In 2019, McDonald’s Corporation fired its CEO Steve Easterbrook after it learned he had an inappropriate relationship with a subordinate employee. The relationship came to light when the subordinate employee reported that she engaged in a consensual relationship with Easterbrook that involved explicit text messages and photographs, but no physical contact.  Naturally, McDonald’s investigated the allegations. The investigation included interviews and an examination of Easterbrook’s iPhone and an iCloud account. Easterbrook admitted the allegations, however, no additional misconduct was revealed. Consequently, McDonald’s board terminated Easterbrook “without cause,” meaning he stood to collect approximately $40 million in stock options and other compensation. Easterbrook’s severance arrangement with McDonald’s stated that if the company later determined that the employee was dishonest and cause for termination existed, the company had the right to recoup the severance payments.  Fast forward to the summer of 2020: this is exactly what happened.

More specifically, other employees came forward and it was learned Easterbrook not only had a sexual relationship with a different subordinate employee, but that Easterbrook awarded that employee a significant six-figure stock grant. McDonald’s conducted a second investigation which included searching Easterbrook’s corporate emails (which were not searched previously).  This investigation revealed dozens of nude or sexually explicit photos of various women, including company employees. The email search appeared fairly simple. Among other things, McDonald’s searched for the name of the employee who was alleged to have had an affair with Easterbrook. The emails were apparently not previously located during the first investigation because Easterbrook deleted them from his iPhone. McDonald’s has now sued Easterbrook to recover severance compensation paid or owed to him based on his lies, concealment and fraud.

McDonald’s predicament points to a simple lesson: when conducting an investigation of employee misconduct, in addition to a forensic search of electronic devices, a search of an employee’s work-related emails is imperative. McDonald’s likely could have avoided suing Easterbrook had this been accomplished during the first investigation.