Opinion
No. 107678
10-03-2019
ALLIED DEBT COLLECTION OF VIRGINIA, L.L.C., Plaintiff-Appellee, v. NAUTICA ENTERTAINMENT, L.L.C., et al., Defendants-Appellants.
Patrick J. Milligan Co., L.P.A., and Patrick J. Milligan, Beachwood, for appellees. Hahn Loeser & Parks, L.L.P., Eric B. Levasseur, Anna Leigh Gecht, and Dennis R. Rose, Cleveland, for appellants.
Patrick J. Milligan Co., L.P.A., and Patrick J. Milligan, Beachwood, for appellees.
Hahn Loeser & Parks, L.L.P., Eric B. Levasseur, Anna Leigh Gecht, and Dennis R. Rose, Cleveland, for appellants.
JOURNAL ENTRY AND OPINION
MICHELLE J. SHEEHAN, J.: {¶1} Defendants-appellants Nautica Entertainment, L.L.C., Jacobs Entertainment, Inc., Jacobs Investments, Inc., and Mary Horoszko (collectively "Nautica" or "Nautica Defendants") appeal from the trial court's order compelling the production of the electronically stored information ("ESI"), or "mirror image," of "all Nautica's computers used by Mary Horoszko." Because we find the trial court's order was warranted under the circumstances, yet failed to establish adequate protections to safeguard the confidentiality of the information contained on the computer systems to be imaged, we affirm in part, reverse in part, and remand.
Procedural History and Substantive Facts
{¶2} On May 23, 2017, plaintiff-appellee Allied Debt Collection of Virginia, L.L.C. ("Allied") filed a complaint against the Nautica Defendants, Jeffrey Livingston, and Chad Barth for actions stemming from a Kid Rock concert held at the Jacobs Pavilion in the Nautica Entertainment Complex during the 2016 Republican National Convention. Allied states that it is a Virginia limited liability company and assignee of any tort claims belonging to Blue Star Productions, L.L.C. ("Blue Star"). The complaint alleged tortious interference with a contract between Concerts for a Cause, Inc. ("CFAC") and Blue Star, Virginia statutory business conspiracy, fraud, theft in violation of R.C. 2307.61, and civil conspiracy. Barth is President and a director of CFAC. Livingston is allegedly the fundraiser who handled all negotiations on behalf of CFAC and Barth.
{¶3} According to Allied, Blue Star had contracted Kid Rock, among other acts, to perform concerts during the convention, and Blue Star searched for a venue in Cleveland for its concerts. Blue Star ultimately rented Jacobs Pavilion, which is owned and operated by Nautica Entertainment, through CFAC, under a shared-use arrangement whereby Blue Star agreed to promote and produce its music concerts at Jacobs Pavilion in exchange for providing CFAC with 1,200 Blue Star issued tickets to the Kid Rock concert. CFAC could in turn allocate the tickets to sponsors and guests. Allied claims that Nautica Defendants tortiously interfered with Blue Star's arrangement with CFAC and conspired with CFAC to circumvent Blue Star's ticketing process by issuing unauthorized wristbands to third parties for entry to the concert. Allied maintains that this scheme resulted in thousands of people accessing the Kid Rock concert without a Blue Star ticket, in contravention of the Blue Star/CFAC arrangement.
Discovery
{¶4} On September 6, 2017, the court held a case management conference during which the court scheduled a paper discovery cutoff of November 6, 2017. During the conference, the parties agreed to forego electronic discovery and would exchange paper discovery only.
{¶5} The parties exchanged written discovery. Discovery disputes ensued, with both sides claiming discovery abuses. On April 5, 2018, Allied filed a motion to compel Nautica Defendants and Jeffrey Livingston to respond to Allied's request for interrogatories and requests for production of documents. Regarding Nautica Defendants, Allied claimed that Nautica failed to fully answer several interrogatories and failed to produce numerous requested documents. Both Nautica Defendants and Livingston opposed the motion. Thereafter, the parties entered into a stipulated protective order. On June 11, 2018, the trial court granted Allied's motion to compel, ordering Nautica and Livingston to respond to discovery within five days from the date of the order or face sanctions. Nautica Defendants served amended and supplemental discovery responses, which included 2,495 additional pages of documents.
{¶6} Claiming Nautica's amended and supplemental discovery responses were still deficient, Allied filed a motion to show cause on July 25, 2018. Within this motion, Allied requested ESI for the first time. In its motion to show cause concerning Nautica Defendants' paper discovery, Allied claimed that Nautica Defendants "habitually engaged in dilatory tactics, failed to meet their discovery obligations, and engaged in a rolling document production." In referencing the documents it had received in response to its requests, Allied noted that it had received a purportedly "altered email chain" between Horoszko and Chad Barth of CFAC. In a footnote to this reference, Allied explained that Barth's email production included an email that contained the word "wristbands" in two locations, while Horoszko's production of that same email exchange did not:
Barth's email production: Wire I'm working on as we speak...will let you know amount and confirmation # shortly. Wristbands we're working on a plan and executing it within the next hour. * * * How many of those 4,450 do you have? How many are committed to sponsors? I need the wristbands and info about today's wire. Please and thank you.
