Opinion
24cv1646(DLC)
10-11-2024
SKILLZ PLATFORM INC., Plaintiff, v. PAPAYA GAMING, LTD. et al., Defendants. PAPAYA GAMING, LTD. et al., Counterclaim Plaintiffs, v. SKILLZ PLATFORM INC., Counterclaim Defendant, and TETHER STUDIOS, LLC, et al., Additional Counterclaim Defendants.
For plaintiff Skillz Platform Inc. Craig Carpenito Amy Katherine Nemetz Jessica C. Benvenisty King & Spalding LLP Lazar Pol Raynal Michael Anthony Lombardo King & Spalding LLP For defendants Papaya Gaming, Ltd. and Papaya Gaming, Inc.: Anthony Joseph Dreyer Jordan Adam Feirman Michael A. McIntosh Skadden, Arps, Slate, Meagher & Flom LLP One Manhattan West New York, NY 10001 David B. Leland Margaret E. Krawiec Skadden Arps Slate Meagher & Flom LLP 1440 New York Avenue, N.W. Washington, DC 20005
DENISE COTE, DISTRICT JUDGE
For plaintiff Skillz Platform Inc. Craig Carpenito Amy Katherine Nemetz Jessica C. Benvenisty King & Spalding LLP Lazar Pol Raynal Michael Anthony Lombardo King & Spalding LLP
For defendants Papaya Gaming, Ltd. and Papaya Gaming, Inc.: Anthony Joseph Dreyer Jordan Adam Feirman Michael A. McIntosh Skadden, Arps, Slate, Meagher & Flom LLP One Manhattan West New York, NY 10001 David B. Leland Margaret E. Krawiec Skadden Arps Slate Meagher & Flom LLP 1440 New York Avenue, N.W. Washington, DC 20005
OPINION AND ORDER
DENISE COTE, DISTRICT JUDGE
The parties dispute the necessity of using procedures established by the Hague Convention on the Taking of Evidence Abroad in Civil and Commercial Matters, opened for signature Mar. 18, 1970, 23 U.S.T. 2555 ("Hague Convention"), to obtain discovery requested by plaintiff Skillz Platform, Inc. ("Skillz") from defendants Papaya Gaming, Ltd. and Papaya Gaming, Inc. (collectively, "Papaya"). While the parties have narrowed their dispute, Papaya continues to assert it may not produce employee communications or company documents outside of Hague Convention procedures, due to Israeli data protection law. For the following reasons, Papaya's objection to Skillz obtaining discovery from it without using Hague Convention procedures is overruled.
Background
Skillz is a United States-based corporation that operates a mobile gaming platform. Papaya Gaming, Ltd. is an Israeli corporation that operates a mobile gaming platform in competition with Skillz. On March 4, 2024, Skillz filed this action, asserting false advertising and deceptive practices claims against Papaya. It alleges that Papaya told consumers they would play against other human beings when in fact they were playing against robots.
One of the defendants in this action, Papaya Gaming, Inc., is not Israeli but rather is a Delaware corporation. Papaya's counsel reports that company is a subsidiary of the Israeli defendant, Papaya Gaming, Ltd., has no employees or office space, and is physically nothing more than a mailbox. So this Opinion follows the parties in focusing on the Israeli defendant, Papaya Gaming, Ltd.
On June 26 and 27, 2024, Skillz served two sets of requests for production on Papaya. The requests focus on a range of materials, largely related to Papaya's alleged use of "bots" in the mobile games hosted on its platform and Skillz's requests for damages. On June 28, a protective order, stipulated to and proposed by the parties, was entered. That Order allows the parties to designate material as confidential, and it requires them to maintain safeguards and limitations on its storage, access, and use.
On July 23, the defendants' motion to dismiss was denied. Skillz Platform Inc, v. Papaya Gaming, Ltd., No. 24cv1646 (DLC), 2024 WL 3526853 (S.D.N.Y. July 23, 2024). In a July 30 letter to the Court reporting on the parties' Rule 26(f) conference, Papaya noted that the requirements of the Hague Convention were a relevant consideration in setting any schedule for discovery "given that Skillz seeks extensive discovery from Israeli data depositories" and the "strict Israeli data protection laws." Papaya has since disclosed that there are no Israeli data depositories; its document depositories reside in the European Union.
On August 5, 2024, Papaya answered Skillz's complaint and filed counterclaims against Skillz, as well as against several other game developers. Mirroring Skillz's allegations against it, Papaya accused Skillz of misrepresenting to consumers that they would be playing against only human beings in Skillz's games, when in fact Skillz included robots in its games. Among other allegations, Papaya accused Skillz of defaming it and alleged that Skillz and the other developers infringed on its trademarks. Skillz moved to dismiss the counterclaims against it on September 4, and Papaya amended its counterclaims on September 23.
