Opinion
MDL No. 19 and 2879
10-09-2020
IN RE: MARRIOTT INTERNATIONAL CUSTOMER DATA SECURITY BREACH LITIGATION.
(JUDGE GRIMM)
REPORT AND RECOMMENDATION
Introduction
The City of Chicago ("Chicago) and the defendant Marriott International, Inc. ("Marriott") have reached an impasse on several discovery disputes. They quarrel over:
• Whether Chicago has answered correctly and completely a Request for Production for documents related to the data breach at issue.
• Whether certain of Marriott interrogatories are contention interrogatories.
• Whether Chicago should have to provide information to Marriott about Chicago's security procedures.
• Whether Chicago should provide information about whether it started this and similar data breach cases to generate revenue.
Recommendations.
For the reasons stated in the following Report, I recommend:
• That Chicago be required to provide a clearer and more definite answer to Marriott's first and second Requests for Production.
• That the court reject Chicago's objection that two of Marriott's interrogatories are contention interrogatories.
• That Chicago not be required to produce information about its security procedures.
• That Chicago must answer once again Request for Production Number 8, which seeks documents that speak to whether its motive in filing this and similar lawsuits was to generate revenue.
REPORT
I. Chicago should provide a more definite answer to Request for Production No. 1
Marriott demanded that Chicago produce "all documents and communications related to the Data Security Incident, including but not limited to the "communications sent to or received from the City of Chicago's Department of Business Affairs" referenced on page 16 of your Initial Disclosures." RFP No. 1.
Chicago responded that: "Plaintiffs will provide non-privileged documents in its possession, custody or control that are responsive to this request." Id.
In Request No. 2, Marriott then demanded that Chicago:
2. Produce all documents and communications related to any investigation you conducted into the Data Security incident, including but not limited to the investigation file for the Pre-suit Investigation. For purposes of this Request, "investigation file" includes all documents and communications that you created, sent, received, obtained, or relied upon during or in connection with the Pre-suit Investigation.
Chicago responded the same way as it had responded to the first Request, i.e., " Plaintiffs will provide non-privileged documents in its possession, custody or control that are responsive to this request."
Marriott considered this a paltry response to these two requests and sought clarification. Letter of September 1, 2020, at 2. Chicago responded: "with the exception of a limited number of privileged and otherwise protected documents for which it will provide a log," it "is not withholding any documents or communications with the Department of Business Affairs and Consumer Protection regarding the Marriott data security incident." Id.
Therefore, Marriott wonders whether it got all the documents it was entitled to or only the documents from the one Chicago agency Chicago specified. Chicago had responded that it made sense to focus on that agency's documents because it handles matters such as the data breach in this case. Letter of September 25, 2020, at 1.
Perhaps, but it still seems possible that other agencies may have documents that fall within the two requests. Marriott is entitled to know that.
I appreciate that Chicago tries to meet Marriott's concern by stating in its letter that: " "[n]evertheless, the City confirms here again that it is not withholding any documents or other information related to this matter except as will be identified in its privilege log." Letter of September 25, 2020, at 1.
Close, but not close enough to meet Marriott's concerns. In my view, Chicago has to state whether its production is complete, i.e., that there are no other documents, wherever they may be located, that are responsive to the two Requests for Production. If I am reading Chicago's September 25, 2020 letter correctly, it seems to be insisting that is was it meant—there are no other documents.
To bring this to a quick end, I will take the liberty of drafting Chicago's response consistently with what I believe it intended to say-there are no other documents anywhere that Chicago has not produced, and Chicago has provided everything that it has to Marriott.
I will use the simplicity created by now amended Fed. R. Civ. P 35(b)(2)(C) which requires the responding party to state whether it is withholding any documents based on the objection. That means that if the party is not withholding any documents because of an objection, it is producing all that it has. Its lawyer is so certifying by signing the answer to the Request for Production. Fed. R. Civ. P 26(g).
I will therefore deem Chicago to have answered the two Requests as follows:
Chicago will produce the documents requested by __________. It has withheld documents that it claims are privileged and will comply with Fed. R. Civ. P 26 (b)(5)(A) by __________.
