Opinion
1390-2021
03-21-2022
ST. FRANCES ACADEMY, et al. v. GILMAN SCHOOL, INC.
Circuit Court for Baltimore City Case No. 24-C-19-002374
Berger, Reed, Beachley, JJ.
OPINION [*]
Beachley, J.
In 2019, Tyree Henry and his parents filed suit against Gilman School, Inc. ("Gilman") and various other defendants for damages resulting from an injury that he sustained on Gilman's football field during a game in 2016. This appeal arises from a discovery dispute between appellee Gilman and appellants St. Frances Academy ("SFA"), Henry Russell, and Messay Hailemariam (collectively, the "Coaches"). The Coaches, who are not parties to the underlying case, present the following issues on appeal:
1. As a case of first impression, under what circumstances may a non-party be compelled to relinquish all his private cell phone data to a third-party for extraction and production to a litigant in a civil case?
2. Did the circuit court err by ordering the [C]oaches to surrender their cell phones for extraction and production?
As we shall explain, the circuit court reasonably protected the Coaches' privacy interests, and ordered discovery protocols consistent with the Maryland Rules. Accordingly, we affirm.
FACTUAL AND PROCEDURAL BACKGROUND
Tyree Henry suffered a serious spinal injury in 2016 while playing a high school football game for SFA against Gilman on Gilman's home field. In his pending negligence action against Gilman, Mr. Henry alleges that his injury was caused by a defective condition in Gilman's field. He also alleges that, had he not been injured, he "would have accepted a full scholarship offer to play, and would have played, college football at an elite level, been drafted by an NFL team, and enjoyed a successful NFL career."
On March 2, 2022, the circuit court granted partial summary judgment against Mr. Henry for damages related to the "alleged loss of a future professional athletic career."
On January 3, 2020, Gilman sent a subpoena requesting SFA to produce numerous documents, including "documents and communications between [Mr. Henry and] the football and/or basketball coaching staff and/or athletic trainer(s)" at SFA. SFA produced numerous documents, but did not produce any emails or text messages. On November 10, 2020, Henry Russell, who, at the time of the injury was employed by SFA as the co-head football coach, testified in a deposition that he exchanged text messages with Mr. Henry after his injury. He testified that he looked through his phone for text messages exchanged with Mr. Henry, but was unable to find any because he had obtained a new phone sometime between 2016 and 2020. Mr. Russell testified that other members of the coaching staff likely communicated with Mr. Henry by text message as well.
In December 2020, Gilman suggested that the Coaches work with a third-party e-discovery vendor to extract the relevant text messages from the phones of Mr. Russell and Mr. Hailemariam, a coach at SFA who recruited Mr. Henry. On February 2, 2021, the Coaches' counsel expressed concern about the cost of forensic extraction of data from the phones and asked "to see something from the vendor explaining what needs to be done at SFA's end . . . to accomplish the extraction." Gilman responded by providing an overview of the "basic protocols" for text message extraction from two e-discovery vendors, Epiq eDiscovery Solutions, Inc. ("Epiq") and KL Discovery. Additionally, Gilman provided a link to a detailed article about the technical aspects of cell phone data extraction. The Coaches' counsel responded:
Mr. Hailemariam is now SFA's head coach.
The Coaches' attorney also represented SFA.
Forensic data extraction involves first making a forensic image, or "mirror image," of the device, which is "an exact bit-for-bit duplication" of "all allocated and unallocated space" on a storage device. Delta T, LLC v. Williams, 337 F.R.D. 395, 400 (S.D. Ohio 2021) (first quoting List Indus., Inc. v. Umina, No. 3:18-CV-199, slip op. at 1 (S.D. Ohio May 1, 2019), then quoting Bennett v. Martin, 928 N.E.2d 763, 773 (Ct. App. Ohio 2009)).
I don't think it is appropriate to have any type of extraction done on people's personal phones. I suggest that I have SFA ask the people who were involved to check their own devices and if they still have any text messages from that time period that are relevant, the individuals can make screen shots and send them to me. I can then share them with you after I have reviewed them to make sure no irrelevant personal information is being disclosed.
