Opinion
19-md-2904 (MCA) (MAH) MDL 2904
10-16-2023
IN RE AMERICAN MEDICAL COLLECTION AGENCY, INC., CUSTOMER DATA SECURITY BREACH LITIGATION
The Court has temporarily sealed this Opinion because the parties filed the joint letter and exhibits under seal. To the extent any party wishes to seal any portion of this Opinion, that party shall make an appropriate motion in accordance with Local Civil Rule 5.3(c)(3), within fourteen days of this Opinion. If no party timely files such a motion, or otherwise moves to extend the deadline by which to file the same, the temporary seal will be lifted.
OPINION
MICHAEL A. HAMMER, UNITED STATES MAGISTRATE JUDGE
I. Introduction
This matter comes before the Court on a discovery dispute regarding non-party American Medical Collection Agency's (“AMCA”) non-production of a full forensic analysis report prepared by Charles River Associates (“Charles River”). Joint Ltr., Mar. 29, 2023, D.E. 497. Plaintiffs and Defendants contend that AMCA must produce the full forensic analysis report (the “CRA Report”).AMCA argues that the attorney-client privilege and work product doctrine protect the CRA Report from disclosure. Id. The Court has reviewed the parties' submissions and conducted an in camera review of the CRA Report. For the reasons that follow, the Court will require AMCA to produce the CRA Report and the materials on which Charles River relied to create the CRA Report.
AMCA is also known as Retrieval-Masters Creditors Bureau.
For the sake of consistency, the Court will refer to the full forensic report by Charles River as the CRA Report. The Court will refer to the five-page summary as the Forensic Analysis.
The procedural history of this action is extensive and complex. Because this Court writes predominantly for the parties, the Court sets forth only those facts necessary for resolution of the instant dispute.
This matter arises from an alleged data breach of AMCA (the “Data Breach”), a medical billing collection company that Defendants, which are clinical diagnostic laboratories and related entities, retained as their collections vendor. Quest Action First Amended Complaint (redacted) (“Quest FAC”), Mar. 31, 2022, D.E. 317, ¶¶ 1, 2; LabCorp Action First Amended Complaint (redacted) (“LabCorp FAC”), Mar. 31, 2022, D.E. 319, ¶ 2; Other Labs Action First Amended Complaint (redacted) (“Sonic FAC”), Mar. 31, 2022, D.E. 321, ¶ 1. Defendants purportedly furnished financial information, medical information, and personally identifying information concerning their patients to AMCA to assist the latter's collection efforts. Quest FAC, ¶¶ 34143; LabCorp FAC, ¶¶ 71-73; Sonic FAC, ¶¶ 115, 117. Plaintiffs allege that between August 2018 and March 2019, one or more hackers gained access to AMCA's servers containing that sensitive information, and thereby gained access to the patients' personal identifying information (“PII”) and personal health information (“PHI”). Quest FAC, ¶¶ 1, 344; LabCorp FAC, ¶ 74; Sonic FAC, ¶ 137. Plaintiffs estimate that the number of patients whose information may have been compromised exceeds ten million. Quest FAC, ¶ 7; LabCorp FAC, ¶ 7. AMCA disclosed the occurrence of the cyberattack to certain Defendants in May 2019. Quest FAC, ¶¶ 401-402; LabCorp FAC, ¶ 137; Sonic FAC, ¶ 179.
On March 20, 2019, AMCA first learned of the Data Breach from a third-party security compliance firm. See Joint Ltr., Pls.' Exh. B, May 31, 2019 Letter from William E. Ridgway, D.E. 497-2, at 3-5. Nine days later, AMCA's outside counsel, Hinshaw & Culbertson LLP (“Hinshaw”), engaged Charles River to perform a forensic review of AMCA's internal systems. See Joint Ltr., Pls.' Exh. A, Forensic Analysis, D.E. 497-1, at 2; id. at AMCA Ex. A, D.E. 497-5 (engagement letter and terms and conditions). During its investigation, Charles River generated at least three reports concerning its findings, including: (1) a two-page “AMCA Summary Analysis”; (2) the five-page Forensic Analysis; and (3) the full CRA Report. Joint Ltr., D.E. 497, at 9. The Forensic Analysis, which was characterized as a summary of the longer CRA Report, was produced to Plaintiffs and Defendants years ago. See RMCB-AG-00000195. The CRA Report is “a second, more substantive forensic analysis report” that provides further detail regarding Charles River's investigation of the breach and the circumstances surrounding it. Joint Ltr., D.E. 497, at 3.
Plaintiffs indicate that several Defendants and AMCA produced the five-page document to them at the outset of the case. Joint Ltr., D.E. 497, at 2.
Following the Data Breach, affected persons began to file suit against AMCA and Defendants. The mounting litigation and associated fallout from the Data Breach prompted AMCA to file a Chapter 11 bankruptcy petition in the United States Bankruptcy Court for the Southern District of New York on June 17, 2019. Quest FAC, ¶ 385. Patients nonetheless continued to file civil actions against Defendants arising from their relationships with AMCA. On July 31, 2019, the Judicial Panel on Multidistrict Litigation transferred those actions to the United States District Court for the District of New Jersey to conduct pretrial proceedings in a single, multi-defendant multidistrict litigation (“MDL”).Quest FAC, ¶ 14.
Plaintiffs' general theory of this litigation is that Defendants should have prevented the identity theft by limiting the customer information they shared with their vendors, and employing reasonable measures to assure those vendors applied adequate data-security protocols. See Quest Compl., ¶ 3; LabCorp Compl., ¶ 4. Subject matter jurisdiction is predicated on the Class Action Fairness Act of 2005, 28 U.S.C. § 1332(d)(2).
On June 17, 2020, the bankruptcy court overseeing AMCA's petition entered an Order permitting the parties to this MDL to serve subpoenas on AMCA relevant to this litigation. In re Retrieval-Masters Creditors Bureau, Inc., Bankr. No. 19-23185 (RDD) (Bankr. S.D.N.Y. June 17, 2020), D.E. 301. The bankruptcy court directed AMCA to produce all electronic files in its possession through March 20, 2019, including privileged materials in connection with the subpoenas. Id. The bankruptcy court also limited AMCA to reviewing only “documents generated on or after March 20, 2019 for privilege using search terms based on the names of [AMCA's] outside counsel to identify potentially privileged documents[,]” and provided that “[a]ny disputes as to whether documents were properly withheld as privileged shall be resolved by the court overseeing the [MDL].” Id.
This Court finds, and no party argues to the contrary, that the instant dispute is properly before this Court. Order, Bankr. No. 19-23185, D.E. 301, at ¶ 3 (“the rights, obligations and defenses of the [MDL parties] and [AMCA] with respect to the Subpoenas [served on AMCA] not addressed in this Order shall be determined by the United States District Court for the District of New Jersey.”).