(Emphasis added.)
Horoszko's email production: Wire I'm working on as we speak...will let you know amount and confirmation # shortly. * * * How many of those 4,450 do you have? How many are committed to sponsors? I need info about today's wire. Please and thank you.
{¶7} Allied had therefore surmised that Horoszko had altered her email to delete all references to "wristbands." Consequently, within this footnote, Allied "request[ed] the court order Nautica to produce the doctored email in native format." Nautica Defendants opposed Allied's motion, along with this new request. On August 14, 2018, Nautica Defendants also filed a motion to compel responses to its written discovery requests propounded upon Allied, which the court ultimately held in abeyance.
August Hearing
{¶8} The court held a hearing on August 15, 2018, during which the parties were scheduled to address Allied's motion to show cause on the alleged discovery issues. At the hearing, however, the court informed the parties that the hearing would instead address "some emails that were exchanged that caused concern to [Allied], who is now asking for further information from [Nautica Defendants]." And the parties proceeded to address the purportedly altered email.
{¶9} During the hearing, Allied expanded its initial footnote request for "the doctored email in native format" to include all email communications, requesting "e-discovery with respect to Nautica's emails" and "an order * * * requiring Nautica to produce the electronic email communications in their native e-discovery format." (Emphasis added.) Allied argued that ESI discovery is inherent in its document request and that one altered email suggests there may be more, thus justifying the need for ESI. Nautica opposed Allied's new request, arguing that the parties agreed at the case management conference that the parties would exchange paper discovery due to the timing and cost concerns associated with electronic discovery, the parties had not been previously subjected to produce any ESI, there had been no discussions concerning the proper ESI protocols, Allied had the opportunity to depose Horoszko on the altered email, and ordering ESI now would result in an undue burden and unfair cost to Nautica Defendants. Without offering any explanation concerning the conflicting emails, Nautica's counsel stated only that Nautica Defendants "dispute that there was something inappropriate done with that email."
{¶10} Acknowledging that this hearing pertained only to the allegedly altered email, the court inquired of Nautica whether there were any other reasons the court should not order ESI discovery in this matter, to which Nautica Defendants replied that they have abided by the previously agreed upon discovery procedure, discovery in the case has become extremely costly, and they believe ESI discovery would be unduly burdensome and inappropriate. The court then ordered ESI discovery "with respect to [Allied's] request motion," noting that it had not heard "any specific reasons why it's too burdensome despite the normal, you know, costs of litigation that this is, according to Plaintiff seeking a $4.5 million verdict, that would require me to not order this." After ordering the ESI discovery of "all the emails," the court instructed the parties' two IT experts to confer on the issue. Thereafter, the court advised the parties that its order would be journalized. A review of the record, however, reveals that no journal entry was entered.
September Hearing
{¶11} On September 5, 2018, the court held a hearing on Allied's motion to show cause regarding Nautica's responses to Interrogatory Nos. 7 and 12-14 and Document Request Nos. 4, 30, and 36. During the hearing, the court found Nautica Defendants in contempt for their failure to sufficiently respond to Allied's discovery requests, stating "It's been admitted by both parties that they didn't provide documents. They refer to someone else's production of documents and that they didn't understand what the word ‘communication’ meant and that — this has been going on long enough, and it needs to stop." The court then instructed Allied to produce information pertinent to sanctions against Nautica, such as attorney fees. The court also discussed scheduling a hearing on Nautica Defendants' motion to compel.
{¶12} Additionally, at the September hearing, the court addressed "the altered email issue." In its opening statement, Allied's counsel argued that there are two main issues the court should consider in granting its motion to show cause — the financial issues or records concerning Livingston that had not been fully produced and the communications between the parties that revealed a discrepancy in emails between Barth and Horoszko that referenced wristbands. Livingston's counsel asserted that Allied indeed obtained all the requested records. Counsel for Nautica Defendants asserted that Nautica had fully responded to all discovery requests, including "thousands of emails."
{¶13} In addressing Allied's second issue, the altered email issue, Nautica's counsel represented that the parties had numerous "productive discussions," presumably off the record, regarding how to go about conducting the search, electronically, but the parties disagreed on the scope of the search. Counsel also informed the court that Allied apparently expanded its request for ESI once again, now seeking more than the emails associated with Horoszko:
Your Honor, as I believe the court will hear, what the plaintiffs have proposed is effectively to have a third-party outside vendor come in and do a complete image of Ms. Horoszko's computer. And it's unclear to me whether they've suggested that the servers should also somehow be included. But they've at
least I believe said Ms. Horoszko's computer.
{¶14} Counsel then noted his concerns regarding potential attorney-client privilege and other confidential or proprietary information and the risk of placing this information in the hands of a third-party vendor with no restrictions. Counsel further argued that "anything beyond the email-related data would be wholly irrelevant, [ ] overbroad, and beyond what this court had ordered at the last hearing." In response, the court stated:
Okay. So I see a very simple and easy solution to solve these things. That is a confidentiality protective agreement with the third-party vendor which is done pretty routinely whenever there's a third-party vendor who images a computer and also an opportunity for your IT person to identify as — in conjunction with the mirror image exactly what communications came from your firm. It's not that hard to do. * * * Write up an agreement, and you're done.