On the eve of a September 6 pretrial conference, Papaya served its responses and objections to Skillz's requests. In response to the vast majority of Skillz's requests, Papaya lodged objections and did not agree to search for or produce information. In its general responses and objections, Papaya asserted that Israel's data protection laws "bar Papaya from collecting and transferring a significant portion of the nonpublic responsive documents and information to the United States absent an Israeli court order."
At the pretrial conference on September 6, Papaya further articulated its position that Skillz's discovery requests needed to be submitted through Hague Convention procedures for Papaya to avoid liability for violation of Israeli data protection law. An Order of the same day directed the parties to each submit letters explaining their positions on this objection. It also required fact discovery on the claims between Skillz and Papaya to be completed by February 28, 2025. Following a period for expert discovery, a Pretrial Order is due to be filed on May 30, 2025 in the event there is no summary judgment practice.
Papaya submitted its letter regarding Israeli data protection law on September 13; Skillz submitted a letter in response on September 20. Along with the letters, both parties submitted declarations of Israeli lawyers with experience in the Israeli law of privacy and data protection. Those experts reached different conclusions about whether Israeli privacy law bars Papaya's production of requested documents without resort to the Hague Convention.
In its September 13 submission, Papaya maintained that the Hague Convention was the "sole mechanism" Skillz could use "to obtain [nonpublic] evidence from Papaya in this matter." It argued that Israeli privacy law restricted the "collection, review, and transfer" of materials containing "personal information" of its customers and employees, "defined broadly to encompass virtually any identifying characteristics of an individual, including an email address." Papaya did not explain where the servers containing its corporate records were located.
In its September 20 submission regarding foreign discovery, Skillz revealed that Papaya had refused to disclose the location of its servers and databases, taking the position that the location was irrelevant. Skillz explained that the data in Papaya's possession, specifically "gameplay logs, tournament information, statistics, source code, including bot codes, and Papaya's internal communications acknowledging the presence of bots on its platform," were critical to the litigation. It noted that Papaya had already disclosed its employees' identities in its initial disclosures.
An Order of September 23 required the parties to confer regarding five issues enumerated in Skillz's September 20 letter addressing outstanding discovery disputes. In a joint letter of October 1, the parties reported that their disputes over Skillz's discovery demands, including regarding the necessity of Hague Convention procedures, had significantly narrowed. In a conference later the same day, Papaya's counsel explained that it had agreed to produce anonymized customer data, including "game log data" that would bear on Papaya's alleged use of "bots," outside of Hague Convention procedures. Papaya's counsel further explained, however, that the company still objected to producing "employee data," including data that would need to be collected from employee devices, as well as "internal employee emails and employee communications."
An Order of October 1 directed Papaya to submit a letter responding to the Court's inquiries at the conference and providing any additional facts relevant to its position on employee communications, and it did so on October 8. That letter revealed that the corporate records, including its employees' company-provided email accounts, are stored on Google Drive in servers residing in the European Union. Papaya provides its employees with laptops and in some cases phones. While employees might sometimes save files locally on their
laptops, employees typically save company documents on Google Drive, via their individual, company-provided Google Drive accounts. Papaya can search for both employee emails and company documents saved on Google Drive using a "central administrator account on an administrator device." Finally, Papaya explained that it would no longer resist producing personal information of consumers found in its data repositories, including gameplay logs and related data, because of the consumers' agreement to Papaya's Terms of Use and Privacy Policy.
Discussion
The parties currently dispute whether Papaya should be ordered to respond to the plaintiff's discovery demands for company documents relevant to its claims, including emails of its employees, stored on servers located in the European Union. Papaya takes the position that Israeli privacy law requires Skillz to pursue these materials through the Hague Convention procedures.
Federal courts may, but are not required, to resort to the Hague Convention for conducting foreign discovery. The United States and Israel are both signatories of the Hague Convention, which "prescribes certain procedures by which a judicial authority in one contracting state may request evidence located in another contracting state." Societe Nationale Industrielle Aeropostiale v. U.S. Dist. Ct., 482 U.S. 522, 524 (1987). Those procedures include a process for sending "Letters of Request," whereby a judicial authority in one state sends a request to a designated central authority in another state, which then executes the request in accordance with the receiving state's internal law. Hague Convention arts. 2-14.