In June 2020, the MDL parties served subpoenas on AMCA. Joint Ltr., D.E. 497, at 8. In response to the MDL parties' subpoenas and in accordance with the bankruptcy court's orders, AMCA produced a significant number of pre-March 20, 2019 documents and emails in its possession. Id. at 13. AMCA also conducted a privilege review of post-March 20, 2019 emails, and identified a substantial number of privileged documents. Id. AMCA logged as privileged a substantial number of Charles River communications, including the CRA Report. Id. In late 2020, AMCA produced an additional 350,000 nonprivileged emails post-March 20, 2019, along with privilege logs. Id. AMCA also required Charles River to withhold from production any materials AMCA regarded as privileged. Id. AMCA contends that sometime in November 2020, Charles River produced to Plaintiffs and Defendants a hard drive containing the nonprivileged data that formed the basis for its forensic analysis, as well as a privilege log. Id.
At some point during AMCA and CRA's productions, the parties copied AMCA's hard drives along with other data sources. Joint Ltr., D.E. 497, at 14. Once AMCA realized that certain post-March 20, 2019 purportedly privileged documents, including the CRA Report, were among those copied, AMCA clawed back the CRA Report and the other inadvertently produced, assertedly privileged documents. Id. at 8-9, 14.
The bankruptcy court dismissed the petition on December 10, 2020, and closed the case on June 21, 2021. In re Retrieval-Masters Creditors Bureau, Inc., No. 19-23185, Order Dismissing Chapter 11 Case and Granting Related Relief, (Bankr. S.D.N.Y. Dec. 10, 2020), D.E. 357. The dismissal order provided that all prior orders of the bankruptcy court, including the one concerning the MDL parties' service of third-party subpoenas on AMCA, were to remain in full force and effect. Id.
Both Plaintiffs and Defendants contend that they learned of the existence of the CRA Report at the center of this discovery dispute only recently. Joint Ltr., D.E. 497, at 1, 2, and 9. Plaintiffs and Defendants seek the CRA Report and all underlying factual materials Charles River relied on in creating the Report, including the materials referenced in the five-page Forensic Analysis. Id. at 8, 12. Although Plaintiffs contend the CRA Report has never been privileged, and Defendants contend it was privileged until AMCA became defunct as a corporation, those parties agree that CRA Report is not privileged at this time.
Relying principally on United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), AMCA argues that the CRA Report is protected by both the attorney-client privilege and work product doctrine. AMCA also avers that it never waived any privileges or protections. Further, AMCA maintains that although it “no longer conducts business, it remains an active corporation with its longtime owner and chief executive officer still overseeing various activities, including required filings, legacy litigation, and document re-collection efforts.” Joint Ltr., D.E. 497, at 12-21.
Plaintiffs claim that AMCA's withholding of the CRA Report on privilege grounds fails for four reasons. Id. at 3-8. Specifically, Plaintiffs argue that: (1) AMCA waived any workproduct protections; (2) in any event, the work product doctrine does not protect the facts underlying the CRA Report and supporting materials; (3) the CRA report is not an attorneyclient communication because it was created principally for business, not litigation, purposes; and (4) even if the CRA Report is protected by work product privilege, and AMCA has not waived the privilege, Plaintiffs have established a substantial need for it. Id.
Defendants disagree with Plaintiffs' contention that the CRA Report was never covered by the attorney-client privilege and/or work product protection. Nonetheless, Defendants assert that AMCA is a defunct corporate entity without any operations, assets, business, or directors or employees who can assert the privilege on behalf of AMCA, and as a result, these protections no longer apply. Id. at 10-12. Defendants therefore request that the CRA Report and the evidence that Charles River analyzed to create that report be produced. Id. at 12.
This Court notes that because jurisdiction is based upon the presence of a federal question, the federal common law of attorney-client privilege governs this matter. See Fed.R.Evid. 501; Harding v. Dana Transport, Inc., 914 Supp. 1084, 1090 (D.N.J. 1996) (citing Wm. T. Thompson Co. v. General Nutrition Corp., Inc., 671 F.2d 100, 103 (3d Cir. 1982)). The parties have not identified, nor has this Court independently identified, a conflict between the federal common law of attorney-client privilege and any applicable state laws concerning privilege for purposes of resolving this dispute. There also is no conflict issue concerning the work product doctrine, because “[u]nlike the attorney client privilege, the work product privilege is governed, even in diversity cases, by a uniform federal standard embodied in Federal Rule of Civil Procedure 26(b)(3).” United Coal Co. v. Powell Constr. Co., 839 F.2d 958, 966 (3d Cir. 1988).
A. Attorney-Client Privilege
The purpose of the attorney-client privilege is to encourage “full and frank communication between attorneys and their clients.” Upjohn Co. v. United States, 449 U.S. 383, 389 (1981); Westinghouse Electric Corp. v. Republic of the Philippines, 951 F.2d 1414, 1423 (3d Cir. 1991). The privilege protects a client's right to refuse to disclose “confidential communications between attorney and client made for the purpose of obtaining legal advice.” Genetech, Inc. v. U.S. Int'l Trade Comm'n, 122 F.3d 1409, 1415 (Fed. Cir. 1997). Even where the privilege protects attorney-client communications, the facts underlying the communications are always discoverable. See Upjohn, 449 U.S. at 395-96 (“Protection of the privilege extends only to communications not to facts.”).
Whether the privilege applies is decided on a case-by-case basis, and the party asserting the privilege bears the burden to show it applies. Matter of Bevill, Bresler & Schulman Asset Mgmt. Corp., 805 F.2d 120, 124 (3d Cir. 1986). Because the attorney-client privilege obstructs the truth-finding process, however, it is construed narrowly. Westinghouse, 951 F.2d at 1423-24 (quoting Fisher v. United States, 425 U.S. 391, 403 (1976)). A party asserting the privilege must show “(1) that it submitted confidential information to a lawyer, . . . (2) that it did so with the reasonable belief that the lawyer was acting as the parties' attorney,” Montgomery Acad. v. Kohn, 50 F.Supp.2d 344, 350 (D.N.J. 1999), and (3) the purpose of the communications was to secure legal, as opposed to business, advice. In re Ford Motor Co., 110 F.3d 954, 965 (3d Cir. 1997). The touchstone of the privilege, therefore, is that the communications between client and attorney were both made and maintained in confidence. See Republic of Philippines v. Westinghouse Elec. Corp., 132 F.R.D. 384, 388 (D.N.J. 1990) (stating “a litigant who wishes to assert confidentiality must maintain genuine confidentiality”).
The attorney-client privilege applies to both individuals and corporations. See Upjohn, 449 U.S. at 390. Corporations, as inanimate entities, must act through agents. Bevill, 805 F.2d at 124 (quoting Commodity Futures Trading Comm'n v. Weintraub, 471 U.S. 343, 348 (1985)). However, the privilege does not cease to exist solely because a client is a corporation. Id. Instead, the attorney-client privilege extends to communications of a corporation's management and employees where doing so would effectuate or enable legal advice. See Upjohn, 449 U.S. at 391, 394-95. Advice concerning a corporation's business affairs, technical issues, or public relations is not protected by the attorney-client privilege. Dejewski v. Nat'l Beverage Corp., Civ. No. 19-14532, 2021 WL 118929, at *1-2 (D.N.J. Jan. 12, 2021); Louisiana Mun. Police Emps. Ret. Sys. v. Sealed Air Corp., 253 F.R.D. 300, 305-06 (D.N.J. 2008). Where communications contain both legal and business advice, courts must ascertain whether “the communication is designed to meet problems which can be fairly characterized as predominantly legal.” Leonen v. Johns-Manville, 135 F.R.D. 94, 99 (D.N.J. 1990) (quoting Cuno, Inc. v. Pall Corp., 121 F.R.D. 198, 204 (E.D.N.Y. 1988)).
