

A broad monitoring capability does not mean every employee should be subjected to heightened scrutiny.

The appropriate objective is to protect business information and investigate credible risks, not to monitor people’s private lives.

Five controls New Zealand businesses should implement

The Jarden–Barrenjoey dispute is an unusually prominent example, but the underlying technology questions apply to organisations of almost any size.

A practical response does not require an investment bank’s security budget.

It requires clear decisions about information ownership, access, preservation and response.

1. Establish a clear device and BYOD policy

Define which devices may access business systems, what personal use is permitted and what happens to business information when employment ends.

The policy should distinguish between corporate-owned and personally owned devices.

It should also explain any management, monitoring or selective-removal capabilities.

Employees should understand these arrangements before a dispute arises.

2. Keep sensitive information in controlled business systems

Where possible, business documents and communications should remain within managed applications and approved storage locations.

Reduce unnecessary local downloads, unmanaged sharing and use of personal storage services.

Apply information classification and appropriate access controls to sensitive client and commercial material.

This improves both security and the organisation’s ability to identify relevant records later.

3. Preserve the right logs for the right period

Review the audit information available across Microsoft 365, identity systems, endpoints and critical business applications.

Establish retention periods based on business requirements, privacy obligations, contractual requirements and reasonably foreseeable investigations.

Protect important evidence against unauthorised modification.

Test whether the organisation can actually retrieve and interpret the records it expects to rely on.

4. Create a high-risk departure process

Routine employee offboarding and a departure involving elevated information risk should not necessarily follow identical workflows.

A high-risk process should identify who authorises additional controls, when legal and HR advice is required, what evidence may need preservation and how access changes are documented.

It should also cover situations where several employees leave for the same competitor within a short period.

The process must remain proportionate. A resignation alone is not evidence of wrongdoing.

5. Agree on the forensic process before an incident

Decide in advance who can authorise forensic collection, who may examine preserved material, how private information will be handled and how evidence integrity will be maintained.

For complex employment disputes, independent specialists and legal oversight may be appropriate.

An organisation that waits until a dispute begins to decide these questions may face avoidable delays, privacy concerns and evidentiary uncertainty.

KIS’s incident response services include incident preparation, evidence preservation and investigation support. For organisations that need broader governance and board-level oversight, a cybersecurity risk assessment can help identify gaps in existing policies and controls.

The question boards should be asking

The Jarden–Barrenjoey proceedings demonstrate why digital evidence should be treated as a governance issue, not simply an IT problem.

Boards and senior management should be asking:

If a senior employee left tomorrow and a dispute arose over confidential information, could we establish what happened without relying entirely on their phone?

That question leads to several others.

Could the organisation identify which sensitive information the employee accessed?

Could it determine whether relevant files were downloaded or shared?

Could it preserve records before they expired or were removed?

Would the organisation know who was authorised to examine the evidence?

Could it distinguish business information from personal information?

And could it explain why its investigation was necessary, proportionate and properly documented?

The answers provide a more useful measure of readiness than simply knowing how many security tools the organisation owns.

The lesson: preserve the evidence, respect the boundaries

The Employment Court will determine the legal questions properly before it. Cybersecurity commentary should not attempt to decide disputed facts or infer misconduct from allegations.

What the publicly reported proceedings do illustrate is the difficulty of managing information when business and personal data coexist on workplace devices.

An organisation may have a legitimate need to recover corporate information.

An employee may have legitimate privacy interests in personal material.

And an investigation may require potentially relevant evidence to be preserved before the appropriate scope of access has been resolved.

These considerations do not have to be mutually exclusive.

A mature security environment should make it possible to protect corporate information, preserve relevant evidence and apply appropriate privacy safeguards.

The most important preparation happens long before a device is returned, a resignation is submitted or a legal dispute begins.

The goal is not unrestricted access to employee devices. It is reliable access to the business evidence an organisation is properly entitled to preserve and examine.

That is where device governance, employee privacy and digital-forensic readiness meet.

How prepared is your organisation?

Most businesses have an employee offboarding process.

Far fewer have tested whether they could preserve relevant evidence, reconstruct sensitive data movement or distinguish personal from corporate information during a contested departure.

If you’re unsure how your current Microsoft 365, endpoint and information-governance controls would perform, start with the free KIS Microsoft 365 Secure Score Review.

For a broader view of your security governance, detection and incident-response maturity, take the free NIST CSF 2.0 assessment.

Keep IT Simple. Keep IT Secure.

Sources and further reading

Jarden–Barrenjoey proceedings

1. The Australian — Jarden launches legal action against departing Kiwi directors, August 2026. Initial reporting on the proceedings and recruitment of former Jarden executives.
2. The Australian — Jarden vs Barrenjoey: Device data row heard in NZ court, August 2026. Reporting on the parties’ competing submissions concerning devices and information.
3. Human Resources Director — Jarden employment dispute: court blocks media access to sealed affidavits, 3 October 2026. Discussion of the August jurisdictional decision and September ruling concerning access to untested affidavit evidence.
4. NZ Herald reporting via News Minimalist — Jarden executives’ dispute returns to Employment Court, October 2026. Reporting on the procedural developments and renewed dispute.
5. NZ Herald reporting indexed by KhanList — Jarden–Barrenjoey dispute over cloned phone data, 27 October 2026. Reporting on the competing arguments concerning access to phone information.

Privacy and technical guidance

6. Office of the Privacy Commissioner — Do I have to give my employer personal information when I leave?. New Zealand guidance on employment-related business information, personal information and workplace device policies.
7. Microsoft Learn — Retire devices with Microsoft Intune. Technical guidance on removing managed corporate data and settings while preserving personal information.
8. Microsoft Learn — Wipe only corporate data from Intune-managed apps. Guidance on selective removal of corporate information from supported managed applications.
9. Microsoft Learn — Device management actions. Reference describing the distinctions between device management, retire and wipe operations.

Related KIS guidance

10. When Talent Leaves in Bulk: What the Jarden–Barrenjoey Dispute Reveals About Insider Risk and Digital Forensics. Our original analysis of employee departures, insider-risk monitoring, early warning and forensic readiness.

Important qualification

This article is technology-risk commentary based on publicly available reporting reviewed as at 3 November 2026. The descriptions of allegations, submissions and disputed events are not findings of fact. Procedural decisions concerning jurisdiction or access to evidence should not be interpreted as determinations of the underlying allegations.

The article does not assert that Jarden, Barrenjoey or any individual acted unlawfully or lacked particular information-security controls.

The cybersecurity recommendations are general examples of good practice. They are not legal advice, and organisations should obtain appropriate New Zealand legal advice before collecting, accessing or disclosing employee information in contested circumstances.