In Societe Nationale, the Supreme Court addressed the question whether litigants must resort to such procedures prior to taking discovery under the Federal Rules of Civil Procedure. The Court ruled that the Hague Convention did not divest the federal courts of jurisdiction "to order a foreign national party before it to produce evidence physically located within a signatory nation." Id. at 539-40. The Hague Convention procedures are merely a "permissive supplement" to other means of foreign discovery, not "exclusive and mandatory." Id. at 529, 536. Nor are litigants required to use them as a "first resort," because the procedures would in some cases be "unduly time consuming and expensive, as well as less certain to produce needed evidence than direct use of the Federal Rules." Id. at 542. Nevertheless, "American courts should . . . take care to demonstrate due respect for any special problem confronted by the foreign litigant on account of its nationality or the location of its operations, and for any sovereign interest expressed by a foreign state." Id. at 546.
The Court declined to "articulate specific rules" for balancing these considerations, but the Second Circuit Court of Appeals has listed several factors to guide the analysis: "the competing interests of the nations whose laws are in conflict," "the hardship that compliance would impose on the party or witness from whom discovery is sought," "the importance to the litigation of the information and documents requested," and "the good faith of the party resisting discovery." First Am. Corp, v. Price Waterhouse LLP, 154 F.3d 16, 22 (2d Cir. 1998) (citation omitted). Other considerations include whether the party resisting discovery under the Federal Rules is a litigant in the case at hand, id. at 21, and whether the Hague Convention "offer[s] a meaningful avenue of discovery in the present case," id. at 23 (citing Societe Nationale, 482 U.S. at 542-44).
The present circumstances do not call for Skillz to resort to the Hague Convention, as almost all the applicable factors weigh against such a requirement. Most importantly, the record before the Court does not reflect that there is a true conflict between Israeli law and the discovery demands at issue.
I. Competing Interests of the United States and Israel
As articulated in the Federal Rules, the United States has an interest in the "just, speedy, and inexpensive determination of every action and proceeding" in its courts. Fed.R.Civ.P. 1. And a "fundamental maxim of discovery" is that "[m]utual knowledge of all the relevant facts gathered by both parties is essential to proper litigation." Societe Nationale, 482 U.S. at 540 n.25 (citation omitted). Israel has an interest in the privacy of its citizens and of effecting its legislature's chosen policies on consumer protection, data security, and the like through its national law.
But the existence of any competing interests rests primarily on whether U.S. and Israeli laws are actually in conflict, which the parties dispute. See Filetech S.A, v. France Telecom S.A., 157 F.3d 922, 928 (2d Cir. 1998) (describing the question whether a "true conflict" exists between U.S. and foreign law as a threshold issue for comity analysis), overruled in part on other grounds, Lotes Co., Ltd, v. Hon Hai Precision Indus. Co., 753 F.3d 395, 398 (2d Cir. 2014); In re Maxwell Commnc'n Corp, plc by Homan, 93 F.3d 1036, 1049 (2d Cir. 1996) ("International comity comes into play only when there is a true conflict between American law and that of a foreign jurisdiction." (citation omitted)). A lack of actual conflict between the Federal Rules and Israeli law would imply that, at least for present purposes, both countries' interests can be accommodated. After all, Papaya's objection at issue here is not to ever producing the materials at issue, but rather to producing them outside of the Hague Convention procedures.
Papaya previously objected separately to many of Skillz's requests pursuant to the Federal Rules. Those objections are not addressed in this Opinion, and the parties report that they have been largely resolved anyway.
A. Findings of Israeli Law
"Determination of a foreign country's law is an issue of law." Itar-Tass Russian News Agency v. Russian Kurier, Inc., 153 F.3d 82, 92 (2d Cir. 1998) (citing Fed.R.Civ.P. 44.1). "In determining foreign law, the court may consider any relevant material or source . . . ." Fed.R.Civ.P. 44.1. A district court considering opposing experts' views on foreign law, for instance, evaluates the "persuasive force of the opinions they expressed." Itar-Tass Russian News Agency, 153 F.3d at 92; see also Branch of Citibank, N.A. v. De Nevares, 74 F.4th 8, 19 n.9 (2d Cir. 2023).
The declaration of Skillz's expert, Noga Rubinstein, is far more robust and reliable in its description of Israel's Privacy Protection Law ("PPL") and Data Transfer Regulations. Indeed, nothing in the declaration of Papaya's expert, Dan Hay, contradicts or calls into question the reliability of Rubinstein's detailed description of Israeli law.
