Opinion
MDL NO. 19-md-2879
09-14-2020
IN RE: MARRIOTT INTERNATIONAL CUSTOMER DATA SECURITY BREACH LITIGATION THE DOCUMENT RELATES TO THE CONSUMER TRACK
JUDGE GRIMM
REPORT AND RECOMMENDATION
Introduction
On August 19, 2020, Marriott asked me to: (1) permit it to use the plaintiffs' street addresses in its subpoenas to third parties; (2) order plaintiffs to disclose the 16 digit credit card numbers on the credit cards that were the subject of Marriott's interrogatories and requests to produce documents, and (3) order plaintiffs to produce documents without redactions that "hide relevant information." Letter of August 19, 2020. The plaintiffs have responded to this letter. Letter of September 2, 2020
There was additional correspondence that is described in the last section of this Report and Recommendation.
Summary
I have reached the following conclusions:
1. The Federal Rules of Civil Procedure do not permit a party to redact information in the documents it produces. Instead, plaintiffs must either produce unredacted documents or, if it wishes to redact information from a document, plaintiffs must first describe the nature of the redaction "without revealing information itself privileged or protected" to enable "other parties to assess the claim." See Fed. R. Civ. P 26(b) (5)(ii).
2. Marriott may use the plaintiffs' street addresses in subpoenas it issues to third parties since those addresses are now in the public domain and are therefore not subject to the Protective Order.
3. Marriott's interrogatories and requests to produce documents should be deemed amended to demand the sixteen digits of the credit cards Marriott seeks.
4. Plaintiffs should be deemed to have admitted that they cannot find the sixteen digits of the credit cards.
5. If Marriott objects to paragraph 4, Marriott should be permitted to serve additional interrogatories and requests for production asking plaintiffs to state (1) what efforts they each made to find the sixteen digits in their personal papers or secure the 16 digits from their banks or other third parties, (2) whether or not those efforts were successful, and (3) what the third party told them when the plaintiffs sought information from them. Marriott should also be permitted to request production of whatever documents the third parties made available to the plaintiffswhen the plaintiffs asked that party for the sixteen digits.
6. If plaintiffs do not agree to the use of the sixteen-digit numbers in the subpoenas that Marriott will serve on third parties, I recommend that Judge Grimm issue an order to show cause why the Protective Order should not be amended to permit such use by any party in this lawsuit.
7. It is appropriate for me to resolve the legal issues presented by Marriott's August 19, 2020 submission in this Report and Recommendation.
Analysis
The Federal Rules Do Not Permit Redaction
As noted above, Marriott complains that the plaintiffs have redacted material from the documents the plaintiffs have provided in their responses to discovery. While I have not seen the documents, I can conclude that such redactions are impermissible.
The federal courts have concluded that the Federal Rules of Civil Procedure do not permit a party to redact information, claimed to be irrelevant, from the documents it produces. In Bartholomew v. Avalon Capital Group, Inc., 278 F.R.D. 441, 451(D. Minn. 2011), the court stated:
Fed. R. Civ. P. 34 concerns the discovery of "documents"; it does not concern the discovery of individual pictures, graphics, paragraphs, sentences, or words within those documents. Thus, courts view
"documents" as relevant or irrelevant; courts do not, as a matter of practice, weigh the relevance of particular pictures, graphics, paragraphs, sentences, or words, except to the extent that if one part of a document is relevant then the entire document is relevant for the purposes of Fed. R. Civ. P. 34. This is the only interpretation of Fed. R. Civ. P. 34, that yields "just, speedy, and inexpensive determination[s] of every action and proceeding." Fed. R. Civ. P. 1.
