Data Privacy

The emergence of ephemeral messaging applications to communicate with friends, family, and coworkers quickly, securely, and effortlessly has boomed over the past decade. In that time, users of ephemeral messaging apps have risen significantly, from millions to billions of active users! Ephemeral messaging is an integral and evolving part of both individual and company communications with advantages and challenges impacting companies and the legal industry. Companies must consider the ramifications of their employees' use of ephemeral messaging and adopt policies and procedures to best protect themselves and comply with requirements relating to litigation and regulation. Courts have already begun addressing the failure to preserve relevant ephemeral messages and have been issuing sanctions in a myriad of legal challenges. Ephemeral messaging is here to stay, and companies, courts, and attorneys must understand and adapt to evolve with this emerging technology.

We’re all familiar with the importance of avoiding the inadvertent disclosure of attorney-client communications, work product or sensitive, proprietary or confidential business information. However, our obligations don’t end there. In addition to protecting this information, we also need to consider how to handle personal identifying information (“PII”). With extremely large amounts of data being at play in most litigation matters, it is becoming more and more important to have a solid game plan with safeguards and protections in place. Accidentally disclosing PII can lead to a chaotic discovery process and could lead to expensive monetary sanctions.

In 2019, I co-authored an article published by the American Bar Association regarding the future of U.S. pretrial discovery involving European Union data following the decision by the United States District Court for the District of Arizona in Salt River Project Agricultural Improvement & Power District v. Trench-France SAS, 303 F. Supp. 3d 1004 (D. Ariz. 2018). The article concluded that Salt River represented a potential watershed moment promoting the application of a foreign mechanism to U.S. discovery overseen by a foreign discovery master under the Hague Convention, as opposed to U.S. courts’ typical deference to domestic discovery practices. Recently, however, I was involved in a matter which demonstrated that state courts may be reluctant to follow Salt River’s lead.

As you recall, in December of 2015, the amended FRCP 26(b)(1) sought to address the escalating burdens associated with data preservation and production by emphasizing proportionality and defining the scope of discovery. As the latest proportionality rulings show, Rule 26(b)(1) is having an impact on limiting the scope of discovery based on the associated expense and some state courts are even following the federal courts’ lead in enforcing proportionality. Interestingly, while expense continues to be a factor in the proportionality argument, parties’ objections on the basis of proportionality have extended to nonmonetary factors as well, including privacy. As a result, some courts are now recognizing privacy as a consideration in determining whether the discovery sought is proportional to the needs of the case.

In the modern workplace, companies are beset with a multitude of challenges regarding ownership and use of devices such as laptops, mobile phones, tablets, and others, and the information on or accessed by them. It has become increasingly common for companies to follow a model called BYOD, or “Bring Your Own Device,” where an employee purchases their own device and the company pays for either all or partial service. While there are clear advantages to this type of business model, there are drawbacks that should be considered when drafting company policies.