Hay's declaration has proven to be in error in several material respects. For instance, Hay attested that, with respect to Skillz's discovery demands, Papaya's users "have not consented to such disclosures," and that obtaining their consent "is not a feasible option." Papaya now admits that it can produce consumer data "based on consumers' agreement to Papaya's Terms of Use and Privacy Policy." In addition, Hay stated that Israeli law would shield even the names of individuals, and that employees could not validly consent to being identified. But Papaya disclosed the names of individual employees in its initial disclosures.
Based on these experts' declarations, the Court finds that Israeli law does not require that discovery of Israeli companies that are parties to a proceeding before a foreign court, including litigation filed in a United States court, use the Hague Convention procedures. In this regard it is telling that neither expert cites any decision by an Israeli court in which an Israeli company has been found to violate the PPL by complying with a foreign nation's discovery protocols. Nor has either expert referenced any civil or criminal enforcement action against an Israeli company or individual on that basis.
According to the experts' declarations, Israeli data protection law operates as follows. The PPL, which was enacted in 1981, governs the handling of certain "data." "Data" is defined as "information on the personality, personal status, intimate affairs, health status, economic position, vocational qualifications, opinions and beliefs of a person." The PPL confers protection only on data concerning natural persons, not on data pertaining to corporations. Even with respect to personal information, however, documents that contain only "deidentified" data are not considered "data" under the PPL. Whether data has been sufficiently deidentified depends on whether a "reasonable person" could reidentify the person, and on who is receiving the deidentified data.
Hay also mentions that Israel's Basic Law: Human Dignity and Liberty created a constitutional right to privacy. But he acknowledges that the PPL "serves as the primary legal framework for matters concerning the right to privacy in Israel." And, as Rubinstein explains, the Basic Law restricts the government's intrusion on a person's privacy, not that of a private company.
The Israeli Minister of Justice promulgated Data Transfer Regulations, pursuant to the PPL, in 2001, but the regulations only apply to the transfers of data from databases in Israel to databases outside of Israel. And even with respect to databases in Israel, the regulations allow for transfers of data to countries whose law "ensures a level of data protection which is no less, mutatis mutandis, than the level of data protection prescribed by Israeli law." The regulations incorporate by reference exceptions from the European Union's General Data Protection Regulation, which allow transfers of data for the defense against legal claims, including "for the purpose of formal pre-trial discovery procedures in civil litigation." Another exception allows transfer among parties who have stipulated to protect the data under conditions consistent with Israeli law. Finally, the PPL grants a "good defense" from enforcement to anyone who otherwise violates the law, so long as "the violation was committed under circumstances in which the perpetrator had a legal, moral, social or professional duty to do so."
B. Israeli Law's Application to Skillz's Demands
There are several bases for concluding that Israeli law does not prevent Skillz from taking discovery from Papaya outside of Hague Convention procedures. The requested data pertains to Papaya, a corporation, not to natural persons. To the extent the Data Transfer Regulations apply at all, they allow for the transfers at issue here on two independent grounds: the transfer would be necessary for the defense of legal claims, and the materials at issue would be covered by the June 28 protective order. And even if the requested materials did fall under the PPL, the law contains a ready-made defense for Papaya, which would be acting under a legal duty to produce them.
Rubinstein notes that the PPL requires PPL-covered databases to be registered with the Privacy Protection Authority. Papaya has not registered any database with the Authority, which is consistent with the notion that its data does not fall under the PPL.
Even though there is no basis to find that Papaya's company documents are covered at all by the PPL, Papaya argues that they are. Papaya claims that "company documents," which reside on servers outside Israel, cannot be produced or even searched because the documents were "primarily saved" by individual employees on Google Drive. But that logic -- which would shield any corporate document just because it is stored in a filesharing system accessible by human beings -- does not square with the PPL's explicit exclusion of corporations.
Papaya next contends that its employees' company-provided email accounts stored on Google servers located in the European Union cannot be searched without violating the PPL because such a search would involve "accessing all of the personal information and emails stored in an employee's mailbox," which would be "a significant intrusion into the privacy of employees." As already explained, there are multiple grounds to find that the PPL does not apply to these business records, and that Papaya is fully protected from any assertion that it has violated that law by complying with United States federal court discovery obligations. There is also no basis to find that any search for information relevant to the conduct of Papaya's business will intrude on any individual's privacy. In practical terms, the searches at issue here will be of business email accounts belonging to identified custodians using agreed upon search terms.
Papaya suggests that relevant company documents may exist only on the individual work-provided laptops and not be accessible through a search of the company's servers. If that proves to be true, the parties should confer regarding which employees' laptops must be retrieved and searched. There is no reason to find, based on Papaya's submissions, that such a search of company records on a company-issued laptop would subject Papaya to liability under the PPL, but other issues regarding the proper scope of discovery may be implicated.