Gilman reassured the Coaches that "Procedures can be put in place such that only those relevant text message communications are retrieved from them. In a nutshell, an independent third party vendor can extract only that relevant information that will be turned over to us." Additionally, Gilman was "open to a discussion on cost for the extraction."
On March 5, 2021, Gilman, in addition to sending a second subpoena to SFA's custodian of records, sent subpoenas to Mr. Russell and Mr. Hailemariam requesting "documents and communications," including text messages related to the litigation. Gilman additionally sent SFA a letter providing detailed information on the procedure for remote data extraction using iCloud and represented that "[t]he extraction of this relevant information can be done in such a way to ensure that no personal non-responsive information is collected and/or seen by anyone other than an independent third-party forensic vendor." Gilman offered to allow the Coaches' counsel to "review the collected data prior to its production" to Gilman and/or to enter into a claw-back agreement. Finally, Gilman stated, "If cost is an issue, we are willing to discuss the shifting of that expense."
In response to the subpoenas, the Coaches' counsel sent an email to Gilman on March 16, 2021, attaching twenty screenshots of text messages from Mr. Russell's phone. The Coaches' counsel further informed Gilman that Mr. Russell "also exchanged text messages from another football coach and an SAT coach, neither of whom is affiliated with SFA or any party to the lawsuit. I am therefore reluctant to disclose those private communications." The Coaches' counsel also stated that Mr. Hailemariam "was unable to retrieve old messages."
The next communication between the parties that appears in the record is an email from Gilman's counsel to the Coaches' counsel on April 14, 2021, stating:
Both the Coaches' and Gilman's counsel asserted during a hearing on October 19, 2021, that, "weeks before" Mr. Hailemariam's phone data was extracted, counsel participated in a conference call with an Epiq representative. However, neither party submitted any exhibits indicating that such a call took place.
Included on this email is my colleague Ravan Roddy, our litigation support representative. Ravan will connect you with the third-party vendor that will handle imaging Coach Massay and Coach Russell's phones. The vendor will extract the information from the phones. Once the information has been extracted, the vendor will run a list of search terms/parameters across the extracted information in order to identify what should be produced. You and/or the Coaches will then be able to review the information before it is produced to us. We will provide you a list of the search terms in the next few days.
Gilman, the Coaches, and Epiq's employee then exchanged emails making arrangements for the extractions to take place.
On May 5, 2021, the Coaches' counsel informed Gilman that "[b]oth coaches are available tomorrow afternoon to get their phones opened." On May 6, 2021, Andrew Crouse, an Epiq employee, extracted the data from Mr. Hailemariam's phone, and saved two copies of the data on encrypted hard drives. Mr. Hailemariam, however, ultimately refused to allow the employee to remove the hard drives from the premises. The employee placed the hard drives in a sealed evidence bag and left them at SFA. Mr. Russell was not present to have the data extracted from his phone.
The Coaches advised Gilman that they had understood that Epiq would conduct the entire forensic examination and extraction at SFA, in the presence of Mr. Russell and Mr. Hailemariam. On May 10, 2021, Gilman advised the Coaches' counsel that processing the data from the cell phones at SFA "is not possible from a technical standpoint and is inconsistent with the agreed upon procedure when we had the third party vendor extract the data from the phones." Gilman and the Coaches' counsel arranged a conference call with a representative from Epiq on May 12, 2021. During that call, the Coaches' counsel asked if Epiq was bonded and if it had ever had a data breach. The next day, Epiq provided its insurance information and confirmed that it had never had a data breach.
After Gilman filed a motion to compel discovery and the Coaches moved for a protective order, the court held a hearing on July 29, 2021. In the court's order issued after that hearing, the court noted that although Mr. Henry withdrew his objection to Gilman's motion to compel production of text messages from the Coaches, the Coaches continued to oppose their production. Thus, the court ordered:
with respect to any remaining issues concerning the production of text messages by any party or non-party, the court will deny without prejudice any pending motions, and any party seeking to compel such discovery must file a new motion seeking such relief based on the agreements in place and any focusing of the issues.