In deeming that this to be Chicago's answers, I am holding counsel to have made the certification contained in Fed. R. Civ. P 26(g)(1) that Chicago's production was "complete and correct," i.e., it contained everything Chicago has that is responsive to the interrogatory. If counsel is unwilling to make that certification, he should so advise me. See New Hampshire v. Maine, 532 US 742, 749 (2001) ("Where a party assumes a certain position in a legal proceeding, and succeeds in maintaining that position, he may not thereafter, simply because his interests have changed, assume a contrary position . . . .") See also Fed. R. Evid. 801 (d)(2)(C)&(D)(the statement of a person authorized to make a statement on behalf of a party is an admission by that party.).
Finally, I have left the dates blank. I expect counsel to confer and agree upon dates for any additional production and the detailed showing that Chicago has to make under Fed. R. Civ. P 26(b)(5)(A) if it is going to claim that it is withholding any documents because of a claim of privilege.
II. The interrogatories to which Chicago objects are not contention interrogatories
Interrogatories 9 and 10 state:
9. Identify every representation made by Marriott or Starwood that forms the basis of your claim in paragraph 100 of the First Amended Complaint that "'Marriott engaged in deceptive acts and practices by representing that Marriott used 'reasonable' safeguards to protect Chicago residents' personal information."
10. Identify every document and communication that forms the basis of your claim in paragraph 101 of the First Amended Complaint that Marriott failed to disclose that it "lacked reasonable safeguards to protect Chicago residents' personal information."
Chicago objects to Interrogatories 9 and 10 as a premature contention interrogatory and because it seeks information "squarely within Marriott's knowledge, custody, and control." Plaintiff City of Chicago Responses and Objections to Defendant's Second Set of Interrogatories, Response to Interrogatory Number 9.
First, I have already held in this case that a responding party must produce the information demanded even if the responding party insists that the responding party already has it. I stated :
Marriott has reminded me that in an opinion I wrote when I was a magistrate judge I pointed out this is not a proper response to a request to produce. See McNamara v. Picken, Civil Action No. 11-1051, 2013 WL 2423804, at *3 (DDC 2013) (Facciola, J.) ("[T]he courts have rejected as illegitimate any objection based on the
supposition that the other party already has what it is demanding. A moment's thought shows how impractical such an objection can be. The demanding party cannot possibly know whether it has, in fact, all of the documents it is requesting, because neither side can know to a certainty what the other side has. It is preferable, easier, and more efficient to the producing party to produce what it has, so the demanding party can determine, with all the records in front of it, whether it has all the information it needs and wants.").
Report and Recommendation, ECF No. 649 at 14.
Therefore, that Marriott may have the information it seeks is irrelevant.
Second, an interrogatory that asks a party for the facts that support a contention is not a contention interrogatory. In Roberts v. Heim, 130 FRD. 424, 430, (ND Calif. 1989), the court stated:
It is not difficult to discern a significant difference between an interrogatory which, for example, asks a plaintiff to "state all facts upon which you base your contention that defendant is liable in this action" and an interrogatory which asks a plaintiff to "state all facts upon which you base your contention that defendant was in attendance at the meeting of January 10, 1989". The latter is a reasonable interrogatory, and the former is not.
In Moses v. Halstead, 236 FRD. 667, 674 (D. Kan. 2006), the court agreed and stated:
Thus, the general rule in this court is that interrogatories may "properly ask for the 'principal or material' facts which support an allegation or defense." In addition, interrogatories may seek the identities of knowledgeable persons and supporting documents for the
"principal" or "material" facts supporting an allegation or defense.
Interrogatory 9 asks Chicago to identify certain representations, while Interrogatory 10 asks it to identify documents that form the basis of a certain claim. Neither interrogatory "asks for an opinion or contention the relates to fact or the application of law to fact." Fed. R. Civ. P 33(a)(2). They simply demand that Chicago identify specific documents. They are not contention interrogatories, and Chicago must answer them.
III. Chicago does not have to provide information about its security procedures
In its First Amended Complaint, Chicago accused Marriott of not having in place specific security procedures and protocols that might have prevented the data breach that is the subject of this case. Chicago has asked that the court fine Marriott $10,000 a day, require it to alter its data security practices, and create a "city-run fraud-monitoring program on behalf of Chicago residents." Letter of September 1, 2020. See Amended Complaint, para. 80-108, ECF No. 27.
Marriott wants to know whether Chicago had in place procedures and protocols to protect its citizens when the breach at issue in this case occurred. Marriott justifies its demand on the ground that the pot should not call the kettle black. Chicago should disclose its procedures so that Marriott can defend itself against claims for injunctive relief and argue that Chicago's procedures were not any better than Marriott's.