II. The Remaining Comity Factors
There is no basis to find that Israeli law requires Skillz to use the Hague Convention to obtain the discovery it seeks of Papaya. Nonetheless it is useful to consider the other factors identified by courts as relevant to Papaya's arguments. See First Am. Corp., 154 F.3d at 21-22. These other factors, taken together, further weigh against requiring the use of Hague Convention procedures.
A. Hardship of Compliance
First, there is no reason to think that the hardship of compliance on Papaya will be any different than that of a litigant in any other commercial litigation involving companies that handle large amounts of data and do business in multiple countries. Papaya has millions of U.S. customers, and its data and business information relate directly to the representations it has made to American consumers. While prosecution by Israeli authorities would certainly present hardship, Papaya has not shown any likelihood of a prosecution for complying with American discovery requirements. It is noteworthy that Israeli law includes a clear defense for these circumstances in the event any disclosure were made of information covered by the PPL.
B. Importance to the Litigation
Second, the discovery at issue is important to the litigation at hand and Papaya does not suggest otherwise. Central to this case, for instance, is Skillz's allegation that Papaya uses "bots" in games hosted on its online platform. Most of Skillz's requests are aimed at materials that would disclose whether that is or is not true, and the damages that might be available if it were true.
The centrality of the requested information to this litigation is underscored by Papaya's counterclaims. Those counterclaims rely on the same kind of information sought by Skillz, in that they accuse Skillz of using robots itself and allege that Skillz defamed Papaya in claiming that Papaya uses robots. Papaya will want reciprocal discovery from Skillz, and the parties' negotiations over the scope of their discovery obligations have taken that issue under consideration. Papaya will also need to produce evidence regarding its own business practices -- indeed the very evidence Skillz now seeks -- to prove that Skillz defamed it.
C. Good Faith
There are several reasons to question whether Papaya's invocation of the PPL has been in good faith. For instance, as Skillz points out, Papaya delayed for months in explaining to Skillz why Skillz had to use Hague Convention procedures to obtain any discovery materials. And it would not disclose where its data was located until the Court itself inquired. Its expert's declaration was far more conclusory than that submitted by Skillz's expert, which was detailed and supported by relevant citations. Papaya initially took the extreme position that almost everything Skillz requested was protected by Israeli law -- a position that it now seems to admit was in error. The parties are commended for narrowing their dispute through conferral, but this series of events casts doubt on Papaya's latest position, which is extraordinarily far-reaching. Given the other grounds for concluding that Hague Convention procedures are unnecessary, however, there is no need to reach a conclusion on this factor.
D. Involvement in the Litigation
The Second Circuit has noted that although the Federal Rules do not distinguish between discovery of parties and of nonparties, resorting to Hague Convention procedures may be appropriate where the party resisting discovery is not a litigant. First Am. Corp., 154 F.3d at 21. No such consideration exists here. Papaya is a party and has not contested that is subject to the jurisdiction of this Court. It has also brought numerous counterclaims against the plaintiff and other companies. If Papaya's position were accepted, this litigation would unfold on a distinctly uneven playing field. Papaya would take discovery of its adversaries using all the tools available under the Federal Rules, while insisting they rely on a lengthy and limiting process to gather the same kinds of information from it. Papaya's status as a party to this litigation and equity counsel strongly against using Hague Convention procedures.
E. Discovery Offered by Hague Convention Procedures
Requiring the use of Hague Convention procedures for categories of business information which are routinely discoverable in commercial litigation would substantially delay this matter's adjudication, or, even worse, may prevent full discovery from taking place at all. The Supreme Court has noted that the Hague Convention's procedure for submitting a Letter of Request can be "unduly time consuming and expensive, as well as less certain to produce needed evidence than direct use of the Federal Rules." Societe Nationale, 482 U.S. at 542.
The Hague Convention provides that foreign discovery takes place pursuant to the foreign state's internal law governing its internal proceedings. See Hague Convention art. 10. Hay's declaration explains that, per Hague Convention procedures, an "Israeli court will review the Plaintiff's requests under Israeli law" and will provide Skillz "with the requested information in a manner and scope deemed appropriate by the Israeli court." This process raises the prospect of substantial delay, as well as a narrowing of the discovery that would otherwise be available under the Federal Rules. And it is in considerable tension with Papaya's commitment to "afford[] Skillz a full opportunity to obtain its requested evidence."
Conclusion
Papaya's objection to producing otherwise discoverable materials outside of the Hague Convention is overruled. Discovery shall proceed pursuant to the Federal Rules.