Shortly thereafter, on August 9, 2021, Gilman provided the Coaches a list of proposed search terms. Gilman suggested a procedure whereby Epiq would limit its search to text messages to and from a specified list of individuals-SFA coaches, a small number of other SFA employees, Mr. Henry and his parents, eight other SFA football players, two employees of Gilman, Mr. Henry's counsel, and one other person whose relationship to this case is not clear from the record. Epiq would then search for texts containing at least one of a list of forty-four terms (many of which are duplicative, such as synonyms for "lawsuit," or different ways to express a name). The Coaches' counsel replied to Gilman's email, stating: "I haven't heard directly from the coaches but I do not believe they will agree to the search criteria. Too broad." No further discussion of the search terms appears in the record.
On August 23, 2021, Gilman filed a Renewed Motion to Compel Discovery, seeking to compel the Coaches to work with Epiq to extract their cell phone data. The next day, the Coaches moved for a protective order, asserting that, as non-parties, they were "not . . . prepared to relinquish their private cell phone data to a third party." Gilman's opposition to that motion included an affidavit from Andrew Crouse, the Epiq employee who extracted data from Mr. Hailemariam's phone. Mr. Crouse described Epiq's protocols for handling extracted data and Epiq's general security features. Mr. Crouse also described the events that transpired when he extracted data from Mr. Hailemariam's phone. Mr. Crouse stated: "The parties can apply keywords and date filters to search for relevant data. Only the relevant hit data that is promoted for review is viewed by a human in a readable, non-encrypted form."
On October 19, 2021, the court held a hearing on Gilman's motion to compel and the Coaches' motion for protective order. Gilman argued that it had explained Epiq's procedure to the Coaches in detail and the Coaches had agreed to the entire procedure. Furthermore, Gilman stated that "no human looks at [the data] until [the Coaches' counsel] gets an opportunity to go through it. . . . [W]hen it gets time for a human to set eyes on it, [the Coaches' counsel] can be the very first person to look at the text messages before it's disclosed to me." In response, the Coaches' counsel told the court:
I agreed to start the process. In the spirit of trying to cooperate and trying to produce everything reasonably producible, I listened to a sales pitch from the vendor about how they do things.
. . .
I read the information that [Gilman's counsel] sent to me. And I agreed to have Coach Russell, who I was told had the easier of the two phones to extract, to start the process, and he did. . . .
. . .
I was under the belief that it would all take place in Coach Russell's presence so he would always have access to his data, and it would never leave his sight, and leave his effective control.
. . .
So that's all I agreed to. I did not agree to the most intrusive part, really, is when the data goes out of your control, and you lose all possession of it, and all control over it.
In its ruling on the competing discovery motions, the court ordered that the Coaches allow Epiq to extract "relevant text messages" from Mr. Russell's phone and process the data from both phones, using the search terms provided in Gilman's August 9, 2021 email.However, the court eliminated two Gilman employees from the search list of individuals who may have exchanged text messages with the Coaches, concluding that Gilman should first attempt to retrieve those text messages from its own employees. The court further limited the discovery request by removing all of the SFA football players other than Mr. Henry from the search list because they were minors at the time of the incident. Importantly, the court's order provided that "the SFA Parties shall be permitted to review the text messages that fall within the specified parameters for relevance prior to production to Gilman." Finally, the order provided that "Gilman shall pay the cost only for the extraction of Mr. Hailemariam's cell phone."
Much confusion exists throughout the record concerning which of the Coaches' phones had already been extracted. The court's order actually reads:
ORDERED that the SFA Parties, at their expense, are hereby COMPELLED to mail via FedEx the encrypted hard drives containing the data extracted from Henry Russell's cell phone to Epiq . . . .
ORDERED that the SFA Parties are hereby COMPELLED to permit Epiq to extract Messay Hailemariam's cell phone on or before Friday, October 29, 2021.However, the record is clear that the court intended to order that Mr. Russell's phone be extracted rather than have Mr. Hailemariam's phone extracted a second time. At oral argument, the parties agreed that the Coaches' names were transposed.
The order actually references an "email dated October 20, 2021," but no such email appears in the record. At oral argument, counsel clarified that the search terms were contained in the August 9, 2021 email.
We note that Gilman's counsel unequivocally represented to the court that it would pay all costs related to the extraction of the cell phone data, and that it had already paid for the extraction of the first phone.