This interpretation is buttressed by the fact that the Federal Rules of Civil Procedure do not grant parties the power to unilaterally redact information on the basis of relevance. The Federal Rules of Civil Procedure explicitly provide when redaction may be used. See Fed . R. Civ. P. 5.2 (discussing redaction within the context of filings with the court); see also D. Minn. LR 5.5 (discussing redaction of transcripts). The Federal Rules of Civil Procedure also explicitly provide a method for a party to object to a request for production of documents. See Fed . R. Civ. P. 34(b)(2). Rule 34(b)(2)(B)-(C) states: "For each item or category, the response must . . . state an objection to the request, including the reasons" and "[a]n objection to part of a request must specify the part and permit inspection of the rest." This method for objection does not explicitly include the option of producing redacted documents. In addition, the Federal Rules of Civil Procedure provide parties with the option to bring a motion for a protective order. Fed. R. Civ. P. 26(c). Thus, a party seeking the power to unilaterally redact documents for relevance should request leave to redact those portions that the party contends are irrelevant. Furthermore, there is a Protective Order [Docket No. 40] in the present case, which could be utilized to limit the dissemination of any confidential information.
Accord: United States v.Performance Food Group, Inc., Civil Action No MJG -13-172, 2016 U.S. Dist. Lexis 33064 *6 (D. Md. March 25, 2016 ( The fact that the material in question may turn out — upon inquiry - to be irrelevant although responsive does not warrant redaction.) David v. Alphin, No 3:07cv11, 2010 U.S. Dist. Lexis. 144275 * 17 (W.D.N.C., March 30, 2020 ); Eshelman v, PUMA Biotechnology, Inc., Bi, 7:16-CV-18-D, 2018 Wl 327559 * 3 (E.D.N.C. January 8, 2018) In re State Street Bank & Trust Co. Fixed Income Funds Inv. Litig., Nos. 08-1945, 08-333, 2009 WL 1026013, at *1 (S.D.N.Y. April 8, 2009) ([Unilateral] redactions [of non-responsive information are generally unwise. They breed suspicions, and they may deprive the reader of context.") In re FedEx Ground Package Sys., Inc. Emp't Practices Litig., No. 05-527, 2007 WL 79312, at *5 (N.D.Ind. Jan. 5, 2007) ("[T]he Federal Rules provide no procedural device for unilateral redaction by a party, and it is a procedure that is not favored.")
That redactions based on relevancy are impermissible makes sense. First, there is no Federal Rule of Civil Procedure that permits it. Second, documents do not exist in a perfect world of relevance and irrelevance. The same document can contain relevant and irrelevant information. The redaction of the "irrelevant" information creates a perfect black box. No one knows what's in it. That would then require the parties and the courts to review every document from which a redaction has been made. But, the worse that can happen, if there is no redaction, is that the opposing party and counsel will see irrelevant information. There is a significant disproportion between the nature of that harm (if there is any) prevented by the redaction and the effort then demanded of all counsel and the court to determine the redaction's legitimacy. See In re: Medeva Sec. Litig., No. 93-4376 KN, 1995 U.S. Dist. Lexis 2895 (C.D. Calif. 1995) (problems created by redaction outweigh "minimal" harm done by disclosure of some irrelevant material).
Furthermore, the document's production does not prevent the producing party from seeking a redaction at trial to prevent the finder of fact from seeing the irrelevant information, if an instruction to the finder to disregard it is insufficient.
Finally, a party is always free to seek a protective order under Fed. R. Civ. P 26(C)(1) against the production of information that it wishes to redact. That Rule permits the court to prevent any disclosure if a party meets the Rule's requirements. Channeling a dispute over whether information should be redacted into a motion practice where both parties can be heard before the redaction is made is preferable to a party resorting to self- help and redacting whatever it pleases.
The redacting party must specify the reason for the redaction.
