Opinion
CASE NO. C17-0356JLR
08-23-2018
VERIDIAN CREDIT UNION, Plaintiff, v. EDDIE BAUER, LLC, Defendant.
ORDER ON MOTION TO COMPEL
I. INTRODUCTION
Before the court is Defendant Eddie Bauer, LLC's motion to compel. (MTC (Dkt. # 115).) Plaintiff Veridian Credit Union ("Veridian") opposes the motion. (Resp. (Dkt. # 120).) The court has considered the motion, the parties' submissions in support of and // // // // in opposition to the motion, the relevant portions of the record, and the applicable law. Being fully advised, the court GRANTS in part and DENIES in part Eddie Bauer's motion for the reasons set forth below.
Eddie Bauer's supplemental brief does not comply with Local Civil Rule 10(e)(1), which requires "[t]he text of any typed . . . brief [to] be 12 point or larger." (See generally EB Supp. (Dkt. # 122)); Local Rules W.D. Wash. LCR 10(e)(1). The court will not permit either party to violate its local rules and will consider appropriate sanctions for any future violations.
Neither party requests oral argument (MTC at 1; Resp. at 1), and the court determines that oral argument would not be helpful to its disposition of the motion, see Local Rules W.D. Wash. LCR 7(b)(4).
II. BACKGROUND
This is a putative class action "on behalf of credit unions, banks, and other financial institutions that suffered injury as a result of a security breach" involving Eddie Bauer from about January 2, 2016, to July 17, 2016. (See SAC (Dkt. # 70) ¶ 1.) Veridian alleges that the breach compromised the financial data of thousands of customers at all of Eddie Bauer's 370 retail stores in the United States and Canada. (Id.) Veridian further alleges that the breach occurred because Eddie Bauer failed to "adequately secure its data networks." (Id. ¶ 2.) Specifically, Veridian states that Eddie Bauer "systematically failed to maintain adequate data security measures, implement best practices, upgrade security systems, and comply with industry standards." (Id. ¶ 3.) Veridian contends that Eddie Bauer failed to mitigate the damage the breach caused and exacerbated the damage by failing to notify customers of the breach until about six weeks after it had occurred. (Id. ¶¶ 4-5.) //
As a result of the alleged breach and resulting harm to customers, Veridian contends that the financial institutions in the class have incurred significant costs related to: (1) notifying customers of the breach; (2) canceling or reissuing credit and debit cards compromised by the breach; (3) closing, opening, and/or reopening any accounts affected by the breach; (4) refunding or crediting cardholders for unauthorized transactions; (4) responding to a greater number of customer inquiries; (5) increasing their fraud monitoring; and (6) losing revenue. (Id. ¶ 8.) Veridian contends that Eddie Bauer has not offered any of the affected financial institutions "any compensation for the fraud losses or reissuance costs associated with [the compromised] credit and debit cards." (See id. ¶ 31.) Veridian brings claims for negligence; violation of RCW 19.255.020; and violation of Washington's Consumer Protection Act ("CPA"), RCW ch. 19.86, et seq. (Id. ¶ 10.) It seeks damages and declaratory and injunctive relief. (Id.)
In detailing the alleged deficiencies with Eddie Bauer's security, Veridian relies in part on statements from two sources: (1) a former Information Security Manager ("IS Manager"), and (2) an IT consultant ("IT Consultant"). (See, e.g., id. ¶¶ 41 (IS Manager), 65 (IT Consultant).) The IS Manager "described Eddie Bauer management's approach toward the security of its [point of sale ("POS")] environment as minimalistic and low priority." (Id. ¶ 41; see also id. (describing Eddie Bauer's approach as "bare minimum").) According to that person, Eddie Bauer failed to timely implement security patches and refused to implement recommended critical data security measures. (Id. ¶ 41; see also id. ¶ 57 (stating that Eddie Bauer refused to "update vital software programs to remove the 'bugs' and other vulnerabilities").) The IS Manager further stated that Eddie Bauer did not "implement a multi-factor authentication process for its POS environment." (Id. ¶ 74.) Eddie Bauer allegedly failed to implement those measures because it was unwilling to spend the money necessary to secure its payment systems. (See id. ¶¶ 63-64; see also id. ¶ 70.)
In 2014 and 2015, Eddie Bauer retained a third-party IT consulting firm to evaluate those systems. (Id. ¶ 64.) The firm identified "two primary security initiatives": (1) "point-to-point encryption," and (2) "tokenization of the POS environment." (Id.) That firm's IT Consultant recommended that Eddie Bauer encrypt and tokenize the POS environment in all of its stores (see id. ¶¶ 65-66, 68), but Eddie Bauer allegedly did not do so (see id. ¶ 81).
