The device is not his anymore. When submitted for repair, I believe the typical contract agreement was if the item was not picked up and paid for, the ownership of the device was forfeited to the repair shop, without further extension. The shop became the owner, and in such instances, there is no agreement regarding privacy of the contents, particularly if no password to the drive or its contents was set.
Correct.