When a party claims that the information, sought by discovery, is privileged, the Rule, quoted above, Fed. R. Civ. P 26(b) (5)(ii), requires that party to describe "the nature of the documents, communications, or tangible things not produced or disclosed—and do so in a manner that, without revealing information itself privileged or protected, will enable other parties to assess the claim." As I have pointed out in an earlier Report and Recommendation, ECF Doc. No. 634, then Magistrate Judge Grimm has defined with precision the obligations this Rule imposes on the party that claims privilege. Judge Grimm stated:
Thus, insuring that a privilege or protection claim is properly asserted in the first instance and maintained thereafter involves a several step process. First, pursuant to Fed. R. Civ. P. 26(b) (5), the party asserting privilege/protection must do so with particularity for each document, or category of documents, for which privilege/protection is claimed. At this first stage, it is sufficient to meet the initial burden by a properly prepared privilege log. If, after this has been done, the requesting party challenges the sufficiency of the assertion of privilege/protection, the asserting party may no longer rest on the privilege log, but bears the burden of establishing an evidentiary basis-by affidavit, deposition transcript, or other evidence- for each element of each privilege/protection claimed for each document or category of documents. A failure to do so warrants a ruling that the documents must be produced because of the failure of the asserting party to meet its burden. If it makes this showing, and the requesting party still contests the assertion of privilege/protection, then the dispute is ready to submit to the court, which, after looking at the evidentiary support offered by the asserting party, can either rule on the merits of the claim or order that the disputed documents be produced for in camera inspection.Victor Stanley, Inc. v. Creative Pipe, Inc., 250 F.R.D. 251, 267 (D. Md. 2008)
We must follow Judge Grimm's commands to the letter. Hence, for each proposed redaction, "the party asserting privilege/protection must do so with particularity for each [redaction], for which privilege/protection is claimed." Id. at 267.
Additionally, in the case quoted above, the court found that redaction was unnecessary because there was a protective order in place. There is such an order in this case, and I recommend that Judge Grimm also require that plaintiffs justify any redaction and establish either that (1) the Protective Order permits the redaction made or (2) if it does not, the redaction is justified by a recognized privilege.
Bartholomew v. Avalon Capital Group, Inc., 278 F.R.D. 441, 451(D. Minn. 2011).
"Recognized" is a word of art. There are no specific privileges in the Federal Rules of Evidence. Instead, the "[c]ommon law—as interpreted by United States courts in light of reason and experience—governs a claim of privilege." Fed. R. Evid. 501. Thus, in my view, the plaintiffs will have to show that any privilege it claims, other than work product and attorney-client, is or should be available under the common law "in light of reason and experience." See Jaffee v. Redmond, 518 U.S. 1 (1996)(recognizing patient-psychotherapist privilege); In re: Subpoena Issued to Commodity Futures Trading Commission, 370 F. Supp. 2d 201 (D.D.C. 2007)(declining to create settlement discussions privilege). See also Swidler Berlin v. United States, 524 U.S. 399 (1998) (common law determines whether attorney-client privilege survives the client's death).
The sixteen-digit problem
Marriott's requests to poduce Marriott demanded of the plaintiffs the following:
Identify all of the following used by you at any point from January 1, 2014 to the present: names, residential and business addresses, personal and business email addresses, passport numbers with expiration dates, SPG numbers, and last six digits of payment card numbers with expiration dates.
Plaintiffs, after listing their objections, stated:
Subject to and without waiving the foregoing objections, and noting that investigation and discovery are ongoing, Plaintiff responds that [the Plaintiff] will produce all responsive non-privileged documents for the time period of July 1, 2014, through the present.
Thus, Marriott first asked for (among other things) the "last six digits of payment card numbers with expiration dates." Interrogatory No. 2. I have spot-checked some of the answers Marriott provided me, and I see that they provided either 4 to 6 of the credit card numbers. As I understand it, Marriott, in discussions with plaintiffs' counsel, then asked for all sixteen digits of the credit cards. Marriott has now asked me to make plaintiffs "disclose the 16-digit card numbers for all payment cards that they allege were misused because of the data security incident and permit Marriott to share those card numbers in Rule 45 subpoenas to third parties who have information relevant to Marriott's defense." Letter of August 19, 2020.
Plaintiffs protest that Marriott is asking me to compel something it never asked for in the first palace. Letters of September 2 and September 9. While that may be true, I am afraid that it does not get us anywhere. I suppose that technically I could require Marriott to amend its interrogatory to demand the sixteen digits and then await the plaintiffs' response.
But, we already know that Marriott wants the sixtee digits, and plaintiffs cannot find them even though they have made diligent searches into their own personal papers.
I would instead recommend to Judge Grimm that Marriott's interrogatory be deemed to be amended, by the parties' discussion and correspondence, to demand the sixteen digits of the credit card numbers.