On August 2, 2018, Eddie Bauer moved to compel the production of documents responsive to its requests for production ("RFPs") No. 18 and 19. (See MTC.) RFPs No. 18 and 19 ask Veridian to produce the following:
REQUEST FOR PRODUCTION NO. 18:// (Id. at 3-4.) Veridian refused to produce responsive documents on the basis of attorney client privilege and the work product privilege. (See Nelson Decl. (Dkt. # 116) ¶ 6, Ex. A at 12-13; id. ¶ 7, Ex. B at 13-14.) The court now considers Eddie Bauer's motion.
Documents memorializing all communications with the "former Information Security Manager ('IS Manager')" referred to in paragraph 41 of [Veridian's] Amended Class Action Complaint.
REQUEST FOR PRODUCTION NO. 19:
Documents memorializing all communications with the "IT Consultant" referred to in paragraph 65 of [Veridian's] Amended Class Action Complaint.
Eddie Bauer notes that its RFPs refer to Veridian's first amended complaint but avers that the RFPs are nevertheless relevant because Veridian makes the same allegations in the second amended complaint. (See MTC at 3 n.2.)
III. ANALYSIS
Eddie Bauer argues that Veridian has waived the work product privilege by making affirmative allegations regarding the IS Manager and the IT Consultant. (See MTC at 8.) Thus, Veridian has made its communications with those people discoverable by placing the communications in issue. (Id.) Although Veridian has since identified the IS Manager and IT Consultant, Eddie Bauer claims that deposing them is insufficient because "[m]emories fade." (Id. at 9 n.6.)
Despite Veridian's objection to the RFPs on the basis of attorney client privilege, Eddie Bauer does not make any substantive argument on that point. (See generally MTC.) In addition, Veridian states that based on recent clarification from counsel for Eddie Bauer, Eddie Bauer does not seek communications between Veridian and its counsel, and therefore proposes to further amend its responses to RFPs No. 18 and 19 to withdraw the attorney client privilege objection. (See Veridian Supp. (Dkt. # 124) at 2.) For those reasons, the court GRANTS Veridian's proposal to withdraw that objection, and Veridian must serve its amended responses by the same deadline set forth below.
Veridian counters that the privilege protects the communications because they "occurred solely because of the instant litigation." (Resp. at 7.) Veridian states that responsive documents include (1) "communications between Veridian and its counsel," (2) "communications among Veridian's counsel reflecting mental impressions regarding their investigation and litigation strategy," and (3) "documents reflecting the mental impressions of Veridian's counsel in preparing the complaint." (Id. at 8.) Veridian argues that Eddie Bauer has not demonstrated a substantial need for those documents. (See id. at 8-9.) Moreover, Veridian contends that it has not waived the privilege. (See id. at 9-12.)
The work product doctrine is a qualified protection limiting discovery of "documents and tangible things" prepared by a party or its attorney in anticipation of litigation. See Admiral Ins. Co. v. U.S. Dist. Court for Dist. of Ariz., 881 F.2d 1486, 1494 (9th Cir. 1989); see also Fed. R. Civ. P. 26(b)(3)(A). "The doctrine seeks to preserve the privacy of an attorney's thought processes, encourage careful and thorough preparation by the attorney without undue and needless interference, and prevent exploitation of a party's efforts in preparing for litigation." E.E.O.C. v. Safeway Store, Inc., No. C-00-3155 THE(EMC), 2002 WL 31947153, at *4 (N.D. Cal. Sept. 16, 2002) (citing Hickman v. Taylor, 329 U.S. 495, 511-16 (1947)).
The party claiming work product protection bears the burden of establishing that the work product doctrine applies. See Kintera, Inc. v. Convio, Inc., 219 F.R.D. 503, 507 (S.D. Cal. 2003). A party may obtain discovery of work product only by showing a "substantial need" and an inability to obtain the same information elsewhere. See Fed. R. Civ. P. 26(b)(3)(A)(ii). But even if a court orders disclosure of work product, "it must protect against disclosure of the mental impressions, conclusions, opinions, or legal theories of a party's attorney . . . concerning the litigation." See Fed. R. Civ. P. 26(b)(3)(B). Those materials—opinion work product—are the "core types of work product" that the doctrine protects. See Republic of Ecuador v. Mackay, 742 F.3d 860, 869 n.3 (9th Cir. 2014); see also Safeway, 2002 WL 31947153, at *6. A party may // nevertheless waive the privilege. See United States v. Richey, 632 F.3d 559, 567 (9th Cir. 2011).
