PRIVACY PLEASE, DO NOT DISTURB: Proportionality and Privacy

About a year ago, I wrote the blog “Proportionality:  Tipping the Scale” spotlighting proportionality with respect to data preservation and the related amendments to the Federal Rules of Civil Procedure, which you can find here. As you recall, in December of 2015, the amended FRCP 26(b)(1) sought to address the escalating burdens associated with data preservation and production by emphasizing proportionality and defining the scope of discovery. As the latest proportionality rulings show, Rule 26(b)(1) is having an impact on limiting the scope of discovery based on the associated expense and some state courts are even following the federal courts’ lead in enforcing proportionality. Interestingly, while expense continues to be a factor in the proportionality argument, parties’ objections on the basis of proportionality have extended to nonmonetary factors as well, including privacy. As a result, some courts are now recognizing privacy as a consideration in determining whether the discovery sought is proportional to the needs of the case.

Remind Me Again, What Is Proportionality?

Rule 26(b)(1) states “Unless otherwise limited by court order, the scope of discovery is as follows:  Parties may obtain discovery regarding any nonprivileged matter that it is relevant to any party’s claim or defense and proportional to the needs of case…” The Rule also lists six factors in determining proportionality:

1. The importance of the issues at stake in the action;
2. The amount of controversy;
3. The parties’ relative access to relevant information;
4. The parties’ resources;
5. The importance of the discovery in resolving the issues; and
6. Whether the burden of expense of the proposed discovery outweighs its likely benefit.

“The Court’s responsibility, using all the information provided by the parties, is to consider [all the proportionality factors] in reaching a case-specific determination of the appropriate scope of discovery.” See Fed. R. Civ. P. 26 advisory committee note. 

What Does This Have to Do with Privacy?

In this digital era we are tethered to our devices for emails, chats, text messages, internet, calendars, contacts, photos, social media, fitness, GPS, and our faithful virtual assistants. Almost every click or command to an electronic device creates electronically stored information (ESI) that may be subject to discovery in litigation. More than likely, our devices also contain personal and sensitive ESI which is not relevant and may raise significant privacy concerns to litigants and third parties. 

How Have Courts Addressed Privacy in Their Proportionality Analysis?

A great example of a court analyzing privacy and proportionality is Hensen v Turn, Inc., 15-cv-01497, 2018 WL 5281629 (N.D. Cal. Oct. 22, 2018). In this class action centering on data privacy claims, plaintiffs allege defendant placed “zombie cookies” on their mobile devices. Zombie cookies are cookies that users cannot delete or block or that, when users try to delete them, “respawn” to continue tracking users across the web. Defendant requested that plaintiffs:

1. produce their mobile devices for inspection or produce complete images of their devices,
2. produce their full web browsing history from their devices, and
3. produce all cookies stored on or deleted from their devices. 

Plaintiffs argue that defendant’s requests were overbroad and invaded their privacy rights. As an alternative, plaintiffs proposed that they produce (1) their web browsing history and cookies associated with defendant’s partner websites (contingent on defendant identifying such sites); and (2) date fields. Plaintiffs opposed producing the content of all other cookies on their mobile devices. Further, plaintiffs opposed allowing defendant to inspect their devices or produce complete images of their devices, arguing that the request for full contents “flies in the face of Rule 26(b)’s relevancy and proportional requirements.” 

The Court’s Analysis of Defendant’s Three Requests

(1) Inspection or complete forensic images  

The court noted that defendant’s request to directly inspect plaintiffs’ mobile devices or produce complete forensic images would likely sweep in numerous private and irrelevant documents. The court also ruled that inspection or imaging was disproportional to the needs of the case. “While questions of proportionality often arise in the context of disputes about the expense of discovery, proportionality is not limited to such financial considerations.” The court also cites numerous cases from a variety of jurisdictions where “[c]ourts and commentators have recognized that privacy interests can be a consideration in evaluating proportionality, particularly in the context of a request to inspect personal electronic devices.”

