Opinion
21cv31-H-LL
10-12-2021
ROBERT MAAG, individually, and on behalf of a class of similarly situated persons, Plaintiff, v. U.S. BANK NATIONAL ASSOCIATION, Defendant.
ORDER GRANTING IN PART AND DENYING IN PART PLAINTIFF'S MOTION TO COMPEL FURTHER RESPONSES TO PLAINTIFF'S REQUEST FOR PRODUCTION NO. 11 [ECF No. 38]
Honorable Linda Lopez United States Magistrate Judge
Before the Court is Plaintiff Robert Maag's Motion to Compel production of documents from Defendant U.S. Bank National Association [ECF No. 38 (“Motion” or “MTC”)] and Defendant's Opposition [ECF No. 40 (“Opposition” or “Oppo.”)]. For the reasons set forth below, the Court GRANTS IN PART AND DENIES IN PART Plaintiff's Motion to Compel.
I. RELEVANT BACKGROUND
Plaintiff brings this action against U.S. Bank National Association on behalf of himself and all others similarly situated for violation of their privacy rights in connection with an alleged data breach in July 2020. ECF No. 26, ¶ 2. Specifically, Plaintiff “bring[s] this lawsuit on behalf of himself and Class Members whose PII [personal identifiable information] was compromised as a result of the Data Breach and [Defendant's] failure to (i) implement and maintain reasonable security procedures and practices appropriate to the nature of the PII; (ii) disclose its inadequate security procedures and practices; (iii) effectively monitor its systems for security vulnerabilities; and (iv) failure to timely detect, report, and disclose the Data Breach.” Id., ¶ 4. In the operative complaint, Plaintiff seeks to certify the following class:
All USB customers who reside in California and whose PII was accessed or otherwise compromised in the Data Breach, which, according to the Notice of Data Breach provided by USB, occurred on or about July 30, 2020.Id., ¶ 36. Plaintiff's operative complaint alleges one cause of action for violation of the California Consumer Privacy Act (“CCPA”), Cal. Civil Code §§ 1798.150, et seq. Id., ¶¶ 45-53.
On March 9, 2021, Defendant filed a Motion to Dismiss Plaintiff's Second Amended Complaint. ECF No. 19. On April 8, 2021, Judge Huff granted Defendant's Motion to Dismiss Plaintiff's Second Amended Complaint. ECF No. 25. On May 3, 2021, Plaintiff filed the operative Third Amended Complaint. ECF No. 26. On May 17, 2021, Defendant filed its answer and affirmative defenses. ECF No. 27. On July 27, 2021, this Court issued an order regulating discovery. ECF No. 33. On September 14, 2021, Plaintiff filed a Motion to Remand, which is still pending. ECF No. 36.
On September 20, 2021, Plaintiff filed the instant motion. MTC. Defendant responded on September 24, 2021. Oppo. The current deadline for Plaintiffs to file a motion for class certification is January 24, 2022. ECF No. 44 at 2.
The disputed written discovery is Plaintiff's Request for Production No. 11 which seeks generally the identity and contact information of putative class members. MTC at 7. Specifically, Plaintiff's Request for Production No. 11 states:
DOCUMENTS IDENTIFYING all individuals whose PERSONAL INFORMATION was stored on the COMPROMISED SERVER at the time of the DATA BREACH including the number of total individuals, the
COMPROMISED SERVER for each individual, whether the individuals were subject to an arbitration agreement with YOU, and, if so, which version of the arbitration agreement the individual is/was subject to.ECF No. 38 at 7. Defendant objected to the request on the following grounds:
U.S. Bank incorporates by reference its General Objections. U.S. Bank also objects to this Request to the extent it seeks information protected from disclosure by the attorney-client privilege, the work product doctrine, the bank examination privilege, or another privilege, immunity, or protection from disclosure, which will be withheld. U.S. Bank also objects to this Request on the grounds that it is overly broad and unduly burdensome to the extent that it asks U.S. Bank to identify whether the individual whose information was located on the Server were subject to an arbitration agreement with U.S. Bank and which version of the arbitration agreement the individuals were subject to. Determining that information for each of the individuals would require an individualized file-by-file review of each person's accounts with U.S. Bank. U.S. Bank is withholding documents on the basis of this objection. U.S. Bank also objects to this Request as overly broad, unduly burdensome, not reasonably calculated to lead to the discovery of admissible evidence, and not proportionate to the needs of the case to the extent it seeks information about the types of personal information stored on the compromised server for non-California residents, as information about individuals who are not residents of California is not relevant to any party's claims or defenses. U.S. Bank is withholding documents on the basis of this objection.