Based on Veridian's representations about the content of responsive documents (see Resp. at 8; Guglielmo Decl. (Dkt. # 121) ¶ 27), the court concludes in the first instance that the doctrine applies. The materials Veridian has withheld are documents that its counsel prepared in anticipation of this case. (See Guglielmo Decl. ¶ 27); Admiral Ins., 881 F.2d at 1494. Moreover, Eddie Bauer does not dispute that conclusion, arguing only that Veridian has waived the privilege. Cf. In re Symbol Techs., Inc. Sec. Litig., No. CV 05-3923 (DRH) (AKT), 2017 WL 1233842, at *14 (E.D.N.Y. Mar. 31, 2017) (forgoing "an analysis as to whether [the requested documents] are eligible for protection as work product" because the defendants conceded the issue). Thus, the court considers whether Veridian waived the privilege through the allegations in its second amended complaint.
Because the court concludes that Veridian has waived the privilege as to factual work product, the court does not address whether Eddie Bauer demonstrates substantial need under Rule 26(b)(3)(A)(ii). (See Resp. at 8-9 (arguing that Eddie Bauer does not demonstrate substantial need for the information)); cf. Waymo LLC v. Uber Techs., Inc., No. 17-cv-00939-WHA (JSC), 2017 WL 2485382, at *13 (N.D. Cal. June 8, 2017) (analyzing substantial need only to the extent that the at-issue materials were "non-waived attorney work-product").
The proponent of the privilege—here, Veridian—bears the burden of proving it has not waived the privilege. See United States v. Ruehle, 583 F.3d 600, 608 (9th Cir. 2009). A party waives the work product privilege when it "shows disregard for the protection by making the information public." Campagnolo S.R.L. v. Full Speed Ahead, Inc., No. C08-1372RSM, 2010 WL 11527271, at *3 (W.D. Wash. Apr. 27, 2010). By basing allegations in a complaint on work product, the party makes the information public and waives the privilege. See Brown v. China Integrated Energy, Inc., No. CV 11-2559-BRO (PLAx), 2014 WL 12577130, at *3 (C.D. Cal. June 19, 2014); Sommer v. United States, No. 09cv2093 WQH (WMc), 2012 WL 28337, at *4 (S.D. Cal. Jan. 5, 2012); Rackemann v. LISNR, Inc., No. 1:17-cv-00624-MJD-TWP, 2018 WL 3328140, at *3 (S.D. Ind. July 6, 2018) ("When work-product information is disclosed in and underlies the allegations of a [c]omplaint, . . . the information must be disclosed to allow [d]efendants to evaluate [a p]laintiff's allegations"). That rule prohibits the party asserting the privilege from using "the privilege both offensively and defensively in order to gain a strategic advantage, i.e., as both a sword and a shield." Symbol Techs., 2017 WL 1233842, at *16.
Veridian's claims rest upon its allegations that Eddie Bauer failed to adequately guard against the data breach. (See, e.g., SAC ¶ 3 ("The data breach was the inevitable result of Eddie Bauer's inadequate data security measures and approach to data security."); see also id. ¶¶ 7-8, 39.) Several of those allegations specifically reference communications with the IS Manager and the IT Consultant. (See, e.g., id. ¶¶ 41, 63-66, 68, 70, 74.) For example, the IS Manager "described" Eddie Bauer's "approach" to security as "minimalistic and low priority" and detailed several security measures that Eddie Bauer opted not to implement. (See id. ¶¶ 41, 63-64, 66, 68, 70, 74.) In addition, the IT Consultant "confirmed" that he or she made specific recommendations to Eddie Bauer about the security of its payment systems. (See id. ¶¶ 64-66, 68, 70.)
Based on the allegations in the complaint, the court concludes that Veridian has placed its communications with the IS Manager and IT Consultant in issue. (See SAC ¶¶ 41, 63-66, 68, 70, 74); Brown, 2014 WL 12577130, at *3. Even though Veridian also relies on other sources (see Resp. at 10; Guglielmo Decl. ¶ 29; SAC ¶¶ 43, 45, 48-49, 53, 61-62, 75, 80, 85, 90-91), the fact remains that Veridian explicitly relies on the communications to state its claims. Specifically, Veridian alleges that Eddie Bauer knew its security measures were substandard and nonetheless chose not to implement necessary improvements. (See, e.g., SAC ¶¶ 120-24, 128, 132-33, 138-41.) The allegations involving the IS Manager and the IT Consultant are directed squarely at proving that contention. Although Eddie Bauer knows those individuals' identities and therefore may depose them (see Resp. at 5), "documentary evidence is often necessary" even if "a deposition may be useful and informative," see Tennison v. City & Cty. of S.F., 226 F.R.D. 615, 622 (N.D. Cal. 2005).
In this regard, Eddie Bauer is incorrect that Veridian "appears to rely exclusively on statements allegedly made by the IS Manager and IT Consultant to support its assertion that Eddie Bauer's security processes were deficient." (See MTC at 8.)