{¶15} Nautica's counsel indicated that he would be willing to propose an order that would provide "strict limitations on what [the] third-party vendor could do with this information," because the parties had yet to agree on the parameters for the ESI search. In response, Allied's counsel once again linked the ESI issue with its original motion to compel interrogatories, noting that the altered email was revealed during the initial discovery exchange, and counsel agreed that there should be an order in place concerning the ESI.
{¶16} After the majority of the September hearing was spent discussing specific interrogatories and document requests and the court found Allied's motion well taken and found Nautica in contempt concerning "document dumps" and "misunderstanding communications," Allied's counsel raised the ESI issue. The court asked Nautica Defendants if there was any reason they could not create a confidentiality agreement concerning the ESI. Nautica objected on the grounds that the request for ESI was overbroad and not consistent with what had been discussed at the August hearing; however, counsel indicated that he would work with opposing counsel to craft an order that would ensure the necessary confidentiality safeguards. At this point, the court stated, "You had this opportunity for all this time, and now we're down to this where I have to order a mirror image of a computer to get this information to Plaintiffs. I'm not going to take it anymore. Write an order, protective order. I'll sign it, and we'll just get it done." The court then noted that "[w]e'll sort out attorney-client privileges, in camera inspections. Just bring them to me."
{¶17} According to Nautica Defendants, they attempted in good faith to reach an agreement with Allied on a joint stipulated ESI order but were ultimately unable to agree on the terms, including the time in which Nautica could conduct a privilege review and the search methodology utilized to protect against the disclosure of proprietary and confidential information. Thereafter, the parties each filed a proposed ESI order. Nautica objected to Allied's proposed order.
The Trial Court's Discovery Order
{¶18} On September 12, 2018, the court issued the following order:
Hearing held for plaintiff's motion to show cause why defendants should not be held in contempt for violating this court's order compelling discovery. Defendants found in contempt of court for their failure to respond with particularity to interrogatories and requests for documents. Plaintiff to propose any adverse inference of fact relative to documents/information not produced to be considered by the jury and provide defense
counsel with affidavit detailing attorney fees and expenses related to the efforts to compel discovery, preparation of the motion, and prosecuting the show cause hearing. Attorney fees hearing to be set. Defendant's duty to comply with all discovery continues and is ongoing.
Defendants ordered to provide mirror image of all Nautica's computers used by Mary Horoszko through third-party vendor. See ESI order adopted and incorporated herein and entered under separate entry.
{¶19} Expanding Allied's request for "e-discovery with respect to Nautica's emails," the trial court ordered Nautica Defendants to produce a "mirror image of all Nautica's computers used by Mary Horoszko." In so doing, the trial court adopted and incorporated into its order Allied's entire proposed ESI order verbatim. That order compelled ESI, utilizing the third-party vendor engaged by Allied, Vestige, with the following limitations and conditions:
1. Vestige shall collect the requested ESI from Nautica and Horoszko by imaging and inventorying (i) the Nautica computer regularly used by Horoszko and (ii) any production/non-backup server where e-mails associated with her e-mail account * * * (or any other e-mail account she has used to conduct business on behalf of Nautica, if any) (collectively, the "Horoszko Accounts") might otherwise be electronically stored (collectively, the "Imaged ESI"). With respect to the imaging of any server, such imaging shall be limited to those ESI files associated with the Horoszko Accounts or where such ESI might be electronically stored. Vestige shall be responsible for collecting the ESI within five (5) days of the entry of this Order at a place, date and time mutually agreeable between Vestige and Nautica's information technology ("IT") personnel. Nautica and/or Nautica and Horoszko's counsel's IT personnel shall have the right to be present and supervise the imaging and inventorying of any ESI collected by Vestige, and shall be provided an exact copy of any ESI forensically imaged by Vestige prior to departing the collection locale.
2. Nautica and Horoszko's counsel shall have the right to review the Imaged ESI for any information protected by the attorney-client privilege (The "Protected Information") and shall create and produce a log of any such Protected Information for delivery to Vestige and Allied's counsel within three (3) day thereof. Upon receipt of the log identifying Protected Information, Vestige shall separate the Protected Information from the Imaged ESI for purpose of production and promptly produce to Allied all other ESI for the period October 1, 2014 through the present date. Allied's counsel may request any information withheld from production by Nautica and Horoszko to be submitted by Vestige to the Court for determination of whether the Protected Information is attorney-client privileged.
3. All ESI (i) collected by Vestige, and (ii) provided to Allied as part of the Production Image, shall be deemed and treated as "confidential Information" under the Court's previously entered Stipulated Protective Order ("SPO"). At all times while in possession of the ESI, Vestige and Allied shall be bound by the SPO, a copy of which shall be provided by Allied's counsel to Vestige before it collects any ESI. Vestige shall review and execute Exhibit A to the SPO and provide an original executed copy of the same to Nautica and Horoszko's counsel and/or IT personnel prior to the collection of any ESI.
4. Within five (5) days of the final disposition of this action, whether by entry of judgment or settlement, Vestige shall destroy (and attest by affidavit to the destruction) or return to Nautica and Horoszko's counsel any ESI.