First, there is no information that Marriott makes available of how the statute that imposes the fine or its judicial interpretation would permit Marriott to argue that any laxness or deficiency in Chicago's security procedures should either prevent the imposition of a fine or mitigate it. Therefore, I cannot find that Chicago's security procedures are relevant to any issue in this case. See Fed. R. Civ. P 26(b)(1)(discovery limited to matter that is relevant to claim or defense.) Cf. Fed. R. Evid. 401 (evidence is relevant if it makes a fact more or less probable than it would be without the evidence, and the fact is of consequence in determining the action.)
Second, that the court will impose the monitoring program is unlikely. The fundamental precept of equity is that it is not available when there is an adequate remedy at law, and the party seeking equity is threatened by irreparable harm. Age of Majority Educ. Corp. v. Preller, 512 F.2d 1241, 1243 (4th Cir. 1975). In eBay Inc. v. MercExchange, LLC, 547 US 388, 391 (2006), the Supreme Court stated:
According to well-established principles of equity, a plaintiff seeking a permanent injunction must satisfy a four-factor test before a court may grant such relief. A plaintiff must demonstrate: (1) that it has suffered an irreparable injury; (2) that remedies available at law, such as monetary damages, are inadequate to compensate for
that injury; (3) that, considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted; and (4) that the public interest would not be disserved by a permanent injunction.
Furthermore, the threat of irreparable harm must be immediate. The Supreme Court has also said:
Lyons fares no better if it be assumed that his pending damages suit affords him Art. III standing to seek an injunction as a remedy for the claim arising out of the October 1976 events. The equitable remedy is unavailable absent a showing of irreparable injury, a requirement that cannot be met where there is no showing of any real or immediate threat that the plaintiff will be wronged again -- a "likelihood of substantial and immediate irreparable injury." O'Shea v. Littleton, 414 US, at 50.
Los Angeles v. Lyons, 461 US 95, 109 (1983)(emphasis added).
The creation and enforcement of a fraud monitoring program are unlikely under these factors.
First, if Chicago's residents were threatened with irreparable harm when they filed their complaint, why did they not seek immediate injunctive relief? It is inconceivable that several years after the breach, Judge Grimm will take the claim of Chicago's residents seriously, perhaps a year from now, that they are threatened with immediate irreparable harm from that breach when they did not seek immediate relief when Chicago filed its complaint. And, would they not cancel the credit cards affected by the breach, having become aware of it?
Second, monetary damages in the form of Marriott having to reimburse victims of the breach to buy programs that protect from them the consequences of a data breach are adequate. Such programs (e.g., Norton Life Lock) are now readily available and used by many people, including me. If Chicago's residents have canceled their cards and are compensated for buying such a program, they do not need injunctive relief. Nor should they fear any hardship from the breach in the future if they take ordinary steps to protect themselves. There is no public interest in creating an unneeded program.
A court in equity may balance other factors in exercising its equitable discretion, such as that one must come into equity with clean hands. But sloppy security procedures when the breach occurred do not seem to qualify as "dirty hands" or have anything to do with whether to award Chicago equitable relief. The Fourth Circuit has stated:
The purpose of the unclean hands doctrine is to "prevent the court from assisting in fraud or other inequitable conduct . . . ." Mona v. Mona Elec. Grp., Inc., 176 Md. App. 672, 714, 934 A.2d 450, 474 (2007) (quoting Turner v. Turner, 147 Md. App. 350, 419, 809 A.2d 18, 58 (2002)) (internal quotation marks omitted). It "is available to deny relief to those guilty of unlawful or inequitable conduct with respect to the matter for which relief is sought." Mona, 176 Md. App. at 714, 934 A.2d at 474. To invoke the doctrine, there must be a "nexus between the misconduct and the transaction because 'what is material is not that the plaintiff's hands are dirty, but that [she] dirties them in acquiring the right [she] now asserts.'"
United Bank v. Buckingham, 761 F. App'x 185, 191 (4th Cir. 2019).
Marriott cannot possibly meet that standard by proving that Chicago's security procedures were no better than Marriott's when the breach occurred. Premising the availability of relief on the deficiencies in Chicago's security procedures, years before the conclusion of the case and the application for equitable relief, would be, in my view, an abuse of discretion. Therefore, Marriott does not need evidence to defend itself against the award of injunctive relief.