STANDARD OF REVIEW
We review a trial court's decision on a discovery motion for abuse of discretion. Md. Bd. of Physicians v. Geier, 451 Md. 526, 543-44 (2017). A trial court abuses its discretion where "no reasonable person would take the view adopted by the [trial] court," "the court acts without reference to any guiding principles, and the ruling under consideration is clearly against the logic and effect of facts and inferences before the court," or "the ruling is violative of fact and logic." Bacon v. Arey, 203 Md.App. 606, 671 (2012) (alteration in original) (quoting Beyond Sys., Inc. v. Realtime Gaming Holding Co, LLC, 388 Md. 1, 28 (2005)).
DISCUSSION
The Coaches argue that the procedure the court endorsed for extracting data from their phones does not adequately protect their privacy rights as non-parties. Specifically, the Coaches are concerned that allowing the data from their phones to leave their effective control will allow for their private data to be viewed by others. Viewing this matter as a case of first impression, the Coaches argue that this Court should create a presumption that "a non-party's personal cell phone data [is] not discoverable absent compelling circumstances." We note, however, that what led to the discovery dispute here related to a narrow concern-whether Epiq could transport the Coaches' data to Epiq's facility in Arizona for forensic analysis.
Gilman responds that this case "does not warrant a drastic change to Maryland law." In Gilman's view, the court "appropriately weigh[ed] the competing interests at stake" as required by the Maryland Rules governing discovery, and adequately protected the Coaches' privacy interests. We agree with Gilman.
The rules of discovery in Maryland "were deliberately designed to be broad and comprehensive in scope." Gallagher Evelius & Jones, LLP v. Joppa Drive-Thru, Inc., 195 Md.App. 583, 595 (2010) (quoting Ehrlich v. Grove, 396 Md. 550, 560 (2007)).
The fundamental objective of discovery is to advance "the sound and expeditious administration of justice" by "eliminat[ing], as far as possible, the necessity of any party to litigation going to trial in a confused or muddled state of mind, concerning the facts that gave rise to the litigation." Because the "sound and expeditious administration of justice" is best served when all parties are aware of all relevant and non-privileged facts, the discovery rules are intended to be liberally construed.Id. at 595-96 (alteration in original) (citations removed).
Pursuant to Rules 2-412(c) and 2-510(a)(1)(B), Gilman requested the non-party Coaches to produce electronically stored information. In their motion for a protective order, the Coaches asserted that Gilman's request was oppressive and unduly burdensome as provided in Rule 2-403(a), and that the request constituted a "significant invasion of privacy."
The Maryland Rules concerning discovery, motions to compel, and protective orders work together to grant a trial court great flexibility in controlling discovery. Rule 2-402(a) provides, generally, that any relevant, non-privileged document is discoverable. The remaining subsections of Rule 2-402 provide more specific guidance in certain circumstances. Rule 2-402(b)(1) provides, in pertinent part:
The court shall limit the frequency or extent of use of the discovery methods otherwise permitted under these rules if it determines that (A) the discovery sought is unreasonably cumulative or duplicative or is obtainable from some other source that is more convenient, less burdensome, or less expensive; (B) the party seeking discovery has had ample opportunity by discovery in the action to obtain the information sought; or (C) the burden or cost of the proposed discovery outweighs its likely benefit, taking into account the complexity of the case, the amount in controversy, the parties' resources, the importance of the issues at stake in the litigation, and the importance of the proposed discovery in resolving the issues.
Rule 2-403 governs protective orders. Because of its centrality to the resolution of the case at bar, we set forth Rule 2-403(a) in its entirety:
(a) On motion of a party, a person from whom discovery is sought, or a person named or depicted in an item sought to be discovered, and for good cause shown, the court may enter any order that justice requires to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense, including one or more of the following: (1) that the discovery not be had, (2) that the discovery not be had until other designated discovery has been completed, a pretrial conference has taken place, or some other event or proceeding has occurred, (3) that the discovery may be had only on specified terms and conditions, including an allocation of the expenses or a designation of the time or place, (4) that the discovery may be had only by a method of discovery other than that selected by the party seeking discovery, (5) that certain matters not be inquired into or that the scope of the discovery be limited to certain matters, (6) that discovery be conducted with no one present except persons designated by the court, (7) that a deposition, after being sealed, be opened only by order of the court, (8) that a trade secret or other confidential research, development, or commercial information not be disclosed or be disclosed only in a designated way, (9) that the parties simultaneously file specified documents or information enclosed in sealed envelopes to be opened as directed by the court.