5. Although all ESI produced to Allied by Vestige shall be deemed and treated as Confidential Information under the SPO, Allied may petition the Court to deem some of the ESI collected by Vestige and produced to Allied non-confidential, if necessary, pursuant to Section 15 of the SPO.
{¶20} On September 13, 2018, Nautica Defendants appealed the trial court's order pertaining to the ESI.
On September 20, 2018, this court sua sponte dismissed Nautica's appeal for lack of final appealable order, finding that "the mere adjudication of contempt of court is not a final appealable order until a sanction or penalty is imposed." Nautica Defendants filed a motion for reconsideration of the dismissal. The motion clarified that Nautica's appeal concerns only the second part of the trial court's order that compelled the production of a "mirror image of all Nautica's computers * * *," which is a final appealable order because the order compels the production of forensic imaging of a computer hard drive and the disclosure of privileged and/or confidential material. In support, Nautica cited Fasteners for Retail, Inc. v. DeJohn, 8th Dist. Cuyahoga No. 100333, 2014-Ohio-1729, 2014 WL 1669132, and Bennett v. Martin, 186 Ohio App.3d 412, 2009-Ohio-6195, 928 N.E.2d 763 (10th Dist.). Nautica's motion was unopposed. Upon reconsideration, we reinstated Nautica's appeal.
Assignments of Error
{¶21} On appeal, Nautica Defendants assign three errors for our review, which we will address together:
I. The trial court abused its discretion in ordering the Nautica Defendants to produce forensic mirror images of their computers and servers to Allied without satisfying the first step of the Bennett test.
II. The trial court abused its discretion in ordering the Nautica Defendants to produce forensic mirror images of their computers and servers to Allied without instituting adequate procedural safeguards to protect their privileged, proprietary, personal, and confidential electronically stored information ("ESI").
III. The trial court abused its discretion in ordering the Nautica Defendants to produce forensic mirror images of their computers and servers to Allied without limiting the scope of the production to only the ESI reasonably calculated to lead to the discovery of admissible evidence.
Law and Analysis
{¶22} Nautica Defendants contend that the trial court abused its discretion in compelling the forensic mirror imaging of "all Nautica's computers used by Mary Horoszko." They argue that the trial court failed to conduct the appropriate balancing test, which includes weighing the parties' interest in discovery against Nautica Defendants' competing interests in privacy and confidentiality; the court failed to institute adequate procedural safeguards for the protection of Nautica's privileged, proprietary, and confidential information; and the court's order was overbroad and unduly burdensome.
Civ.R. 26
{¶23} The Ohio Rules of Civil Procedure provide a right to the "liberal discovery of information." Ward v. Summa Health Sys., 128 Ohio St.3d 212, 2010-Ohio-6275, 943 N.E.2d 514, ¶ 9, citing Moskovitz v. Mt. Sinai Med. Ctr., 69 Ohio St.3d 638, 661-662, 635 N.E.2d 331 (1994). This discovery may be obtained through "deposition upon oral examination or written questions; written interrogatories; production of documents, electronically stored information, or things or permission to enter upon land or other property, for inspection and other purposes; physical and mental examinations; and requests for admission." Civ.R. 26(A).
{¶24} Civ.R. 26(B) governs the scope of the information that a party may obtain through discovery:
[A]ny matter, not privileged, which is relevant to the subject matter involved in the pending action, whether it relates to the claim or defense of the party seeking discovery or to the claim or defense of any other party, including the existence, description, nature, custody, condition and location of any books, documents, electronically stored information, or other tangible things and the identity and location of persons having knowledge of any discoverable matter.
Civ.R. 26(B)(1). Additionally, the information sought must "appear[ ] reasonably calculated to lead to the discovery of admissible evidence." Id.
{¶25} Specifically regarding electronically stored information, Civ.R. 26(B)(4) provides as follows:
A party need not provide discovery of electronically stored information when the production imposes undue burden or expense. On motion to compel discovery or for a protective order, the party from whom electronically stored information is sought must show that the information is not reasonably accessible because of undue burden or expense. If a showing of undue burden or expense is made, the court may nonetheless order production of electronically stored information if the requesting party shows good cause. The court shall consider the following factors when determining if good cause exists:
(a) whether the discovery sought is unreasonably cumulative or duplicative;
(b) whether the information sought can be obtained from some other source that is less burdensome, or less expensive;
(c) whether the party seeking discovery has had ample opportunity by discovery in the action to obtain the information sought; and
(d) whether the burden or expense of the proposed discovery outweighs the likely benefit, taking into account the relative importance in the case of the issues on which electronic discovery is sought, the amount in controversy, the parties' resources, and the importance of the proposed discovery in resolving the issues.
In ordering production of electronically stored information, the court may specify the format, extent, timing, allocation of expenses and other conditions for the discovery of the electronically stored information.
Civ.R. 26(B)(4) ; Townsend v. Ohio DOT, 10th Dist. Franklin No. 11AP-672, 2012-Ohio-2945, 2012 WL 2467047, ¶ 15 ; Loc.R. 21.3(F)(2)(c) of the Court of Common Pleas of Cuyahoga County, General Division (detailing similar factors for the court to consider when determining if good cause exists for the production of ESI).