Finally, I appreciate that Chicago's supposed hypocrisy may be fodder for cross-examination. If Chicago produces a witness who testifies to the unreasonableness of Marriott's measures, it may be appropriate to impeach her by asking whether Chicago's security procedures were no better. But, the legitimacy of that question is, as Chicago points out, a function of whether comparing a hotel's security procedures to a municipality's is comparing an apple to an apple. In any event, if Marriott's were as poor as Chicago's, it does not make Marriott's procedures reasonable. I doubt that Judge Grimm will allow such cross-examination. For all these reasons, I see no reason to compel Chicago to produce what Marriott demands.
IV Chicago should be required to comply with Request for Production 8.
Request for Production Number 3 demands that Chicago produce documents relating to the request of a Chicago Commissioner that the Chicago Law Department bring this action "or any other lawsuit . . . related to a data breach." Requests 7 and 8 "seek documents pertaining to the city's decision to apply its ordinance to data breaches generally and whether that decision was motivated by a desire to generate revenue. " Letter of September 1, 2020, at 2.
Marriott insists that it has a right to learn whether Chicago's desire to increase revenue motivated Chicago to bring this and other data breach cases. Id. at 3.
Chicago counters that courts have consistently held that the motive for bringing lawsuits is irrelevant. Letter of September 25, 2020, at 2. But, Marriott points to cases where Chicago itself sought permission to prove a plaintiff's motive for suing it. Letter of September 1, 2020, at 4.
While I appreciate Chicago's reliance on cases that support its position, I must say that in my view, saying that a motive for bringing a lawsuit is not admissible, is too great a generalization. It is easy to conjure a case where it might be. Smith, a government official, says to Jones, a newspaper publisher, "you better not print that story about me or I will sue you and put out of business." Say that Jones publishes and Smith sues Jones. One is hard-pressed to see why Jones cannot testify to Smith's threat and prove his motive in bringing the lawsuit.
Thus, generalizations by courts that "motive is inadmissible" are not always true. Be that as it may, I find it much more significant that I see an unsettling inconsistency in Chicago's assertions that its motives in bringing lawsuits are irrelevant and its describing, at the very same time, its motives in bringing this and similar lawsuits.
First, in opposing Marriott's motion to dismiss its First Amended Complaint, Chicago argued:
The City also seeks to protect its proprietary interest in "vindicat[ing] the rights of its residents" under the ordinance. City of Milwaukee v. Saxbe, 546 F.2d 693, 698 (7th Cir. 1976). Courts have repeatedly applied this rule in finding that cities had standing based on the "injuries of [their] residents." City of North Chi. v. Hanovnikian, 2006 WL 1519578, at *2 (ND Ill. May 30, 2006); accord City of Stamps v. Aloca, Inc., 2006 WL 2254406, at *6 (W.D. Ark. August 7, 2006). The FAC alleges that "Marriott's misconduct has injured Chicago residents" in many ways, such as causing them to pay more than they otherwise would have to stay at Marriott properties and to suffer fraud and identity theft. 1 (FAC ¶¶ 54-64.)
Plaintiff's Response Memorandum in Opposition to Defendants' Motion to Dismiss (EC F No. 382) at 14.
In now arguing in the matter before me, why Marriott is not entitled to the discovery it seeks, Chicago states:
Marriott next takes issue with the City's responses and productions related to Requests 3, 7, and 8. Marriott's concerns here are animated by the mistaken belief that
the City had some "ulterior motive" for bringing this litigation—i.e., generating revenue. In fact, the City was not motivated by potential civil fines in filing this action, so there are no documents supporting that notion. Rather, the City sued because Marriott's admitted failure to secure Chicago residents' data violated municipal law, injuring the City and subjecting tens of thousands of Chicagoans to potential identity theft and other harm in the process.
Letter of September 25, 2020, at 1.
In that same letter, Chicago goes further and speaks absolutely of how it does not bring "affirmative litigation as a method of generating revenue." Letter of September 25, 2020, at 2. It then discusses its efforts in two data breach cases, against Uber and Equifax, and insists that the resolution of one was "clearly a far cry from meeting its budgetary needs." Id. Chicago then points to facts that it claims show that it does not bring lawsuits to make money.