I believe we could then solve the problem of an amended response to the now amended interrogatory. I recommend that I be permitted to deem counsel's statements to me that, despite a diligent effort, plaintiffs cannot find the sixteen digits in their papers to be a judicial admission that is binding upon them for all purposes and admissible under Fed. R. Evid. 801(2)(C). I am sure that plaintiffs appreciate that I am relying on their attorneys' representation's truthfulness on their behalf. Those representations will bind them for all purposes in this lawsuit.
But, Marriott could object that the pertinent Rule requires that a party, not their lawyer, answer an interrogatory. Fed. R. Civ. P 33(b)(1). If Marriott does so insist, then I recommend it be permitted to propound one additional interrogatory to each of plaintiffs asking them what efforts they made to find the sixteen digits among their personal effects.
If we do that and get the answer we expect-- they could not find them or get them from anyone else--the question of the burden upon plaintiffs to find them is moot, and I need not consider it. Nemo dat quod non habeat is the maxim. One cannot give what one does not have. If plaintiffs cannot find the numbers after a diligent search, we have a solid factual basis for that statement. There is no reason to consider whether it is burdensome to do anything more. That should also bring us closer to resolving this controversy, which has been troubling us for several months.
There is another problem, however. Plaintiffs protest that Marriott's demand that they try to get the sixteen-digit card numbers from their banks unreasonable. They insist that :
But Plaintiffs fail to see what that would accomplish: as we have repeatedly explained to Marriott, nearly all of the Plaintiffs no longer have those full payment card numbers, and obtaining these numbers is not as simple as calling the bank and asking for them as Marriott contends. Once fraudulent activity is reported on a card or account, the card/account is closed and marked as fraudulent, oftentimes preventing the bank from providing any additional information pertaining to the card or account.Letter of September 10, 2020.
The words "nearly all" and "oftentimes" hedge the bet. I, therefore, cannot say with the certainty that I want that all the plaintiffs asked all the banks for the sixteen digits and all of the banks told all of the plaintiffs that the banks did not have them. Until that showing is made, I cannot dismiss Marriott's demand that plaintiffs try to get the banks' information as futile and fruitless. I think one can make that judgment only after every effort by plaintiffs to get the sixteen-digit numbers has failed.
Therefore, I would instead recommend that we nail the facts down by permitting Marriott to ask plaintiffs (1) what efforts they each made to secure the sixteen digits from their banks or other third parties, (2) whether or not those efforts were successful, and (3) what the third party told them when plaintiffs sought the information. Marriott should also be permitted to request production of whatever documents the third parties made available to plaintiffs from the third parties when plaintiffs searched for the sixteen digits.
Plaintiffs also demand that Marriott do an investigation as a condition of getting any relief. They state:
Moreover, Marriott has never confirmed whether the payment cards that the Plaintiffs believe were impacted by the Data Breach were actually part of the data that hackers stole—despite our repeated discovery requests for such information. Allowing Marriott to obtain the full payment card numbers, so it can then serve subpoenas for nearly seven years of financial statements for these cards (which may not even have been part of the Data Breach)
is disproportional to the needs of the case. Marriott should first confirm that these payment card numbers were in fact, part of the Data Breach before it even arguably has any relevance to Marriott.Letter of September 10, 2020.
First, if Marriott had not responded to what plaintiffs describe as "our repeated discovery demands," plaintiffs should seek relief under the Stipulated Proposed Order Regarding Discovery Dispute Protocol. Until they do, and Marriott responds, I cannot find that Marriott has failed to provide discovery that plaintiffs have demanded.
Second, only the party who must comply with a subpoena can assert that doing so creates an unreasonable burden and is "disproportionate to the needs of the case." Thus, the subpoenaed parties can claim that the Marriott subpoena is overly burdensome or expensive. Fed. R. Civ. P 45(d). Those parties, if they see fit, may also claim that Marriott should avail itself of its resources before demanding compliance. While the subpoenaed parties can perhaps make that argument, plaintiffs cannot.