The Coaches' appellate challenge focuses on what they perceive to be a misapplication by the court of Rule 2-403(a).
We begin with the principle that "the plain language of [Rule 2-403] provides the trial court with broad discretion to fashion a protective order in a manner that balances the movant's interest in obtaining relevant discovery with the [respondent's] privacy interests." Saint Luke Inst., Inc. v. Jones, 471 Md. 312, 337-38 (2020). Moreover, "[b]ecause [trial courts] are on the scene and intimately acquainted with the details at the time, they are in a better position than are appellate judges to evaluate such an issue as oppressiveness or burdensomeness and to contrive means of lessening the burden and yet at the same time permitting investigations to go forward." Equitable Tr. Co. v. St. Comm'n on Hum. Rels., 287 Md. 80, 97 (1980).
Because Maryland's discovery rules are "closely patterned after the Federal discovery rules," Gonzales v. Boas, 162 Md.App. 344, 359 n.11 (2005), the Court of Appeals has expressly endorsed looking to federal caselaw for guidance in interpreting corresponding Maryland Rules:
Although there is little Maryland case law providing guidance to trial courts on protective orders in connection with civil discovery matters, we note that Maryland Rule 2-403(a) is based in large part on Federal Rule of Civil Procedure 26(c). We agree with our colleagues on the Court of Special Appeals that "when interpreting a Maryland Rule that is similar to a Federal Rule of Civil Procedure this Court may look for guidance to federal decisions construing the corresponding federal rule[.]"Saint Luke Inst., Inc., 471 Md. at 339 (footnote omitted) (quoting Tanis v. Crocker, 110 Md.App. 559, 574 (1996)).
Although there is a dearth of Maryland caselaw on the discovery issue presented in this case, relevant federal cases are instructive and provide persuasive authority for our conclusion that the trial court did not abuse its discretion in fashioning the discovery order issued in this case.
One of the earliest cases addressing discovery of electronic data is Playboy Enters., Inc. v. Welles, 60 F.Supp.2d 1050 (S.D. Cal. 1999). There, the plaintiff sought to recover the defendant's deleted e-mails from her computer hard drive. Id. at 1051. After determining that the information sought was relevant and discoverable, the court noted that "[t]he only restriction in this discovery is that the producing party be protected against undue burden and expense and/or invasion of privileged matter." Id. at 1053-54. The court determined that the need for the requested discovery outweighed the burden to the defendant, but instituted specific protocols to protect the defendant's privacy interests and her attorney-client privilege. Id. at 1054. The protocols included the court's appointment of a computer expert to create a "mirror image" of the defendant's hard drive, the requirement that the expert acknowledge the protective order by signing it, and the express condition that defendant's counsel have the opportunity to first review the "mirror image" prior to producing communications responsive to the request for documents. Id. at 1055. The court also required the plaintiff to pay the costs associated with the data recovery. Id. at 1054.
In Simon Prop. Grp., L.P. v. mySimon, Inc., 194 F.R.D. 639 (S.D. Ind. 2000), the court substantively applied the Playboy Enterprises protocols for the production of data from the work and home computers of four non-parties who were apparently the defendant corporation's founding members. Id. at 641. The court's discovery order provided that the court would ultimately appoint an expert to create a "mirror image" of the hard drives who would provide the information in a "reasonably convenient form to defendant's counsel." Id. The court ordered the expert "not to disclose the contents of any files or documents to plaintiff or its counsel or other persons." Id. at 642. Finally, because defendant's counsel had initial access to the records, the court required defendant's counsel to "review these records for privilege and responsiveness to plaintiff's discovery requests," and supplement defendant's responses as appropriate. Id.