{¶26} An appellate court generally reviews a discovery dispute for an abuse of discretion. Ward, 128 Ohio St.3d 212, 2010-Ohio-6275, 943 N.E.2d 514, at ¶ 13 ; Fasteners for Retail, Inc., 8th Dist. Cuyahoga No. 100333, 2014-Ohio-1729, at ¶ 19 (reviewing the trial court's order of forensic imaging of a computer's hard drive under the abuse of discretion standard). An "abuse of discretion ‘connotes more than an error of law or judgment; it implies that the court's attitude is unreasonable, arbitrary, or unconscionable.’ " Blakemore v. Blakemore, 5 Ohio St.3d 217, 219, 450 N.E.2d 1140 (1983), quoting State v. Adams, 62 Ohio St.2d 151, 157, 404 N.E.2d 144 (1980). And absent an abuse of discretion, we must affirm the trial court's disposition on discovery matters. Lightbody v. Rust, 137 Ohio App.3d 658, 663, 739 N.E.2d 840 (8th Dist.2000).
Forensic Imaging
{¶27} The trial court ordered Nautica Defendants to produce "all Nautica's computers used by Mary Horoszko" for a forensic examination. A forensic image, also known as a "mirror image," will " ‘replicate bit for bit, sector for sector’ " all allocated and unallocated space on a computer's hard drive, including any embedded, residual, and deleted data. Bennett, 186 Ohio App.3d 412, 2009-Ohio-6195, 928 N.E.2d 763, at ¶ 40, quoting Balboa Threadworks, Inc. v. Stucky, D.Kan. No. 05-1157-JTM-DWB, 2006 WL 763668, 3 (Mar. 24, 2006) ; Ferron v. Search Cactus, L.L.C., S.D.Ohio No. 2:06-CV-327, 2008 WL 1902499, 3, fn. 5 (Apr. 28, 2008) ("A mirror image copy represents a snapshot of the computer's records. * * * It contains all the information in the computer, including embedded, residual, and deleted data.").
{¶28} Courts are generally reluctant to compel forensic imaging "largely due to the risk that the imaging will improperly expose privileged and confidential material contained on the hard drive." Bennett at ¶ 40. To determine whether forensic imaging is warranted, as opposed to standard discovery procedures, the trial court must (1) weigh the parties' interest in obtaining discovery against privacy concerns; and (2) institute a protective protocol to ensure that forensic imaging is not unduly intrusive. Bennett at ¶ 41, 47. This court has adopted the Bennett two-part test utilized by the Tenth District Court of Appeals in Fasteners for Retail, Inc. at ¶ 21.
Weighing of Interests
{¶29} Before compelling forensic imaging, a trial court must first weigh the necessity of obtaining the electronic discovery against any privacy concerns:
"[A] court must weigh ‘the significant privacy and confidentiality concerns’ inherent in imaging against the utility or necessity of the imaging. * * * In determining whether the particular circumstances justify forensic imaging, a court must consider whether the responding party has withheld requested information, whether the responding party is unable or unwilling to search for the requested information, and the extent to which the responding party has complied with discovery requests. * * * When a requesting party demonstrates either discrepancies in a response to a discovery request or the responding party's failure to produce requested information, the scales tip in favor of compelling forensic imaging."
(Citations omitted.) Fasteners for Retail, 8th Dist. Cuyahoga No. 100333, 2014-Ohio-1729, at ¶ 24, quoting Bennett at ¶ 41 ; see also Scott Process Sys. v. Mitchell, 5th Dist. Stark No. 2012CA00021, 2012-Ohio-5971, 2012 WL 6617363, ¶ 37-38 (finding the order for forensic imaging in error where the requesting party failed to demonstrate that paper production of records was insufficient or that the requesting party's need for forensic imaging outweighed the party's privacy interests); Nithiananthan v. Toirac, 12th Dist. Warren No. CA2011-09-098, 2012-Ohio-431, 2012 WL 368332, ¶ 9 (the party requesting forensic imaging must demonstrate a "background of noncompliance" with discovery under part one of the Bennett framework); Scotts Co., L.L.C. v. Liberty Mut. Ins. Co., S.D.Ohio No. 3:06-CV-899, 2007 WL 1723509, 2 (June 12, 2007), quoting Diepenhorst v. Battle Creek, W.D. Mich. No. 1:05-CV-734, 2006 WL 1851243, 3 (June 30, 2006) (expressing reluctance to permit intrusive forensic imaging as a matter of course on a requesting party's "mere suspicion" the opponent is withholding information or to "address the bare possibility of discovery misconduct").
Step One: Necessity of the Imaging vs. Privacy Concerns
{¶30} In Bennett, the court found that the defendants repeatedly represented that they had disclosed all responsive documents when they had not. Bennett, 186 Ohio App.3d 412, 2009-Ohio-6195, 928 N.E.2d 763, at ¶ 42. Additionally, the court noted that the defendants had a "lackadaisical and dilatory approach to providing discovery" when they engaged in last-minute discovery practice. Id. Thus, after applying the balancing factors, the court determined that the defendants demonstrated a "willful disregard of the discovery rules," and given their "background of noncompliance," the trial court properly ordered forensic imaging. Id.