." Judge Chasanow has stated:
Defendant counters that the subpoena was issued to ViaSat, and not to Mr. Deibler; thus, Mr. Deibler faces no burden in complying with the subpoena. (ECF No. 23 at 4). The undue burden contemplated by Rule 45 is one placed on the direct recipient of the subpoena, ViaStat in this case, not on indirect third parties such as Mr. Deibler. See CineTel Films, Inc. v. Does 1-1,052, 853 F.Supp.2d 545, 556-57 (D.Md. 2012); see also Third Degree Films, Inc. v. Does 1-108, No. 11-3007, 2012 WL 669055, *3 (D.Md. February 28, 2010) ("[The] argument that the subpoena presents an undue burden is unavailing because the subpoena is directed toward the ISPs and not the Doe Defendants and accordingly does not require [the Doe Defendants] to produce any information or otherwise respond.") (quoting Third Degree Films, Inc. v. Does 1-118, No. 11-cv-03006-AW, 2011 WL 6837774, at *3 (D.Md. December 28, 2011)); Call of the Wild Movie v. Smith, 274 F.R.D. 334, 338 (D.D.C. 2011) ("The Plaintiff has issued subpoenas to the putative defendants' ISPs, not to the putative defendants themselves. Consequently, the putative defendants face no obligation to produce any information under the subpoenas issued to their respective ISPs and cannot claim any hardship, let alone undue hardship.").Dandridge v. Self Storage Servs., Inc., Civil Action No. DKC 14-2333, at *5-6 (D. Md. October 28, 2014)
Finally, plaintiffs in their objections insist that Marriott has in its custody and control what it seeks from them in a database. The plaintiffs indicate that Marriott should look there before demanding the information from them.
Marriott has reminded me that in an opinion I wrote when I was a magistrate judge I pointed out this is not a proper response to a request to produce. See McNamara v. Picken, Civil Action No. 11-1051, 2013 WL 2423804, at *3 (D.D.C. 2013) (Facciola, J.) ("[T]he courts have rejected as illegitimate any objection based on the supposition that the other party already has what it is demanding. A moment's thought shows how impractical such an objection can be. The demanding party cannot possibly know whether it has, in fact, all of the documents it is requesting, because neither side can know to a certainty what the other side has. It is preferable, easier, and more efficient to the producing party to produce what it has, so the demanding party can determine, with all the records in front of it, whether it has all the information it needs and wants.") I persist in that view. Marriott has a right to demand and receive what plaintiffs have, irrespective of what Marriott has. That right is not a function of what Marriott may or may not already have.
Use of street addresses in subpoenas
Marriott has also insisted that plaintiffs should permit them to use the plaintiffs' addresses and the full credit card numbers so Marriott can prepare subpoenas upon banks and other entities who may have information bearing on the misuse of plaintiffs' credit cards.
Street Addresses
We all must agree that Marriott has produced the addresses from publicly available sources on the internet, for it has attached that information to one of its filings, explaining the source for it. It then follows that the addresses are not "highly confidential" information subject to the Protective Order. It provides:
(l) "PH": Personally Identifiable Information, which, for purposes of this Order, includes, but is not limited to: payment card numbers, financial account numbers, social security numbers, addresses, phone numbers, email addresses, driver's license numbers, or other state identification numbers, employer identification numbers, tax identification numbers, passport numbers, or a foreign government equivalent of any of these numbers or identifiers, or other personal data that may, in combination, reveal sensitive PH.
It also provides:
(g) "Highly Confidential" Information: information (regardless of how generated, stored or maintained) that has not been made public or is not otherwise available or accessible in the public domain, and that the Designating Party believes: (i) concerns or relates to the highly sensitive personal, confidential, financial, commercial, proprietary, cybersecurity, competitively sensitive, or trade secret information of any Party or any third party; or (ii) contains "PH," personnel files, or personal contact information for any person.
Since Marriott has established that the addresses are in the public domain, they are not subject to the order.
The sixteen digits.
The next issue that must be resolved is whether the use of "PPI " (as defined in the Protective Order) in the subpoenas is permissible. The sixteen-digit credit card numbers are certainly PPI under the sections of the Protective Order quoted above.
If plaintiffs are willing to stipulate to the use of the sixteen-digit credit card numbers for this purpose, the parties can draft a stipulation to that effect. If not, and I am so advised, I intend to recommend to Judge Grimm that he issue an Order to Show Cause why the Protective Order should be amended to permit such use. That will permit all parties in all tracks to be heard as to this issue. I fear that whether there should be this use for other purposes than those specified in the Protective Order may arise again, and a thorough discussion of it is appropriate.