B. Work Product Doctrine
The work product doctrine precludes disclosure of “materials prepared by an attorney, or an attorney's agent, in anticipation of or for litigation,” as well as “[a]n attorney's mental impressions, conclusions, opinions or legal theories.” In re Diet Drugs, 2001 WL 34133955, at *4 (citing In re Ford Motor Co. v. Kelly, 110 F.3d 954, 967 (3d Cir. 1997), abrogated on other grounds by Mohawk Indus., Inc. v. Carpenter, 558 U.S. 100 (2009)); see also Fed.R.Civ.P. 26(b)(3). The work product doctrine “shelters the mental processes of the attorney, providing a privileged area within which he can analyze and prepare his client's case.” In re Cendant Corp. Sec. Litig., 343 F.3d 658, 661-63 (3d Cir. 2003). The party asserting the protection of the work product doctrine carries the burden of demonstrating that the doctrine applies. In re GabapentinLitig., 214 F.R.D. 178, 183 (D.N.J. 2003).
Courts in this Circuit have traditionally applied a two-step inquiry in deciding whether a document is protected under the work product doctrine. Id. at 183-84. First, courts look at whether the document was created “in anticipation of litigation,” and second, whether the document was created “primarily for the purpose of litigation.” Id. A party must show more than the “remote prospect” of litigation in satisfying the in anticipation of litigation prong. Id. at 183. Instead, the party must show the “existence of an identifiable specific claim or impending litigation at the time the materials were prepared.” SmithKline Beecham Corp. v. Apotex Corp., 232 F.R.D. 467, 473 (E.D. Pa. 2005). “The mere involvement of, or investigation by an attorney does not, in itself, evidence the ‘anticipation of litigation.'” In re Gabapentin Litig., 214 F.R.D. at 183. In determining whether a document was created primarily for the purpose of litigation, courts look to the motive behind the document's creation. Id. at 184. “The proper inquiry is whether in light of the nature of the document and the factual situation in the particular case, the document can fairly be said to have been prepared or obtained because of the prospect of litigation.” Id. “Documents created for other purposes that prove useful in subsequent litigation are not attorney work product; similarly, documents that are routinely prepared in the ordinary course of business are outside the scope of work product protection.” Id.
IV. DISCUSSION
A. Whether AMCA Can Assert Privilege
As a preliminary matter, the Court will address Defendants' contention that although the CRA Report was once protected by the attorney-client privilege, any protections it once enjoyed no longer exist because AMCA is functionally a defunct entity unable to assert any privilege.Joint Ltr., D.E. 497, at 8. At the outset, it bears noting that AMCA, as the party invoking the privilege, has the burden of establishing that the privilege has been properly asserted. Trading Techs. Intern., Inc. v. GL Consultants, Inc., Civ. No. 05-5164, 2012 WL 874322, at *4 (N.D. Ill. Mar. 14, 2012).
Plaintiffs join in Defendants' argument that AMCA cannot assert any privileges due to its bankruptcy. Joint Ltr., D.E. 497, at 3 n.3.
Defendants posit that any privilege protections that AMCA once enjoyed have dissipated because AMCA is now “defunct, without any assets, employees, or ongoing operations.” Id. AMCA argues that though it no longer conducts business, it continues to be an active corporation and therefore, it may continue to assert privileges. Id. at 20. AMCA asserts that “its longtime owner and chief executive officer [is] still overseeing various activities, including required filings, legacy litigation, and document re-collection efforts.” Id. AMCA also submits a corporate entity information sheet from the New York Department of State, Division of Corporations, which shows that AMCA is an active entity. AMCA Exh., D, D.E. 497-8.
This Court finds that AMCA has not carried its burden of demonstrating that AMCA can assert privilege over the CRA Report. Instead, this Court is persuaded that AMCA is a defunct entity that has lost the protections of privilege. The attorney-client privilege is controlled by a corporation's management. Commodity Futures Trading Comm'n v. Weintraub, 471 U.S. 343, 351-52 (1985). However, a defunct or dissolved corporation does not retain the protections of either the attorney-client privilege or the work product doctrine. See S.E.C. v. Carrillo Huettel LLP, Civ. No. 13-1735, 2015 WL 1610282, at *2 (S.D.N.Y. Apr. 8, 2015) (attorney-client); EFG BNK AG v. Lincoln Nat'l Life Ins. Co., 593 F.Supp.3d 225, 232 (E.D. Pa. 2022) (work product). “No real purpose would be served by continuing the privilege after operations cease, as the corporation would no longer have any goodwill or reputation to maintain.” Gilliland v. Geramita, Civ. No. 05-1059, 2006 WL 2642525, at *4 (W.D. Pa. Sept. 14, 2006). In fact, “[d]ecisions about the attorney-client privilege should be based primarily on the practical realities of the business rather than technical legal status.” Id. at *2. See also Trading Techs. Intern., Inc. v. GL Consultants, Inc., Civ. No. 05-5164, 2012 WL 874322, at *4 (N.D. Ill. Mar. 14, 2012) (“When the corporation is gone, so too is its interest in protecting its communications; the need to promote full and frank exchanges between an attorney and agents of his corporate clients disappears when the corporation employing those clients has departed.”).
AMCA acknowledges that it no longer conducts business. However, it argues that it remains an active corporation. As proof of its active status, AMCA submits a New York State Corporate Entity Information Sheet. See Corporate Entity Information Sheet, AMCA Exh., D, D.E. 497-8. AMCA asserts that this document demonstrates that although it no longer conducts business, it remains an active corporation. Joint Ltr., D.E. 497, at 20. But the information sheet does little to bolster AMCA's claim that it is active. The New York Department of State, Division of Corporations website reflects that although AMCA is listed as an active entity, AMCA has failed to file two biennial statements, those for the years 2021 and 2023. See New York State Dep't of State, Division of Corporations, The Corporation and Business Entity Database, https://apps.dos.ny.gOv/publicInquiry/#search (last visited Oct. 12, 2023). The purpose of the biennial statement is to provide current information concerning the name and business address of the entity's chief executive officer, the street address of its principal office, the post office where the secretary of state would mail process, the number of directors constituting the board, and the number of directors of the board who are women. N.Y. Bus. Corp. Law § 408 (McKinney).