Thus, having asserted that its motives are irrelevant, Chicago proceeds to describe and characterize them, insisting that they have nothing to do with money. It is not fair of Chicago to control the narrative by asserting what its motives were but to prohibit Marriott from finding evidence that contradicts that narrative. It is a central purpose of discovery to create an equality of knowledge as to a pertinent issue. The Supreme Court has stated:
Mutual knowledge of all the relevant facts gathered by both parties is essential to proper litigation. To that end, either party may compel the other to disgorge whatever facts he has in his possession.
Hickman v. Taylor, 329 US 495, 507 (1947)
Since Chicago has put its motives in issue, discovery pertaining to those motives is appropriate. Marriott's entitlement to the information it seeks then becomes a function of applying the factors identified in Fed. R. Civ. P 26(b)(1) to ascertain whether the discovery sought should be permitted.
The factors are:
? The importance of the issues at stake in the action
? The amount in controversy
? The parties' relevant access to relevant information
? The parties' resources
? The importance of the discovery in resolving the issues
? Whether the burden or expense of the proposed discovery outweighs its likely benefit.
Applying those factors, and in support of permitting the discovery, it must be said that the issues involved in this case are important. They pertain to a significant data breach that may have affected hundreds of people. The amount in controversy is substantial. A fine of $10,000 a day is nothing to sniff at. Chicago has unique access to the information, which also favors discovery.
On the other hand, the evidence, admissible solely to attack Chicago's credibility is not in itself dispositive, which in the calculus weighs against permitting the discovery if the effort to get it is disproportionate.
Evidence to be used to impeach credibility, is discoverable. Wilshire v. Love, No. 3:14-cv-08374, 2015 US Dist. LEXIS 41240, at *9 (SD W. Va. March 31, 2015); Beckner v. Bayer Cropscience, L.P., Civil Action No. 2:05-cv-00530, 2006 US Dist. LEXIS 44197, at *9 (SD W. Va. June 28, 2006 ); Newsome v. Penske Truck Leasing Corp., 437 F. Supp. 2d 431, 437 (D. Md. 2006) --------
Finally, the factor of the parties' resources is neutral. The parties, the nation's third-largest city and an international hotel chain, which owns several hotels in that city, would seem to have equal resources.
The final issue, usually the most crucial, is one of marginal utility-does the burden and the expense of doing the discovery outweigh its benefit?
First, in Request to Produce Number 7, Marriott seeks all information "relating to" approving or disapproving bringing lawsuits involving breaches.
Marriott does not have any use for information that does not speak to whether the approval was based on a desire to generate revenue by seeking fines. Information about any other motivation for Chicago to bring a lawsuit has nothing to do with this case. Chicago need not answer it. There is no benefit to come from it.
However, Marriott's Request Number 8 is properly limited since it seeks information about bringing lawsuits "to generate revenues, fines, or fees for the City of Chicago." In my view, it seeks relevant information and is narrowly tailored to get it.
However, for its part, Chicago does not specify with any particularity what burden it would incur if it had to comply with number 8 but simply says that it is disproportionate. It has been true, however, since at least the 2015 amendments to the Federal Rules of Civil Procedure, that detailed and specific facts must support a claim of burdensomeness. Indeed, in certain cases, the failure to make such a showing is grounds in itself to overrule the objection based on "burdensomeness." Arrow Enter. Computing Sols., Inc. v. BlueAlly, LLC, No. 5:15-CV-00037-FL, 2016 WL 4287929, at *1 (EDNC August 15, 2016); Villa Polycarpe v. Seterus, Inc., 2017 WL 2257571 (MD Fla. May 23, 2017); Mann v. City of Chicago, 1:15-cv-09197, 2017 US Dist. Lexis 146039 *14-15 (ND Ill. September 8, 2017).
I have not decided to recommend that Judge Grimm overrule Chicago's objection on that ground at this point. Instead, I will recommend that Judge Grimm overrule all of Chicago's objections to Request for Production 8 but permit Chicago to revisit whether it will answer it. If it is going to object on the ground that answering it will create an unjustifiable burden, it will have to support that assertion with specific facts and figures. As the case I have cited, and other similar cases indicate, the federal judiciary has reached the limit of its patience with "general objections" and the boilerplate incantation of "burdensomeness." If Chicago does not want to comply with Request Number 8, it must make the most specific showing of why it should not have to answer this Request.
I ask counsel to meet and confer and set deadlines for Chicago's response. I would ask counsel to also advise me of what has happened, so I will see if there is another issue I have to resolve.
/s/_________
John M. Facciola Dated:
10/09/2020