{¶31} In Fasteners, we determined that the record concerning discovery did not demonstrate the requisite showing of the defendants' noncompliance with discovery under the first prong of the Bennett test. Specifically, we noted that the record did not demonstrate that the documents sought by the plaintiff "were being unlawfully withheld and not available from [Plaintiff's] own information or other sources." Fasteners for Retail at ¶ 29.
{¶32} Nautica Defendants contend that the trial court failed to satisfy the first step of the Bennett analysis. In support, they claim that their conduct concerning Allied's request for ESI was not improper and therefore forensic imaging was not warranted and the court "ignored" their privacy concerns. We find Nautica Defendants' argument unpersuasive.
{¶33} Here, the record shows that in the course of Nautica Defendants' document production, Allied discovered two conflicting emails between Horoszko and Barth. Barth's copy of the email included references to wristbands, while Horoszko's copy contained no references to wristbands. This discovery, Allied contends, led to its belief that the email chain had been altered, and Allied became concerned that there were other "altered" emails of which Allied was unaware. In response to this discovery, Allied made a new motion (within its motion for sanctions regarding the paper discovery, albeit in a footnote) requesting the court compel forensic imaging of Nautica computers used by Horoszko. In addition, the record shows that following a hearing on Allied's motion to show cause regarding certain paper discovery, the trial court found Nautica Defendants in contempt for failing to fully and properly answer several interrogatories and failing to produce numerous requested documents, namely Interrogatory Nos. 7 and 12-14 and Document Request Nos. 4, 30, and 36.
{¶34} Nautica Defendants argue that the court's sanctions applied only to Nautica's paper discovery and their conduct relating to this new request for ESI was not improper. We agree that the court's sanctions appear to pertain to Nautica's conduct in responding to Allied's paper discovery requests. The trial court's order at issue here, rather, is an ESI order in response to the alleged "altered email chain."
{¶35} The newly discovered "altered email chain," however, demonstrates a discrepancy in discovery that weighs in favor of compelling forensic imaging. Bennett, 186 Ohio App.3d 412, 2009-Ohio-6195, 928 N.E.2d 763, at ¶ 41 (finding "the scales tip in favor of compelling forensic imaging" when a requesting party demonstrates discrepancies in a response to a discovery request); see also Simon Property Group L.P. v. mySimon, Inc., 194 F.R.D. 639, 641 (S.D.Ind.2000) (permitting the plaintiff to inspect the defendant's deleted computer files where the plaintiff demonstrated "troubling discrepancies" concerning the defendant's document production); Playboy Ents., Inc. v. Welles, 60 F.Supp.2d 1050, 1054-55 (S.D. Cal. 1999) (permitting forensic imaging of a defendant's computer where the parties, pursuant to a document request, discovered an email chain produced by one defendant that was not produced by a codefendant and where the parties later learned that the defendant customarily deleted emails after litigation had commenced). Nautica Defendants do not dispute the existence of the discrepancy, yet they offer no explanation for the apparent conflict. And forensic imaging may reveal other deleted emails or altered emails on the Nautica computers used by Horoszko. When the court considered the Barth/Horoszko email discrepancy along with the history of Nautica Defendants' discovery violations concerning paper discovery, where in fact the court found that Nautica Defendants repeatedly failed to produce documents, an order compelling forensic imaging was not unreasonable.
{¶36} Regarding Nautica Defendants' privacy concerns, as discussed below, the record reflects the court considered Nautica Defendants' privacy and confidentiality concerns and instituted certain protective protocols. But the unique discrepancy in discovery and the history of discovery violations weighed in favor of forensic imaging.
{¶37} In light of the foregoing, we cannot find the trial court abused its discretion in ordering forensic imaging under the circumstances. Viewing the record in its entirety, the showing required under the first prong of the Bennett analysis has been satisfied.
Step Two: Protective Protocol
{¶38} "Even when a defendant's misconduct in discovery makes forensic imaging appropriate, a court must protect the defendant's confidential information as well as preserve any private and privileged information." Bennett, 186 Ohio App.3d 412, 2009-Ohio-6195, 928 N.E.2d 763, at ¶ 47. A party's purported failure to produce discovery as requested or ordered "will rarely warrant unfettered access to a party's computer system." Id. A trial court abuses its discretion when "its judgment entry permits unfettered forensic imaging of a party's electronic devices and contains none of the Bennett protections required to conduct such forensic analysis. Fasteners for Retail, 8th Dist. Cuyahoga No. 100333, 2014-Ohio-1729, at ¶ 33, citing Scott Process Sys., 5th Dist. Stark No. 2012CA00021, 2012-Ohio-5971, at ¶ 36.
{¶39} The Bennett court suggested, and this court followed, a protocol for forensic imaging:
"[A]n independent computer expert, subject to a confidentiality order, creates a forensic image of the computer system. The expert then retrieves any responsive files (including deleted files) from the forensic image, normally using search terms submitted by the plaintiff. The defendant's counsel reviews the responsive files for privilege, creates a privilege log, and turns over the nonprivileged files and privilege log to the plaintiff."