AMCA's submission does nothing to clarify whether it remains an “active” corporation. AMCA posits that its chief executive officer continues to carry out various tasks, and that AMCA has not filed for formal dissolution. Even assuming that to be true, AMCA has shown nothing more. And the realities of AMCA's business, rather than its technical legal status, compel the conclusion that AMCA cannot assert privileges. See Off. Comm. Of Admin. Claimants ex rel. LTV Steel Co., Inc. v. Moran, 802 F.Supp.2d 947, 949 (N.D. Ill. 2011) (noting that “[a] completely defunct company should not be allowed to assert privilege, regardless of whether it has technically maintained its legal status.”). Here, AMCA does not submit a certification from its Chief Executive Officer or other knowledgeable person to explain what, if any, activities that person is still undertaking, whether AMCA has any ongoing commercial activities, or whether the CEO is merely winding down the company's responsibilities. It may be, for example, that the CEO is simply discharging AMCA's legal obligations pursuant to AMCA's Chapter 11 settlement. The Court cannot agree that simply discharging certain bankruptcy requirements, without any evidence of ongoing commercial activity or viability, permits the conclusion that AMCA is something more than a defunct corporation for purposes of a privilege analysis. Bagdan v. Beck, 140 F.R.D. 660, 667 (D.N.J. 1991) (holding a bankrupt company that “exists for the sole purpose of marshalling and distributing assets” is “dead”). Further, AMCA does not provide an affidavit from the CEO, or any other responsible officer, asserting the attorney-client privilege. See Overton v. Todman & Co., CPAs, P.C., 249 F.R.D. 147, 148 (S.D.N.Y. 2008) (finding corporate officer's assertion of attorney-client privilege to be a material factor in assessing application of the privilege). In short, AMCA fails to submit any reliable evidence from which this Court can conclude that it is anything other than a defunct organization unable to assert privilege.
As a largely defunct entity that does not appear to be conducting ongoing business activity, the Court cannot conclude that AMCA has either a reputation or goodwill to protect such that the protections of privilege should apply. See, e.g., City of Rialto v. U.S. Dept. ofDefense, 492 F.Supp.2d 1193, 1200 (C.D. Cal. May 25, 2007) (“As there are usually no assets left and no directors, the protections of the attorney-client privilege are less meaningful to the dissolved corporation.”); Lewis v. U.S., Civ. No. 02-2958, 2004 WL 3203121, at *4 (E.D. Tenn. Dec. 7, 2004) (declining to apply attorney-client privilege because “[t]he company is bankrupt and has no assets, liabilities, directors, shareholders, or employees.”). AMCA filed for Chapter 11 bankruptcy more than four years ago. See In re Retrieval-Masters Creditors Bureau, Inc., No. 19-23185 (RDD) (Bankr. S.D.N.Y.), June 17, 2029, D.E. 1. It reached a settlement and its Chapter 11 petition was dismissed more than three years ago. See In re Retrieval-Masters Creditors Bureau, Inc., No. 19-23185 (RDD) (Bankr. S.D.N.Y.), May 4, 2020, D.E. 280; In re Retrieval-Masters Creditors Bureau, Inc., No. 19-23185 (RDD) (Bankr. S.D.N.Y.), Dec. 10, 2020), D.E. 357. As a result, AMCA has no identifiable assets to safeguard. Id. That conclusion finds support in an email that, Defendants contend and AMCA does not deny, AMCA's counsel sent on October 1, 2020. In that email, AMCA's counsel stated that he sought “‘to complete [AMCA's] production obligations now because the Debtor will not have funding or employees after dismissal'” of the bankruptcy petition. Joint Ltr., D.E. 497, at 9 (citing e-mail from R. Weinberg to MDL Parties on Oct. 1, 2020 (on file with counsel)).
The caselaw on which AMCA relies does not yield a different conclusion. For example, in both Gilliland and Carrillo, the courts concluded that once a corporation has no reputation, goodwill, or assets to protect, the protections of the attorney-client privilege are less meaningful. Gilliland, 2006 WL 2642525, at *4; Carrillo, 2015 WL 1610282, at *2. In Overton, the president and another former officer of the defunct corporation both filed affidavits in which they stated that they were still the President and officer, respectively, and asserted the attorney-client privilege. Overton, 249 F.R.D. at 148. Here, AMCA's purported CEO has not filed an affidavit indicating his status at AMCA or asserting the attorney-client privilege. Finally, AMCA's reliance on Randy International, Ltd. v. Automatic Compactor Corp., 412 N.Y.S.2d 995 (N.Y. Civ. Ct. 1979) is misplaced. The court in Randy concluded that a defunct corporation may still assert the attorney-client privilege. Randy, 412 N.Y.S.2d at 997. However, Randy is more than forty years old and is not in line with the weight of authority holding that a defunct corporation does not retain the protections of the attorney-client privilege. See Carrillo, 2015 WL 1610282, at *2. More importantly, Randy was decided before CFTC v. Weintraub, 471 U.S. 343 (1985), which determined that a bankrupt corporation's trustee, not its former director, would hold any privilege. Weintraub, 471 U.S. at 353-55. Accordingly, the Court finds that AMCA cannot assert the attorney-client and work product privileges.
Even if this Court were to find that AMCA is sufficiently viable or operational to assert privilege, it would still conclude that the CRA Report is not privileged, for the reasons that follow.
B. Attorney-Client Privilege and Kovel
AMCA contends that the CRA Report is protected by the attorney-client privilege because AMCA's outside counsel, Hinshaw,engaged Charles River pursuant to a Kovel agreement. Joint Ltr., D.E. 497, at 14. See also AMCA Ex. A to Joint Ltr., D.E. 497-5 (engagement letter and terms and conditions). A Kovel agreement extends the attorney-client privilege to the agent of an attorney retained to assist the attorney understand the client's information, so that the attorney can provide legal advice in anticipation of litigation. United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). In Kovel, the Second Circuit found that an attorney did not waive the attorney-client privilege by sharing the client's financial information with an accountant. Id. at 921-22. The court equated the accountant with an interpreter who assists an attorney in understanding information his client has given him. Id. at 922-23.
AMCA also asserts that although Hinshaw was subsequently replaced by new counsel, all terms of the Kovel agreement have been complied with at all times. Joint Ltr., D.E. 497, at 15. For ease of reference, and because the joint letter does not identify the date of replacement, this Opinion will refer to AMCA's outside counsel as Hinshaw.
AMCA reasons that Hinshaw retained Charles River to act as a translator of AMCA's technical data to help counsel provide legal advice in anticipation of litigation. Joint Ltr., D.E. 497, at 14-15. Plaintiffs respond that the CRA Report is not privileged because it was created for a business purpose and not in anticipation of litigation. Id. at 5. Specifically, Plaintiffs maintain that Charles River was engaged to discover the scope and manner of the breach so that AMCA could comply with its contractual obligations to notify its clients (i.e., the Defendants) of the breach, and to determine how it could augment its data security and continue as a business. Id. Because AMCA seeks to withhold the materials from discovery based on attorney-client privilege and work product, it bears the initial burden of proving that the privileges apply. Holmes v. Pension Plan of Bethlehem Steel Corp., 213 F.3d 124, 138 (3d Cir. 2000).
Federal courts have long recognized that corporate clients may require the assistance of non-attorneys to gather factual information necessary for the provision of legal advice and representation, and to execute the legal advice once it has been conveyed to the company. See, e.g., Upjohn, 449 U.S. at 394 (1981) (holding that the attorney-client privilege extends to communications by a corporation's employees to legal counsel, at the behest of the corporate superior, where the communication was to secure legal advice from counsel); Westinghouse, 951 F.2d at 1424 (“When disclosure to a third party is necessary for the client to obtain informed legal advice, courts have recognized exceptions to the rule that disclosure waives the attorney-client privilege.”).