(2, 3)  Produce full browsing history and cookies

The court ruled requiring plaintiffs to produce their full browsing history presents significant privacy concerns and defendant had not shown that the full browsing history and cookies were relevant or proportional to the needs of the case. Here, plaintiffs agreed to produce browsing history and cookies associated with defendant’s partner websites and the date field of all other cookies on their mobile devices. Plaintiffs also offered to meet and confer to consider specific cookies. The Court found the plaintiffs’ position and proposals to be reasonable and proportional, with a slight modification. The Court ordered plaintiffs to produce the date fields of their browsing history.

In conclusion, the court also noted: “There is an Orwellian irony to the proposition that in order to get relief for a company’s alleged surreptitious monitoring of users' mobile device and web activity, a person has to allow the company unfettered access to inspect his mobile device or his web browsing history. Allowing this discovery would further invade the plaintiffs' privacy interests and may deter current and future plaintiffs from pursuing similar relief.”

Lessons Learned from Hensen:

#1  Privacy Is Now a Proportionality Limitation  

Proportionality is no longer just a benefit and burden of expense analysis. Parties may factor privacy into their proportionality analysis and determine whether a request is likely to produce irrelevant, private data. Like the 26(b)(1) factors, privacy objections should be made to limit the scope of discovery to the relevant data. 

#2  Legitimate Privacy Concerns Will Be Recognized  

In accordance with FRCP 26(c), courts should protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense. As the US Supreme Court held 35 years ago, although the Rule “contains no specific reference to privacy or to other rights or interests that may be implicated, such matters are implicit in the broad purpose and language of the Rule.” See Seattle Times Co. v. Rhinehart, 467 U.S. 20, 35, fn. 21 (1984). Requests for forensic inspections of devices or “any and all” requests may raise significant and legitimate privacy concerns.  If requests are overbroad, the responding party’s objections should be fact based and include metrics where appropriate. In Hensen, plaintiffs clearly stated what they were willing to provide and why their proposal was should be adopted based on proportionality. As a result, the Court adopted their proposal to significantly limit the data produced, with only a slight modification. 

#3  Privacy Data May Be Related to the Claims and Defenses  

The Hensen court made clear that a claim of privacy does not automatically exclude data from production. Indeed, the Hensen court did not “mean to imply that there could never be an instance where a request to directly inspect a litigant’s electronic devices or forensic images, or a request that a litigant produce his complete web browsing history or cookies, would be relevant and proportional.” The same is true for other requests where private data may be a related to the claims and defenses. Here are a two examples:   

• “Private” photos taken before and after an injury were “…reasonably calculated to yield evidence relevant to plaintiff’s assertion that she could no longer engage in the activities she enjoyed before the accident and that she had become reclusive.” See Foreman v. Henkin, 30 N.Y. 3d 656, 657 (2018). 

• Phone records and social media may be discoverable if narrowly tailored in date and time and a key issue in the case. See Hinostroza v. Denny’s Inc., No. 2:17–cv–02561–RFB–NJK, 2018 WL 3212014 (D. Nev. June 29, 2018), a case in which the court permitted defendant to obtain some electronic information but not all communications during the 48 hours after a car accident. The court also recognized “information from social media is relevant to claims of emotional distress because social media activity, to an extent, is reflective of an individual’s contemporaneous emotions and mental state” but limited defendant’s request to a shorter period of time.     

#4  Cooperate, Cooperate, Cooperate. 

It is rather fitting that I end with the same final lesson learned as my previous proportionality blog. Cooperation is still key and parties should cooperate and consider proportionality from inception to completion of discovery. “The parties and the court have a collective responsibility to consider the proportionality of all discovery and consider it in resolving discovery disputes.” See Fed. R. Civ. P. 26 advisory committee note. In Henson, plaintiffs were willing to provide relevant data and meet and confer regarding excluding private, irrelevant data from production. When a privacy objection is made, parties should cooperate to see if there is a less intrusive or less burdensome way to seek the requested discovery.  

DISCLAIMER: The information contained in this blog is not intended as legal advice or as an opinion on specific facts. For more information about these issues, please contact the author(s) of this blog or your existing LitSmart contact. The invitation to contact the author is not to be construed as a solicitation for legal work. Any new attorney/client relationship will be confirmed in writing.