Plaintiffs' Recent Letter
In my most recent correspondence, I indicated that I was working on my Report and Recommendation and wanted to (1) receive any additional case authority on the Rule 45 question and (2) know whether there was an agreement as to the use of the addresses in the subpoenas Marriott contemplated sending to third parties.
Based on everything I had seen, I assumed that, as I indicated, I should proceed and resolve the legal issues presented by the August 19, 2020 letter. Nevertheless, as I read their most recent letter, plaintiffs are asserting that this would be unfair. They express their mystification as to the nature of the August 19, 2020 letter. They also assert that it is inappropriate to "rule in its favor without equitable briefing" because Marriott refused to confer with plaintiffs. They think it unfair to force them to address the three issues Marriott raised in its August 19, 2020 letter in a single five-page letter and that the August 19 letter should not be considered a formal motion.
They conclude their letter by stating:
In the case of Marriott seeking information, the prerequisite discovery has yet to be proffered to allow for any dispute to be raised or resolved. Moreover, Marriott's assertion that it can raise its three challenges in a single letter is inappropriate, a violation of the Stipulated Protective Order and the Discovery Dispute Protocol, and would prejudice Plaintiffs.Letter of September 10, 2020.
First, as we all know, I got involved in trying to resolve this dispute in April. To my chagrin, I have not been able to resolve it. Since I have been involved in the discussions, I am hard-pressed to understand why I should take Marriott to task because it did not tell me what I already knew—additional discussions on these issues would go nowhere, and Marriott was finished talking about them. No one knew that better than I did.
Second, Marriott served interrogatories and requests for production. Plaintiffs responded, and Marriott, in its August 19, 2020, complained about those responses and followed the Discovery Dispute Protocol's requirements to bring the dispute to me. I do not understand what "prerequisite discovery" must be done before I have to resolve the legal issues presented by Marriott's letter.
Third, I cannot require parties to meet and confer until one of them yells "Uncle." Marriott does not want to engage in any further discussions and wants judicial relief. That is its right, and I am now obliged to provide it.
Fourth, there is no such thing as a "formal motion. " Instead, the Protocol limits filings to a five-page letter and a five-page opposition. Once they are filed, the dispute is ripe. In this case, we have had two letters from each party. Marriott demanded specific relief, and the plaintiffs objected. Hence, I go to work and resolve the legal issues presented. That is exactly what I have done—finished this Report and Recommendation and submitted it to Judge Grimm.
Recommendations
For the reasons stated, I make the recommendations specified below, and that Judge Grimm should adopt the following determinations I have made:
1. The Federal Rules of Civil Procedure do not permit a party to redact information in the documents it produces. Instead, plaintiffs must either produce unredacted documents or, if it wishes to redact information from a document, plaintiffs must first describe the nature of the redaction "without revealing information itself privileged or protected" to enable "other parties to assess the claim." See Fed. R. Civ. P 26(b) (5)(ii).
2. Marriott may use the plaintiffs' street addresses in subpoenas it issues to third parties since those addresses are now in the public domain and are therefore not subject to the Protective Order.
3. Marriott's interrogatories and requests to produce documents should be deemed amended to demand the sixteen digits of the credit cards Marriott seeks.
4. Plaintiffs should be deemed to have admitted that they cannot find the sixteen digits of the credit cards.
5. If Marriott objects to paragraph 4, Marriott should be permitted to serve additional interrogatories and requests for production asking plaintiffs to state (1) what efforts they each made to find the sixteen digits in their personal papers or secure the 16 digits from their banks or other third parties, (2) whether or not those efforts were successful, and (3) what the third party told them when the plaintiffs sought information from them. Marriott should also be permitted to request production of whatever documents the third parties made available to the plaintiffs when the plaintiffs asked that party for the sixteen digits.
6. If plaintiffs do not agree to the use of the sixteen-digit numbers in the subpoenas that Marriott will serve on third parties, Judge Grimm should issue an order to show cause why the Protective Order should not be amended to permit such use by any party in this lawsuit.
/s/_________
JOHN M. FACCIOLA
SPECIAL MASTER September 14, 2020