Fasteners for Retail at ¶ 32, quoting Bennett at ¶ 47 ; Nithiananthan, 12th Dist. Warren No. CA2011-09-098, 2012-Ohio-431, at ¶ 19 (adopting the protocol suggested in Bennett and holding that "at minimum, several protective measures must be enforced when ordering forensic imaging"); Scott Process Sys., supra (adopting the Bennett protocol and reversing the trial court's order for forensic imaging where the order contained "none of the Bennett protections").
{¶40} In Bennett, the appellate court found that the trial court did not abuse its discretion in ordering forensic imaging as a sanction for the defendants' noncompliance with the trial court's orders. Bennett at ¶ 49. The appellate court determined, however, that the trial court erred "in not providing adequate protections to safeguard the confidentiality of the information contained on the computer systems to be imaged." Id. Finding insufficient the trial court's safeguards for privileged and confidential information, which included permitting the party to redact privileged information and designating certain confidential and personal information "for attorneys' eyes only," the appellate court stressed the importance of a proper protocol where forensic imaging is ordered, even where a party engages in misconduct:
[W]e believe that more comprehensive protection is necessary, particularly given the sensitivity of the information at issue here. Bennett deserves a remedy for the prejudice caused by defendants' misconduct, but that remedy should not require defendants to sacrifice highly-sensitive, confidential information that has no bearing on Bennett's claims. Additionally, private information of the computers' users — such as personal financial information and communications with friends and family — should not be subject to disclosure. Therefore, we conclude that the trial court abused its discretion in devising the procedure for the forensic imaging. We urge the trial court to adopt a protocol similar to the one described above. We believe that such a protocol would allow Bennett sufficient access to the computer systems to recover useful information, while also providing defendants with an opportunity to identify and protect privileged and confidential matter.
Id. at ¶ 48.
{¶41} Mindful of the "potential intrusiveness" of a forensic examination, federal courts likewise utilize a "collection and review protocol" when compelling a forensic examination, such as the following:
1. An independent computer expert shall be appointed by the Court and shall mirror image [the party's] computer system.
2. The parties have [a designated time in which to] meet and confer regarding their designation of an independent computer expert. If the parties cannot agree, on or before [a set date], each party shall submit its recommendation to the Court, and the Court will select the expert.
3. The appointed expert shall serve as an Officer of the Court. Thus, to the extent that this computer expert has direct or indirect access to information protected by attorney-client privilege, such disclosure will not result in any waiver of the [party's] privilege.
4. The independent expert shall sign a confidentiality order. Additionally, the expert shall be allowed to hire other outside support if necessary in order to mirror image the [party's] computer system. Any outside support shall be required to sign the same confidentiality order.
5. The expert shall mirror image the [party's] computer system.
6. The [requesting party] shall provide a list of search terms to the Court to identify responsive documents to its document requests on or before [a set date]. After [the requesting party] has submitted the search terms to the Court, [the
party] shall have 5 days to submit their objections to the Court regarding any of the search terms, which the court will rule upon. The Court will provide the search terms to the independent expert.
7. Once the expert has mirror imaged the [party's] computer system, the expert shall search the mirror image results using the search terms. The results of the search terms and an electronic copy of all responsive documents shall be provided to the [party] and to the Court.
8. The [party] shall review the search term results provided by the independent expert and identify all responsive documents. The [party] shall either produce all responsive documents to the [requesting party] or identify those responsive documents not produced on a privilege log to the [requesting party] within 20 days of the date that the [party] receives the search term results from the independent expert. Any privilege log produced shall comply strictly with the [the rules of court].
9. [The requesting party] shall pay for all fees and costs of hiring the independent expert at this time. However, if at a later time there is evidence of the [party's] improper deletion of electronic documents or any other associated improper conduct, the Court will revisit this issue and consider charging [that party] for the fees and costs of the independent expert or imposing the fees and costs on the parties in a duly appropriate apportioned manner.
10. The independent expert shall provide a signed affidavit detailing the steps he or she took in mirror imaging the [party's] computer system and searching the mirror image for the search terms within 5 days of providing the [party] and the Court with the results of the search for search terms in the mirror image.
Wynmoor Community Council, Inc. v. QBE Ins. Corp., 280 F.R.D. 681, 687-688 (S.D.Fla.2012) ; Bank of Mongolia v. M & P Global Fin. Servs., 258 F.R.D. 514 (S.D.Fla.2009).
{¶42} Nautica Defendants contend that the trial court's discovery order lacks adequate protective protocols to safeguard its privileged and confidential ESI. In support, Nautica argues that the court's order contains no search methodology or search terms; the order does not exclude from the search information that is not privileged but is otherwise confidential, such as personal or proprietary information irrelevant to the underlying action; and the order's provision of three days in which to conduct a privilege review of potentially hundreds of gigabytes of data is insufficient and unreasonable. Nautica Defendants also contend that the trial court's order is overbroad and permits the production of irrelevant and confidential information that is not reasonably calculated to the discovery of admissible evidence. Thus, according to Nautica, the order exceeds the scope of discoverable information.