Subject to and without waiving the foregoing objections, U.S. Bank is willing to meet and confer with Plaintiff regarding this request.ECF No. 38-1 at 8. The parties have since met and conferred about this request. MTC at 38-1, Declaration of Edward J. Wynne; Oppo. at 5. Defendant represents that it:
[H]as agreed to produce a list of names of putative class members whose information was on the stolen server and to identify, for each listed individual, the relevant categories of information that was stored on the stolen server and the applicable version of arbitration agreement that applies, if any. Plaintiff has additionally requested contact information for these individuals, which Defendant has not agreed to produce.Oppo. at 5.
II. LEGAL STANDARD
“A district court is vested with broad discretion to permit or deny discovery.” Laub v. U.S. Dep't of Interior, 342 F.3d 1080, 1093 (9th Cir. 2003). Unless otherwise limited by court order, the scope of discovery under the Federal Rules of Civil Procedure is as follows:
Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party's claim or defense and proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties' relative access to relevant information, the parties' resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit. Information within this scope of discovery need not be admissible in evidence to be discoverable.Fed. R. Civ. P. 26(b)(1). Courts must limit the frequency or extent of discovery if it determines that:
(i) the discovery sought is unreasonably cumulative or duplicative, or can be obtained from some other source that is more convenient, less burdensome, or less expensive; (ii) the party seeking discovery has had ample opportunity to obtain the information by discovery in the action; or (iii) the proposed discovery is outside the scope permitted by Rule 26(b)(1).Fed. R. Civ. P. 26(b)(2)(C).
“[A] party may move for an order compelling disclosure of discovery.” Fed.R.Civ.P. 37(a)(1). “The party seeking to compel discovery has the burden of establishing that its request satisfies the relevancy requirement of Rule 26(b)(1).” La. Pac. Corp. v. Money Mkt. 1 Inst. Inv. Dealer, 285 F.R.D. 481, 485 (N.D. Cal. 2012). “The party who resists discovery has the burden to show discovery should not be allowed, and has the burden of clarifying, explaining, and supporting its objections.” Blankenship v. Hearst Corp., 519 F.2d 418, 429 (9th Cir. 1975).
III. DISCUSSION
A. The Parties' Arguments
Plaintiff seeks to compel Defendant to provide the identity and contact information of all putative class members because it is “highly relevant to the claims and defenses of the action.” MTC at 7. Specifically, Plaintiff argues that “‘the information is likely to lead to the discovery of admissible evidence that will prove or disprove [] Plaintiff's claims or Defendant's defenses.'” Id. (citing Maharaj v. Charter Communications, Inc., No. 20cv64-BAS-LL, 2021 WL 1428489, at *7 (S.D. Cal. April 15, 2021)). Plaintiff also states that the discovery it seeks is “relevant evidence related to Defendant's affirmative defenses, class certification and the merits.” MTC at 8.
Plaintiff argues that Defendant's affirmative defenses, including lack of proximate cause and that class members failed to mitigate their damages, support Plaintiff's claim that he should be permitted to contact putative class members to gather evidence related to those defenses. Id. at 7-8. Further, Plaintiff states that Defendant “denies there has even been a data breach in its discovery responses.” Id. at 8. Plaintiff argues that “class contact information is relevant because, without this information, Plaintiff would be unable to contact putative class members to establish whether any [sic] they recently have been victims of identity theft since the server was stolen.” Id.
Plaintiff further argues that “the balance of interests weigh[s] in favor of disclosing class member contact information to Plaintiff.” Id. at 9. Plaintiff argues that “putative class members in this action would not want their identities concealed from Plaintiff who is seeking to vindicate their rights under the CCPA and obtain injunctive relief to protect their PII from identity theft.” Id. Plaintiff also argues that the stipulated protective order “adds an extra layer of privacy protection.” Id. at 10.
In response, Defendant states that it “has agreed to produce a list of names of putative class members whose information was on the stolen server and to identify, for each listed individual, the relevant categories of information that was stored on the stolen server and the applicable arbitration version of the arbitration agreement that applies, if any.” Oppo. at 5. Defendant further makes three arguments in support of why Plaintiff's Motion to Compel should be denied. Id. at 4. First, Defendant argues that “Plaintiff does not satisfy his burden of establishing that contact information for thousands of individuals is relevant.” Id. Second, Defendant argues that “Plaintiff ignores completely his burden of establishing that the information is proportional.” Id. Third, Defendant argues that “even if the contact information had some relevance, any interest that Plaintiff has in this information is far outweighed by the putative class members' privacy interests.” Id. Finally, Defendant states that “in the alternative, if this Court is inclined to permit discovery of contact information in this case, Defendant respectfully requests that the Court permit discovery for only a sampling of putative class members (250) and implement additional protective measures governing Plaintiff's counsel's contact with putative class members.” Id. at 4-5.