Under Kovel, this extension of the privilege includes non-attorneys who assist in the conveyance of communications necessary to issue, comprehend, and execute legal advice. See, e.g., United States v. Rockwell Int'l, 879 F.2d 1255, 1264 (3d Cir. 1990); Cottillion v. United Refining Co., 279 F.R.D. 290, 299 (W.D. Pa. 2011). However, courts are careful to scrutinize whether the third-party is intrinsic to the communication and understanding of legal advice, as opposed to acting in some other capacity. For example, in United States v. Ackert, 169 F.3d 136 (2d Cir.1999), the Second Circuit declined to extend Kovel to an attorney after concluding that he provided investment, not legal, advice. David Ackert was an attorney and an investment banker with Goldman Sachs. Id. at 137 n.1, 138. He made an investment proposal to Paramount Corporation. Id. at 138. Subsequently, Ackert had multiple conversations with Eugene Meyers, Paramount's senior vice president and tax counsel, regarding the proposed transaction's tax consequences for Paramount. Id. Seven years later, the IRS subpoenaed Ackert while conducting an audit of Paramount. Id. Paramount asserted the attorney-client privilege concerning the conversations between Meyers and Ackert. Id.
The Second Circuit rejected Paramount's assertion of privilege. Id. at 139. The Second Circuit concluded that Ackert's communications with Meyers were not to improve “comprehension of communications between attorney and client.” Specifically, the court found that Ackert did not act to translate or interpret legal communications between Meyers and Paramount, but instead to provide information to Meyers about the proposed transaction. Id. at 139-40.
Although the Third Circuit and courts in this District have adopted the Kovel approach, those courts have narrowly construed its applicability. See Rockwell International, 897 F.2d at 1264 (reasoning that the essential question under Kovel is whether the information sought to be protected is legal advice); UPMC v. CBIZ, Inc., Civ. No. 16-204, 2018 WL 1542423, at *8 (W.D. Pa. Mar. 29, 2018) (“Privilege does not attach simply because counsel communicates with a third party - such as actuaries, accountants, or federal agencies - to obtain information, seek advice, or attain professional services.”); Salvagno v. Borough of Glen Ridge, Civ. No. 08-2992, 2009 WL 2392887, at *3 (D.N.J. Aug. 3, 2009) (rejecting application of Kovel to communications between defendant and private investigator for defendant, where those communications did not assist counsel in providing legal advice to defendant); In re G-I Holdings, Inc., 218 F.R.D. 428, 435 (D.N.J. 2004) (concluding that Kovel does not protect all third-party communication “necessary to assist the lawyer in rendering legal service to the client,” and adopting the Ackert requirement that the third-party be acting as a “translator or interpreter of client communications” rather than finding “attorney-client privilege based on the necessity or value of the provided assistance”); HPD Labs, Inc. v. Clorox Co., 202 F.R.D. 410, 414 (D.N.J. 2001) (privilege does not apply merely because a communication provides advice that is legal in nature or simply because it was made by an attorney). See also Wychocki v. Franciscan Sisters of Chicago, Civ. No. 10-2954, 2011 WL 2446426, at *7 (N.D. Ill. June 15, 2011) (finding that although attorney counsel hired consultant, consultant's communications were not privileged under Kovel because consultant provided business, not legal, advice)
AMCA contends that the CRA Report is protected by the attorney-client privilege because of a Kovel agreement between Charles River and Hinshaw, AMCA's counsel. But the agreement notwithstanding, AMCA still bears the burden of establishing that application of Kovel is proper. AMCA has not met its burden. AMCA has not provided reliable evidence to demonstrate that Hinshaw retained Charles River either to translate or interpret attorney-client communications between AMCA and Hinshaw. See Ackert, 169 F.3d 138-39; UPMC, Inc., 2018 WL 1542423, at *8. Instead, the record establishes that Charles River conducted a full-scale forensic analysis of the data breach to determine its manner, scope, whether personal identifying information (PII) and personal health information (PHI) had been compromised and, if so, the extent of the compromise. That is evident from the Forensic Analysis. See Joint Ltr., Pls.' Exh. A, Forensic Analysis, D.E. 497-1, at 2-6. There, Charles River described its own mission for AMCA as follows:
Retrieval-Masters/American Medical Collection Agency (the Company) engaged Charles River Associates (CRA) to conduct a forensics review of its internal systems after receiving notice of a possible security compromise to its web payments page from an independent third-party compliance firm that works with credit card companies. Upon retention, CRA immediately began collecting facts regarding the incident, reviewing forensic artifacts, performing a log analysis, and reviewing Company code. The goals of the forensic process were to: analyze whether a data leak occurred, determine if credit cards could be processed safely and securely, and identify any measures to harden the current technology stack. CRA continues to work with the Company to develop a roadmap for
people, process, and technology improvements, as identified by CRA in the review process.
Id. at 2. The summary report detailed the key events that occurred during the breach and files that were downloaded and uploaded. Id. at 2-4. The summary report also noted that Charles River was continuing “to work with the Company to understand the data at risk by recreating the database and datamining records located within the database.” Id. at 4. The summary report therefore made clear that Charles River assisted AMCA in understanding how the breach occurred and its scope, and endeavored to develop improvements to AMCA's systems to allow AMCA to continue its business operations. Accordingly, by Charles River's own account, its role was investigatory, not to translate or interpret information that AMCA gave to Hinshaw so that Hinshaw could provide legal advice to AMCA.
The Court's in camera view of the CRA Report does not alter this conclusion. For the reasons set forth below, the in camera review confirms the Court's conclusion that the report is not privileged.
As noted above, AMCA had to conduct this investigation in order to protect its own interests and operations. But beyond that, AMCA also had a contractual obligation to Defendants to investigate and remediate the breach. For example, AMCA's agreement with LabCorp required AMCA to report any “use or disclosure of PHI not provided for by this Addendum of which [AMCA] becomes aware. [AMCA] agrees to mitigate, to the extent possible, any harmful effect that is known to [AMCA] of a use or disclosure of PHI by [AMCA] in violation of the requirements of this Addendum.” HIPAA Business Associate Addendum, Pltf. Ex. C, D.E. 497-3, ¶ 2.d. Further, the agreement required AMCA not only to notify LabCorp of a breach, intrusion, or unauthorized disclosure of PHI, but also to “take prompt corrective action to cure any such deficiencies[.]” Id. at ¶ 2.k.
It may be that the CRA Report assisted AMCA's counsel in providing legal advice and representation. But that does not qualify the CRA Report for protection under Kovel. A third party that provides investigatory results or information to counsel that assists in representing the client does not satisfy Kovel, regardless of the criticality of the analysis or information. It remains that to qualify for protection under Kovel, the third-party's role must be to translate, interpret, or “clarify communications between attorney and client.” Ackert, 160 F.3d at 139; see also In re. G-I Holdings, Inc., 218 F.R.D. at 435-36 (holding that counsel's retention of tax consultant to understand and explain to corporate client tax implications of proposed deal structure did qualify consultant's communications with counsel or corporation as privileged under Kovel). Similarly, that Hinshaw retained Charles River, or that Charles River and Hinshaw entered into a Kovel agreement, does not alter this conclusion. E.I. du Pont de Nemours & Co. v. MacDermid, Inc., Civ. No. 06-3383, 2009 WL 3048421, at *3 (D.N.J. Sept. 17, 2009) (“that the communication between the attorney and agent later proves helpful to the client's legal representations does not bring the communication within the scope of the attorneyclient privilege.”); Sealed Air Corp., 253 F.R.D. at 312 (same); Cellco P'ship v. Certain Underwriters at Lloyd's London, No. 05-3158, 2006 WL 1320067, at *3 (D.N.J. May 12, 2006) (same). Accordingly, AMCA has failed to establish that the CRA Report was created to translate, interpret, or clarify communications between AMCA and its counsel.