{¶43} Upon review, we find the trial court included some safeguards for Nautica Defendants' privileged and confidential matter. The record shows that the court addressed Nautica Defendants' privacy concerns, at least to some degree. During the September hearing, the court engaged in a colloquy with counsel for Nautica, during which counsel advised the court of his concern regarding protecting confidential information, attorney-client privilege, and other personal and private information arguably contained on Nautica's computers. The court then instructed the parties to fashion a protective order and the court would sign it. The court further stated that the parties could address any issues concerning attorney-client privileges through in camera inspections, instructing, "Just bring them to me." The court also executed an ESI order deeming all ESI produced to Allied as "Confidential Information" under the court's previously entered Stipulated Protective Order.
{¶44} However, the trial court's ESI order lacks sufficient protective protocols intended by Bennett and numerous other courts to safeguard Nautica Defendants' confidential information. For example, the trial court's order in this case failed to include a list of search terms in its order to narrow the production of documents. The court's order also failed to outline a process by which the parties could submit search terms to identify responsive documents, provide objections to proposed search terms, and provide the search terms to an independent third-party computer expert. Allied suggests that a search term protocol using the term "wristbands" would not have exposed the "altered email chain" or any others from which Nautica deleted the term "wristbands" and therefore would not have been fruitful. We find no reason the parties are limited to one relevant search term. Given the opportunity, the parties could agree upon other equally availing search terms that would likely produce responsive documents. And having a procedure in place by which the parties can object to proposed search terms ensures that the parties' interests are protected.
{¶45} Moreover, we find the lack of search terms and search protocol has resulted in an overbroad order that risks including information irrelevant to the underlying claims and information that may be personal, private, proprietary, or otherwise confidential. "Courts have been cautious in requiring the mirror imaging of computers where the request is extremely broad in nature and the connection between the computers and the claims in the lawsuit are unduly vague or unsubstantiated in nature." Balboa Threadworks, Inc., D.Kan.No. 05-1157-JTM-DWB, 2006 WL 763668, 3. Likewise, where courts do compel forensic imaging, courts must utilize a protective protocol "to ensure that the forensic imaging is not unduly intrusive," which protocol serves to protect the defendant's confidential, private, and privileged information. Nithiananthan, 12th Dist. Warren No. CA2011-09-098, 2012-Ohio-431, at ¶ 19, 20.
{¶46} Here, the record shows that Allied's initial request for "the doctored email in native format" (noted within a footnote in Allied's motion for sanctions regarding paper discovery) developed into a request for "e-discovery with respect to Nautica's emails" (at the August hearing) and ultimately resulted in the court's order of "a mirror image of all Nautica's computers used by Mary Horoszko." Although the court's ESI order provided a protocol in which the parties could arguably prevent the disclosure of attorney-client privilege (i.e. the creation of a privilege log), there is nothing in the order — through search terms or other instructions — that expressly required the third-party vendor or expert to limit its search to information relevant to Allied/Blue Star's claims against Nautica Defendants or to exclude personal or confidential information, such as Horoszko's personal or financial information or Nautica's proprietary information. Rather, the order broadly states that the expert shall collect "ESI files associated with the Horoszko accounts or where such ESI might be electronically stored." Without relevant search terms, or other limiting instructions, the court is essentially permitting unfettered access to irrelevant and confidential information contained in the Nautica computers used by Horoszko. {¶47} Additionally, we find the trial court's order failed to provide Nautica Defendants sufficient time in which to review responsive documents for privileged information. The court's order provides that "counsel shall have the right to review the Imaged ESI for any information protected by the attorney-client privilege (The ‘Protected Information’) and shall create and produce a log of any such Protected Information for delivery to Vestige and Allied's counsel within three (3) days thereof." The record shows that thousands of documents have been produced in the course of paper discovery, and Nautica Defendants assert that forensic imaging could access hundreds of gigabytes of data. Given this large amount of data, the court's allowance of only three days to review the records for privilege and responsiveness, appropriately supplement Nautica's responses to discovery requests, and create a privilege log that expressly describes the nature of the documents or communications that are protected is unreasonable. See Ameriwood Industries v. Liberman, E.D.Mo. No. 4:06CV524-DJS, 2006 WL 3825291 (Dec. 27, 2006) (outlining a three-step procedure for forensic imaging and including in its "disclosure step" a period of 20 days for review and creation of privilege log); see also Wynmoor, 280 F.R.D. 681 (S.D.Fla.2012) (20 days for review and creation of privilege log); Bank of Mongolia, 258 F.R.D. 514 (20 days for review and creation of privilege log).
Conclusion
{¶48} Based upon the discovery of a purportedly altered email chain and Nautica Defendants' history of noncompliance with the trial court's previous discovery orders, we find the trial court did not abuse its discretion in compelling forensic imaging of Nautica computers. We find, however, that the trial court abused its discretion in failing to establish the proper protective protocols that would allow Allied sufficient access to recover useful, relevant information, while also providing Nautica Defendants an opportunity to identify and protect privileged and/ or confidential matter.
{¶49} We therefore affirm in part and reverse in part, and we remand to the trial court for further proceedings consistent with this opinion. In remanding, we urge the trial court to adopt a protocol similar to the protocols utilized by the cases referenced in this opinion.
EILEEN T. GALLAGHER, P.J., and RAYMOND C. HEADEN, J., CONCUR