B. Pre-Certification Discovery
“The propriety of a class action cannot be determined in some cases without discovery, as for example, where discovery is necessary to determine the existence of a class or set of subclasses.” Kamm v. Cal. City Dev. Co., 509 F.2d 205, 210 (9th Cir. 1975); see also Vinole v. Countrywide Home Loans, Inc., 571 F.3d 935, 942 (9th Cir. 2009) (“Although a party seeking class certification is not always entitled to discovery on the class certification issue, . . . often the pleadings alone will not resolve the question of class certification and . . . . some discovery will be warranted.”); Doninger v. Pac. Nw. Bell, Inc., 564 F.2d 1304, 1313 (9th Cir. 1977) (“[T]he necessary antecedent to the presentation of evidence is, in most cases, enough discovery to obtain the material, especially when the information is within the sole possession of the defendant.”). “Although in some cases a district court should allow discovery to aid the determination of whether a class action is maintainable, the plaintiff bears the burden of advancing a prima facie showing that the class action requirements of Fed.R.Civ.P. 23 are satisfied or that discovery is likely to produce substantiation of the class allegations.” Mantolete v. Bolger, 767 F.2d 1416, 1424 (9th Cir. 1985), as amended (Aug. 27, 1985); see also Doninger, 564 F.2d at 1313 (“[W]here the plaintiffs fail to make even a prima facie showing of Rule 23's prerequisites . . . . the burden is on the plaintiff to demonstrate that discovery measures are likely to produce persuasive information substantiating the class action allegations.”).
C. Relevance
The Court finds that the contact information sought in RFP No. 11 is relevant. As an initial matter, the Court notes that it is common in class actions to produce names, addresses, and telephone numbers of putative class members. Artis v. Deere & Co., 276 F.R.D. 348, 352 (N.D. Cal. 2011); Faraji v. Target Corp., 2017 WL 8292781, at *4 (C.D. Cal. April 28, 2017). As noted above, relevancy for the purpose of discovery encompasses “any party's claim or defense.” Fed.R.Civ.P. 26(b)(2). Here, Plaintiff argues that it “is entitled to the contact information of the putative class members because it is highly relevant to both class certification and the claims and defenses of the action.” MTC at 4. Plaintiff points to the specific affirmative defenses that it seeks to gather evidence about. Id. at 7-8.
Defendant's argument that Plaintiff “does not come close to meeting his burden of establishing that the contact information for thousands of individuals is relevant” is unpersuasive. Oppo. at 6. Defendant relies largely on Goro v. Flowers Foods, Inc., 334 F.R.D. 275, 2018 WL 3956018, at *8 (S.D. Cal. Aug. 17, 2018) in support of its argument. Goro involved a claim brought by plaintiffs who worked as distributors against defendant, a baked good production company, alleging that they had been misclassified as contractors rather than employees. Id. at 279. In Goro, plaintiffs brought a motion to compel the names and contact information for individuals who performed direct store delivery services and entered into a form distributor agreement with the defendant. Id. at 285. The court found that plaintiffs met their burden to establish that individuals and entities that contracted with defendant may possess information relevant to the claims and defenses in that case. Id. However, the court in Goro found that plaintiffs failed to indicate what relevant information, if any, individuals who did not sign distributor agreements with defendant may have. Id.
Goro is inapposite to the facts in our case. Here, Plaintiff alleges that a data breach caused by a theft of servers from Defendant's office resulted in 5, 725 individuals' information being compromised. MTC at 4; ECF No. 26, ¶ 2. The putative class is comprised of these 5, 725 individuals and, unlike in Goro, all putative plaintiffs were Defendant's banking customers. Plaintiff seeks the contact information of the 5, 725 putative class members “because it is highly relevant to both class certification and the claims and defenses of the action.” MTC at 4. The Court agrees with Plaintiff that the contact information is relevant to both class certification and the claims and defenses of the action. In sum, the Court finds that Plaintiff has met his burden to show that class contact information is relevant at this stage in the litigation. See Salgado v. O'Lakes, 2014 WL 7272784, at *11 (E.D. Cal. Dec. 18, 2014) (“Ultimately, ‘a court maintains a wide latitude in deciding whether contact information of putative class members should be produced prior to class certification…'”) (internal citation omitted). Accordingly, the Court concludes that the disputed discovery is relevant under Rule 26.