Federal courts have consistently imposed similar protocols to govern the production of electronically stored data. See, e.g., Antioch Co. v. Scrapbook Borders, Inc., 210 F.R.D. 645, 653-54 (D. Minn. 2002) (compelling discovery of data from defendants' computers using a computer forensic expert to make a mirror image of the computers and provide the resulting data to both the court and defendants); Genworth Fin. Wealth Mgmt., Inc. v. McMullan, 267 F.R.D. 443, 449 (D. Conn. 2010) (compelling discovery of data from defendants' computers using a computer forensic expert to make a forensic image of hard drives and recover data, then provide the data to defendants' counsel); Delta T, LLC v. Williams, 337 F.R.D. 395, 404 (S.D. Ohio 2021) (independent forensic examiner to make forensic image of defendant's devices, search the forensic image using specified search terms, and provide the resulting documents to defendant's counsel); Frees, Inc. v. McMillian, No. 05-1979, slip op. at 3-4 (W.D. La. May 1, 2007) (compelling production of data from defendant's computers by allowing plaintiff's computer forensics expert to make forensic images of hard drives and perform keyword searches on the images); Cenveo Corp. v. Slater, No. 06-CV-2632, slip op. at 2-3 (E.D. Penn. Jan. 31, 2007) (compelling production of data from defendants' computers using computer forensics expert to make mirror image of computers, recover "all documents" from the computers, and provide resulting data to defendants to review for privilege and relevance).
The Coaches assert that the invasion of privacy resulting from extraction of their cell phone data outweighs any benefit conferred in discovery. On the threshold issue of relevancy, we note that the Coaches did not challenge relevancy at the motions hearing and, in any event, the court limited the discovery to the production of "relevant text messages." The Coaches' principal appellate argument is that the procedure adopted by the court "exposes the data to potential theft, misappropriation, and unauthorized dissemination" because multiple Epiq employees and contractors will "handle the data for manipulation."
We recognize the Coaches' valid concerns about the security of their personal information and data. We likewise agree that courts should recognize the unique position of non-parties in the production of discovery. Nevertheless, the court here specifically considered the Coaches' privacy rights as non-parties and, in our view, the procedure adopted by the circuit court not only properly balanced the Coaches' privacy concerns with Gilman's need for relevant information, but did so in a manner consistent with the federal precedent previously discussed. First, the court reduced the number of individuals in the search list and narrowed the list of search terms to be used in the data extraction. Second, the court expressly provided that the Coaches "shall be permitted to review the text messages that fall within the specified parameters for relevance prior to production to Gilman." Thus, similar to the procedure utilized in the federal cases, the Coaches are entitled to review all of the extracted data before they are required to supplement their discovery responses to Gilman.
Furthermore, the evidence presented regarding Epiq's security protocols indicate only a minimal risk to the Coaches' privacy. The data is stored in encrypted hard drives that can only be read using Epiq's proprietary forensic analysis software. The only portion of the data that is processed into a readable, non-encrypted format is the data fitting the search parameters. The hard drives are tracked using an electronic chain of custody and stored in Epiq's secure datacenter. When not in use, the hard drives are kept in a "limited access storage room that uses two-factor biometric locks, electronic access auditing, high-security wire mesh walls and ceilings, and round-the-clock camera surveillance." Using these security measures, Epiq has never had a data breach.
We note that, at the motions hearing, the Coaches' counsel did not disagree that Epiq's protocols represented the "industry standard" for the extraction of electronically stored data.
Finally, although the court's order is somewhat ambiguous in that it required Gilman to "pay the cost only for the extraction of Mr. Hailemariam's cell phone," it is clear from the motions hearing that Gilman agreed to pay all costs associated with the extraction by Epiq.
Despite a contrary suggestion in its appellate brief, Gilman's counsel advised us at oral argument that Gilman stands by its representation to pay the extraction costs.
We conclude that the court's order reasonably protects the Coaches' privacy interests and, in the end, represents a measured and balanced approach to the production of the Coaches' electronically stored data. Accordingly, in ruling on the motion for protective order, the court properly exercised its discretion when it imposed "such terms and conditions as are just" as contemplated by Rule 2-403.
JUDGMENT OF CIRCUIT COURT FOR BALTIMORE CITY AFFIRMED. APPELLANTS TO PAY COSTS.
[*]This is an unreported opinion, and it may not be cited in any paper, brief, motion, or other document filed in this Court or any other Maryland Court as either precedent within the rule of stare decisis or as persuasive authority. Md. Rule 1-104.