In addition, Veridian's argument regarding the need to protect confidential witnesses' identities is beside the point. (See Resp. at 7.) Veridian has already disclosed the IS Manager's and the IT Consultant's identities. (See id. at 5.)
Veridian's reliance on Hausman v. Holland America Line-U.S.A., No. C11-1308BJR, 2015 WL 8327934 (W.D. Wash. Dec. 9, 2015), is unavailing. (See Resp. at 11.) In that case, the plaintiff moved to compel the defendant to provide a paralegal's notes from a witness interview. See Hausman, 2015 WL 8327934, at *1. The Honorable Barbara J. Rothstein concluded that the defendant had not waived the work product privilege because whether the witness lied during her pretrial interview—what the plaintiff hoped to discover from the notes—was "not germane" to the motion to vacate. Id. at *2-3. Unlike in Hausman, the content of the IS Manager's and the IT Consultant's communications are in issue based on Veridian's complaint.
For those reasons, the court grants Eddie Bauer's motion in part. Veridian must produce any factual work product responsive to RFPs No. 18 and 19. See Brown, 2014 WL 12577130, at *3; Symbol Techs., 2017 WL 1233842, at *19 (describing factual work product as "memoranda consist[ing] of basic factual summaries prepared from information relayed directly to [an] investigator during [an] interview"); Koumoulis v. Indep. Fin. Mktg. Grp., Inc., 295 F.R.D. 28, 39 (E.D.N.Y. 2013) (stating that such work product includes "factual investigation results"). However, Veridian need not produce responsive documents constituting opinion work product—Veridian's counsel's mental impressions, conclusions, opinions, or legal theories. See Fed. R. Civ. P. 26(b)(3)(B); Tennison, 226 F.R.D. at 623 (finding that waiver extended only to factual work product, not opinion work product); U.S. Sec. Exch. Comm'n v. Talbot, No. CV 044556 MMM (PLAx), 2005 WL 8154566, at *6 n.24 (C.D. Cal. June 27, 2005) (describing the distinction between opinion and factual work product in an attorney's interview notes). By way of example, Veridian is not required to produce documents falling within the three categories Veridian identifies: (1) "communications between Veridian and its counsel," (2) Veridian's counsel's "mental impressions regarding their investigation and litigation strategy," and (3) Veridian's counsel's "mental impressions . . . in preparing the complaint." (See Resp. at 8.) However, to the extent that Veridian also possesses factual work product related to the communications, it must produce that material to Eddie Bauer within 14 days of the date of this order. If any material contains both factual and opinion work product, Veridian may appropriately redact the opinion work product before production. By the same date, Veridian must also produce a privilege log detailing any material withheld as opinion work product. The privilege log must "describe the nature of the documents, communications, or tangible things not produced or disclosed—and do so in a manner that, without revealing information itself privileged or protected, will enable [Eddie Bauer] to assess the claim" of privilege. See Fed. R. Civ. P. 26(b)(5)(A)(ii); see also Safeway, 2002 WL 31947153, at *1 (describing the appropriate contents of a privilege log). // //
Pursuant to Federal Rule of Civil Procedure 37, if the court grants in part and denies in part a motion to compel, the court may "apportion reasonable expenses" after giving the parties "an opportunity to be heard." See Fed. R. Civ. P. 37(a)(5)(C). Because Veridian's privilege objection was reasonable insofar as Veridian's opinion work product is not discoverable, the court declines to apportion any fees to Eddie Bauer.
In its supplemental brief, Eddie Bauer acknowledges that it does not seek Veridian's counsel's "mental impressions." (EB Supp. at 3.) And Veridian's counsel represents that counsel for Eddie Bauer recently clarified that Eddie Bauer does not seek "communications between Veridian and its counsel, such as emails transmitting the draft complaint or otherwise discussing the complaint." (Veridian Supp. at 2 (citing Baxter-Kauf Decl. (Dkt. # 125) ¶ 6).)
Eddie Bauer requests production by August 17, 2018 (see MTC at 10), but the motion was first ripe for the court's consideration on that date, see Local Rules W.D. Wash. LCR 7(b)(1). Accordingly, more time is necessary to complete the production. --------
IV. CONCLUSION
For the foregoing reasons, the court GRANTS in part and DENIES in part Eddie Bauer's motion to compel (Dkt. # 115). In response to RFPs No. 18 and 19, Veridian must produce responsive documents comprising factual work product no later than fourteen (14) days of the date of this order. If any material contains both factual and opinion work product, Veridian may appropriately redact the opinion work product before production. By the same deadline, Veridian must also produce a privilege log as detailed above and supplement its responses to Eddie Bauer's RFPs No. 18 and 19. See n.4.
Dated this 23rd day of August, 2018.
/s/_________
JAMES L. ROBART
United States District Judge