D. Proportionality
Defendant argues that “Plaintiff's request is not proportional to the needs of this case.” Oppo. at 8. Defendant states that Plaintiff “ignores completely his burden of establishing that the information is proportional. Nowhere does Plaintiff explain why contact information for thousands of individuals is proportional to the needs of this case.” Id. at 4. The Court finds that Defendant is correct that Plaintiff fails to address why the production of all 5, 725 putative class members' contact information would be proportional in this case. See MTC.
Defendant states in the Opposition that “if this Court is inclined to permit discovery of contact information in this case, Defendant respectfully requests that the Court permit discovery for only a sampling of putative class members (250) and implement additional protective measures governing Plaintiff's counsel's contact with putative class members.” Oppo. at 10. Notably, Defendant does not explain how it arrived at the proposed sampling of 250 putative class members. Defendant possesses the burden of supporting its objections, but fails to show why producing more than the proposed sample of 250 putative class members is not proportional or would be unduly burdensome.
However, at this stage of the litigation, the Court will exercise its discretion in ordering Defendant to provide discovery for a random sampling of 500 putative class members. See Salgado v. O'Lakes, 2014 WL 7272784, at *11 (E.D. Cal. Dec. 18, 2014) (“Ultimately, ‘a court maintains a wide latitude in deciding whether contact information of putative class members should be produced prior to class certification…'”) (internal citation omitted). The Court will also implement additional protective measures governing Plaintiff's counsel's contact with putative class members as set forth below.
E. Privacy
The California Supreme Court established a framework for assessing privacy claims in which “[t]he party asserting a privacy right must establish a legally protected privacy interest, an objectively reasonable expectation of privacy in the given circumstances, and a threatened intrusion that is serious.” Williams v. Superior Ct., 3 Cal. 5th at 552 (citing Hill v. Nat'l Collegiate Athletic Assn., 7 Cal.4th 1, 35-37 (1994)). “The party seeking information may raise in response whatever legitimate and important countervailing interests disclosure serves, while the party seeking protection may identify feasible alternatives that serve the same interests or protective measures that would diminish the loss of privacy.” Id. The court then balances these considerations. Id. (citing Hill v. Nat'l Collegiate Athletic Assn., 7 Cal.4th at 37-40).
The Court has balanced the need of the information against the putative class members' privacy interests and concludes that the information sought by Plaintiff should be produced. In support of Defendant's privacy objection, Defendant argues that “any relevance is outweighed by the putative class members' privacy interest.” Oppo. at 8. Defendant fails to explain how the disclosure of the contact information for a sampling of putative class members would be harmful to them, or why any such harm would not be mitigated by production of this information subject to a protective order. Accordingly, the Court finds that the requested discovery (contact information for a sampling of the putative class members) does not constitute a serious invasion of privacy. See, e.g., Haghyayeghi v. Guess?, Inc., 168 F.Supp.3d 1277, 1281 (S.D. Cal. March 10, 2016) (“disclosing names and contact information does not constitute a serious invasion of privacy and is commonplace in class actions.”).
Additionally, there is a protective order entered in this case [ECF No. 35], which courts have found to be sufficient to protect the privacy of putative class members. See, e.g., Hayghyayeghi, 168 F.Supp.3d 1281; see also Coleman v. Jenny Craig, Inc., 2013 WL 2896884, at *10 (S.D. Cal. June 12, 2013) (finding that “‘the parties can craft a protective order that limits the use of any contact information to the parties in this ligation and protects it from disclosure.'”). Here, because the protective order was entered prior to the issuance of this discovery order, the Court orders the following additional measures in Plaintiff's communications with the putative class members. First, Plaintiff's counsel shall identify themselves as Plaintiff's counsel in this putative class action. Second, Plaintiff's counsel shall inform the contacted putative class member that they have the right not to talk to or communicate with counsel, and if they decline to talk or communicate, then counsel shall terminate the conversation and not contact them again. Third, Plaintiff's counsel shall inform each contacted putative class member that the Court compelled Defendant U.S. Bank to disclose the putative class member's contact information, and that the contact information was provided solely for this lawsuit and cannot be distributed for other uses.
IV. CONCLUSION
For the reasons set forth above, the Court GRANTS IN PART AND DENIES IN PART Plaintiffs Motion to Compel. On or before October 25, 2021 , Defendant shall produce the requested contact information for a random sampling of 500 members of the putative class. Additionally, the production shall be accompanied by a signed declaration stating how the random sample was selected. If the sample proves inadequate because of the inability to locate substantial numbers of putative class members, or the reluctance of significant numbers of putative class members to speak to Plaintiff's counsel, Plaintiff may apply for additional relief after meeting and conferring with Defendant's counsel.
IT IS SO ORDERED.