C. Work Product Doctrine
AMCA and the Defendantsargue that the CRA Report is subject to the work product doctrine because it was created primarily for, and produced in anticipation of, litigation. Joint Ltr., D.E. 497, at 10, 14-21. Plaintiffs, on the other hand, again contend that the CRA Report is not protected by the work product doctrine because the report was created for a business purpose, not litigation. Id. at 5-7. The Court's determination that AMCA, as a now defunct entity, can no longer assert any privilege over the CRA Report, largely moots consideration of whether the doctrine once applied. But in the interest of completeness, the Court concludes that even if the CRA Report otherwise qualified for work product protection, the Court would still require AMCA to produce it.
Defendants argue that the work product doctrine, like the attorney-client privilege, applied to protect the CRA Report from disclosure until AMCA became defunct.
1. Subject Matter Waiver
Plaintiffs assert that AMCA waived any privilege over the CRA Report because it produced the Forensic Analysis, and offered to provide forensic reports and documents to LabCorp if LabCorp would agree to indemnify AMCA. Joint Ltr., D.E. 407, at 3-4. AMCA contends that its production of the Forensic Analysis did not act as a waiver because the Forensic Analysis, unlike the CRA Report, was created for a business purpose and could be shared outside of litigation without compromising the privileged nature of any other materials. Id. at 17-18. AMCA also argues that its proposal to provide LabCorp with certain of the forensic reports cannot be viewed as a waiver because LabCorp never accepted the offer. Id. at 18-19.
A party may waive privilege, whether attorney-client or work product, through various actions including purposeful disclosure, partial disclosure, and careless disclosure. Edna Epstein, The Attorney-Client Privilege and the Work-Product Doctrine 292-309 (American Bar Association 2001). Under the doctrine of waiver, when “[c]onduct touches a certain point of disclosure, fairness requires that the privilege shall cease whether he intended that result or not.” 8 Wigmore, Evidence § 2327 at 636 (1961). Accordingly, a client generally waives the privilege if he or she voluntarily discloses the privileged communication to a third party, Westinghouse, 951 F.2d at 1424; In re Diet Drugs Prods. Liab. Lit., MDL No. 1203, 2001 WL 34133955, at *5 (E.D. Pa. April 19, 2001), or fails to take reasonable measures to ensure the confidentiality of communications with counsel. See Kaufman v. Sungard Invest. Sys., Civ. No. 05-1236, 2006 WL 1307882, at *3 (D.N.J. May 10, 2006); Smithkline Beecham Corp. v Apotex Corp., 232 F.R.D. 467, 479 (E.D. Pa. 2005) (stating that mass dissemination of purportedly confidential communications can destroy an assertion of the privilege).
In the context of work product, “[t]he predicate of the waiver inquiry . . . [is] whether the material was disclosed to an adversary.” Maldonado v. New Jersey ex rel. Administrative Office of Courts-Probation Division, 225 F.R.D. 120, 131-32 (D.N.J. 2004). For protections of the work product doctrine to be waived, disclosures to a third party must afford an adversary the ability to gain access to the information sought to be protected. Westinghouse, 951 F.2d at 1424, 1428. That disclosure necessarily nullifies the confidentiality rationale of the work product protections, i.e., to shield “the confidentiality of papers prepared by or on behalf of attorneys in anticipation of litigation” and “enabl[e] attorneys to prepare cases without fear that their work product will be used against their clients.” Id. (citing Hickman, 329 U.S. at 510-11). “The essential question with respect to waiver of the work-product privilege by disclosure is whether the material has been kept away from adversaries.” Id. (citing Nicholas v. Wyndham Int'l, Inc., Civ. No. 01-147, 2003 WL 23198845, at *3-4, 2003 U.S. Dist. LEXIS 24086, at *9 (D.V.I. May 19, 2003)). “The party seeking to obtain protected work product bears the burden of proving that the protection has been waived.” Hatco Corp. v. W.R. Grace & Co.-Conn., Civ. No. 89-1031, 1991 WL 83126, at *7 (D.N.J. May 10, 1991). A showing of disclosure to a third party does not result in a waiver of the work product protection if the parties have common interests. Id.
If the court determines that a waiver has occurred, it must then determine the scope of that waiver. “When a disclosure waives privilege or work-product protection, that waiver will extend to undisclosed documents or communications if: (1) the waiver is intentional; (2) the disclosed and undisclosed communications or information concern the same subject matter; and (3) they ought in fairness be considered together.” Shire LLC v. Amneal Pharms., LLC, Civ. No. 11-3781, 2014 WL 1509238, at *6 (D.N.J. Jan. 10, 2014). Courts typically find subject matter waiver when the person holding the privilege attempts to use it as both “a sword” and “a shield” or when the person attacking the privilege will suffer prejudice at trial. Id.; see also Westinghouse, 951 F.2d at 1426 n.12 (indicating that where a partial waiver permits the disclosing party to tell a one-sided story, the privilege is waived as to all communications on the same subject matter).
a. Production of the Forensic Analysis & Calls with LabCorp
Here, AMCA effected a significant waiver of work product protection as to the CRA Report when it: (1) produced the Forensic Analysis to all parties in response to subpoenas served on them; and (2) produced on May 16, 2019, and while under threat of litigation, certain of Charles River's findings to LabCorp.Joint Ltr., Pls.' Exh. B, May 31, 2019 Letter from William E. Ridgway, D.E. 497-2, at 3. As noted earlier, the Forensic Analysis was produced both by AMCA and several Defendants at the commencement of this litigation. Joint Ltr., D.E. 497, at 2. In that Report, Charles River indicated that it was hired to complete:
Plaintiffs contend AMCA participated in more than one telephone call with LabCorp in which it discussed Charles River's findings. See Joint Ltr., D.E. 497, at 5 n.6. However, this Court finds reference to only one such telephone call in the exhibits. Thus, the Court will focus on that documented telephone call.
a forensics review of its internal systems after receiving notice of a possible security compromise to its web payments page from an independent third-party compliance firm that works with credit card
companies. Upon retention, CRA immediately began collecting facts regarding the incident, reviewing forensic artifacts, performing a log analysis, and reviewing Company code. The goals of the forensic process were to: analyze whether a data leak occurred, determine if credit cards could be processed safely and securely, and identify any measures to harden the current technology stack. CRA continues to work with the Company to develop a roadmap for people, process, and technology improvements, as identified by CRA in the review process.Joint Ltr., Pls.' Exh. A, Forensic Analysis, D.E. 497-1, at 2. Charles River also set forth its ongoing tasks. Id. at 5. These included: (1) continuing to work with AMCA to “understand the data at risk by recreating the database and datamining records located within the database;” and (2) “reviewing application security findings with [AMCA] to assess the situation and identify and prioritize people, process, and technology improvements.” Id. at 5-6.
With respect to the telephone conference, Charles River, AMCA, and LabCorp participated in a conference call on May 16, 2019, to discuss Charles River's forensic investigation “during which [Charles River] provided technical details regarding its investigation and findings.” Joint Ltr., Pls.' Exh. B, May 31, 2019 Letter from William E. Ridgway, D.E. 497 2, at 3. On May 31, 2019, AMCA's counsel, William Ridgway, also sent a letter to LabCorp's counsel in which Mr. Ridgway further explained Charles River's investigation and findings, as follows:
Soon after AMCA's initial review, on March 28, 2019, AMCA hired CRA through outside counsel to investigate any potential security incident in its systems. In the course of its investigation, CRA collected forensic evidence to determine if a security event had occurred. CRA's review of the forensic evidence collected identified that a web shell was placed on a web server that had access to AMCA's primary database (the Champ database) starting on August 1, 2018. CRA identified 15 suspicious internet protocol (IP) addresses along with another web shell that was inserted on January 27, 2019. Lastly, CRA identified several application issues that the unauthorized user could have used to gain information about AMCA
through the Champ database. Based on the functionality of the two web shells along with other information reviewed, CRA determined that all AMCA data contained within the Champ database may have been exposed to an unauthorized party.Id. at 4.
Considered cumulatively, the foregoing disclosures by AMCA, despite the mounting threat of litigation, constitute waiver of work product protection for the CRA Report. During the telephone conference on May 16, 2019 and in the subsequent letter to LabCorp's counsel, AMCA disclosed the purpose of the Charles River investigation, provided an overview of Charles River's methodology, and articulated the broad conclusion that an unauthorized party had obtained access to data in AMCA's primary database. It is fair to say that the letter related a broad overview of the investigation. But the Forensic Analysis that AMCA produced in discovery was considerably more specific. The Forensic Analysis provided specific information about the scope of the review and a reconstruction of events of the Data Breach. Joint Ltr., Pls.' Exh. A, Forensic Analysis, D.E. 497-1, at 1-3. The reconstruction specified the dates and times that specific intrusion activities occurred on AMCA's servers, including specific software and files that were uploaded and downloaded. Id. at 2-4. It noted, for example, that certain credentials had been “hard coded” into AMCA files and provided specific examples. Id. at 4. Finally, the Forensic Analysis listed Charles River's ongoing tasks. Id. at 4-5. Indeed, AMCA all but acknowledges as much when it contends that the Forensic Analysis contains the underlying facts regarding the Data Breach. Joint Ltr., D.E. 497, at 18.
Therefore, the substance and scope of AMCA's disclosures support a finding of subject matter waiver. But so too do the circumstances under which AMCA made those disclosures. By AMCA's own account, when it conducted the May 16, 2019 telephone conference with LabCorp and Charles River, and sent the follow-up letter, it was aware of the likelihood of litigation. Indeed, AMCA was originally named as a defendant in several cases that were consolidated into the MDL on or about July 31, 2019. And when AMCA produced the Forensic Analysis in 2020, litigation was well underway, albeit AMCA was not a party to the existing litigation. AMCA's intentional disclosure of Charles River's investigation and findings undermines the purpose of both the work product and attorney-client privileges because such disclosures were made to third-parties that themselves were potential litigants and adversaries. Chevron Corp., 633 F.3d at 165 (finding that “purposeful disclosure of [] purportedly privileged material to a third-party” may waive work product and attorney-client privileges “if that disclosure undermines the purpose behind each privilege”); Westinghouse Elec. Corp. v. Republic of Philippines, 951 F.2d 1414, 1424 (3d Cir. 1991) (“voluntary disclosure to a third party of purportedly privileged communications has long been considered inconsistent with an assertion of the privilege.”). Therefore, the Court concludes that AMCA has waived any privilege as to the CRA Report.
AMCA's attempt to distinguish the Forensic Analysis from the CRA Report on the basis that the Forensic Analysis was created for a business purpose, and therefore never privileged, is unavailing. Joint Ltr., D.E. 497, at 17-18. By revealing the goals, scope, methodology, and findings of Charles River's investigation to Plaintiffs and Defendants via the Forensic Analysis, AMCA relinquished work product protection over Charles River's findings.
b. Scope of the Waiver
Having determined that AMCA waived work product protection over the CRA Report, the Court must now consider the scope of that waiver. AMCA's voluntary discussion of Charles River's findings with LabCorp and production of the Forensic Analysis to the parties in this litigation acted as waivers as to all communications that concern the same subject matter and “ought in fairness be considered together.” Shire, 2014 WL 1509238, at *6. Thus, because AMCA intentionally discussed Charles River's findings with LabCorp and produced the Forensic Analysis to the parties, and both the disclosed and undisclosed communications concern Charles River's investigation and findings, they must, in all fairness, be considered together. Id.
c. Plaintiffs Have Demonstrated a Substantial Need
Even if the work product doctrine otherwise protected the CRA Report, Plaintiffs maintain that their substantial need for the Report overrides the doctrine. Joint Ltr., D.E. 497, at 7. They contend that they are unable to obtain the information contained in the CRA Report via other means. Id. They also argue that at present, the only information they have concerning Charles River's investigation of the Data Breach is the Forensic Analysis. They contend that the summary is just that - an overview of the Charles River investigation that is insufficient to elucidate the issues above.
Plaintiffs also contend that even if the CRA Report is protected work product, the parties are nonetheless entitled to obtain the facts surrounding the Data Breach in the CRA Report, as well as the factual materials Charles River reviewed and relied on to draft the Report. Joint Ltr., D.E. 497, at 5. There appears to be little dispute on that point. The dispute is whether the production that AMCA has made to date satisfies AMCA's production of discovery concerning those underlying facts. In any event, the Court's conclusion that the CRA Report is neither an attorney-client communication nor protected by the work product doctrine obviates consideration of whether discovery of the facts surrounding the data breach compels production of the CRA Report.
AMCA contends that it “produced all of the facts and data underlying its work in or around November 2020.” Joint Ltr., D.E. 497, at 16. AMCA essentially suggests that the only significant information it has not produced already is that part of the CRA Report that contains opinion work product. Id. at 16-17. AMCA reasons that “Charles River's expert analysis and curated compilation of relevant facts in the CRA Report are opinion work product because they reflect the mental impressions of AMCA's attorneys' agent.” Id. at 17.
As an initial matter, AMCA does not contend that the CRA Report is irrelevant to the parties' claims and defenses. The issue is whether, if the work product doctrine applies, Plaintiffs can overcome it by “demonstrating a ‘substantial need' for the document and that it ‘is unable without undue hardship to obtain the substantial equivalent of the [document] by other means.'” Martin v. Bally's Park Place Hotel & Casino, 983 F.2d 1252, 1262 (3d Cir. 1993) (quoting Fed.R.Civ.P. 26(b)(3)). Rule 26 (b)(3) of the Federal Rules of Civil Procedure provides:
Subject to the provisions of subdivision (b)(4) of this rule, a party may obtain discovery of documents and tangible things otherwise discoverable under subdivision (b)(1) of this rule and prepared in anticipation of litigation or for trial by or for another party or by or for that party's representative (including the other party's attorney, consultant, surety, indemnitor, insurer, or agent) only upon a showing that the party seeking discovery has substantial need of the materials in the preparation of the party's case and that the party is unable without undue hardship to obtain the substantial equivalent of the materials by other means. In ordering disclosure of such materials when the required showing has been made, the court shall protect against disclosure of the mental impressions, conclusions, opinions, or legal theories of an attorney or other representative of a party concerning the litigation.
In short, Rule 26(b)(3) establishes "two tiers of protection: first, work prepared in anticipation of litigation by an attorney or his agent is discoverable only upon a showing of need and hardship; second, ‘core' or ‘opinion' work product that encompasses the ‘mental impressions, conclusions, opinion, or legal theories of an attorney or other representative of a party concerning the litigation' is ‘generally afforded near absolute protection from discovery.'" In re Cendent Corp., 343 F.3d 658, 663 (3d Cir. 2003) (quoting United States v. Nobles, 422 U.S. 225, 238-239 (1975)). Although it was AMCA's burden to establish the CRA Report qualified for work product protection, Plaintiffs bear the burden of showing substantial need and undue hardship. In re Cendant, 343 F.3d at 663. If Plaintiffs satisfy the burden, the Court must then consider whether the CRA Report constitutes opinion or core work product.
Plaintiffs have established a substantial need for the CRA Report and the documents on which Charles River relied to create the Report. First, the Court cannot discern, nor has AMCA articulated, an alternate way by which the parties could obtain the substance of the report absent undue hardship. It is beyond dispute that Charles River conducted an extensive investigation into the cause, manner, and scope of the Data Breach. That report would allow the parties a fulsome, specific understanding of how the Data Breach occurred, whether deficiencies in AMCA's security protocols allowed the breach to occur, and whether any safeguards that Plaintiffs contend Defendants should have undertaken would have prevented or mitigated the breach.
That discovery is central to the Plaintiffs' claims in this matter. Plaintiffs' general theory of their case is that Defendants could have prevented the identity theft had they limited the customer information they shared with their vendors and employed reasonable measures to assure that AMCA, as their agent entrusted with the Plaintiffs' PII and PHI, implemented and maintained adequate data security protocols. The CRA Report and related materials are the only source of information to understand AMCA's own assessment of the cause, methodology, and extent of the Data Breach, and therefore, whether any acts or omissions of the Defendants might give rise to liability. Without the CRA Report, the parties cannot fully explore and litigate those issues that are fundamental to the claims in this litigation. Simply stated absent the CRA Report, the parties will be unable to fully discover whether AMCA's security measures were subpar and whether Defendants should have been aware that they were deficient and responded accordingly. It follows that the information in the CRA Report will inform the outcome of this litigation. See Mercury Indemnity Company of America v. Great Northern Ins. Co., Civ. No. 19-14278, 2022 WL 844561, *9 (D.N.J. Mar. 22, 2022) (“A substantial need exists where the information would have a significant impact on the outcome of the case.”). It is both relevant and material to the issues in the litigation.
It is also apparent that neither Plaintiffs nor Defendants can obtain the substantial equivalent of the CRA Report, if there is such a thing, by other means without undue hardship. It is not available from any other, less intrusive source. No other party has the CRA Report. Nor can Plaintiffs or Defendants hire a forensic computer examiner to conduct its own analysis or determine the manner and scope of the breach using other discovery methods. See Robinson v. Allstate, Civ. No. 98-4909, 1999 WL 179754, *4 (E.D. Pa. 1999) (finding there is a substantial need if facts cannot be delivered in a deposition or through another discovery device).
Finally, the Court rejects AMCA's contention that the CRA Report contains opinion work product. AMCA's argument is internally inconsistent and suggests the proverbial “sword and shield” framework. On the one hand, AMCA argues that the Forensic Analysis, itself a summary of the larger collection of Charles River's work as reflected in the CRA Report, contains “all of the facts that Charles River had access to, and therefore Plaintiffs cannot show substantial need for the [CRA] Report in order to have access to relevant factual material.” Joint Ltr., D.E. 497, at 17. On the other hand, and without any particularization, AMCA contends that the CRA Report, unlike the Forensic Analysis, reflects “the mental impressions of” Charles River acting as agent of AMCA's counsel. Id. The Court struggles to reconcile these two positions. Further, AMCA has not offered a particularized analysis to explain the distinction. It blandly asserts that the CRA Report “is Charles River's compilation of relevant facts and their professional opinions and conclusions based on their expert analysis of those facts. . . .” Putting aside that the “relevant facts” themselves merit no privilege, AMCA does not explain how Charles River's analysis of the Data Breach in the CRA Report: (1) is qualitatively different than that presented in the Forensic Analysis; and (2) in any event, reflects the “the mental impressions, conclusions, opinions, or legal theories of an attorney or other representative of a party concerning the litigation” under Rule 26(b)(3). See In re Tri Harbor Holdings Corp., Civ. No. 19-13448, 2022 WL 659514, at *7 (Bankr. D.N.J. Mar. 4, 2022) (finding that the party asserting work product protection must produce certain documents because, after conducting an in camera review, it was clear that those documents reflected facts or data considered by expert and did not contain legal theories, mental impressions, conclusions or opinions); see also Ford Motor Co. v. Edgewood Properties, Inc., 257 F.R.D. 418, 422-23 (D.N.J. 2009) (concluding after an in camera review of the purportedly privileged document that the document was not protected as core work product because it did not contain the mental impressions of counsel).
Moreover, even if the CRA Report contained core work product, it is difficult to imagine that the entire CRA Report is comprised of it such as to justify withholding the entire report. Indeed, AMCA itself admits that the CRA Report contains factual information which, as noted above, would not merit core work product protection.
This Court's in camera review of the CRA Report reveals no opinion or core work product. The CRA Report is entirely factual. It discussed potential security vulnerabilities related to AMCA's transaction-processing operations that malicious actors could exploit to gain access to the Champs application and exploit the data that AMCA stored. It considered seven such vulnerabilities, the manner in which each could be exploited, and assigned a specific risk level to each such vulnerability. There is significant overlap between the CRA Report and the Forensic Analysis, in that the Forensic Analysis already produced to the parties similarly discussed most of those vulnerabilities, the means by which they could be exploited, and the extent of the potential exploitation for each such vulnerability. Joint Ltr., Pls.' Exh. A, Forensic Analysis, D.E. 497-1, at 3-4. The CRA Report provides additional factual information and context necessary to understand and assess each of those potential vulnerabilities and their relevance to the claims in this litigation. However, the CRA Report contains nothing suggestive of the mental impressions, thoughts, or opinion of AMCA counsel that would qualify for work product protection. There is no indication, for example, that it was prepared to address particular claims or legal issues that AMCA was likely to confront in litigation. It certainly does not betray counsel's legal strategy. Accordingly, the Court cannot conclude that production of the report would risk disclosure of the mental thoughts, impressions, or legal theories of AMCA's counsel. See Ford Motor Co., 257 F.R.D. at 422-23 (denying work product protection for former employee's affidavit, reasoning that “[a]fter an in camera review of the affidavit, the court concludes that the affidavit contains a recitation of facts within the ken of the witness and does not contain the mental impressions or legal theories of counsel”).
V. Conclusion
For the reasons stated herein, this Court will require AMCA to produce the full CRA Report and all underlying factual materials Charles River relied on in creating the CRA Report. An appropriate Order accompanies this Opinion.