June 2017 Ediscovery Case Summaries
Should We Split It? Court Denies Defendant’s Motion to Be Relieved from Discovery Costs
Hold Onto the Phone: Turning in Phone for Rebate has Preservation Consequences
Court Grants Terminating Spoliation Sanctions Due to Abusive Litigation Practices
Court Orders Parties to Meet and Confer to Determine Scope of Discovery Request
Texas Supreme Court Weighs in on Native File Format Production
50 States: Civil Procedure Rules in State Court – Part 2
Cue the fanfare…The new and improved rules map is here!
This spring, we worked to update our state ediscovery rules map – looking at each state’s civil procedure rules and how they approach ediscovery. Want to know which states have already adopted the 2015 Federal Rules of Civil Procedure (FRCP) amendments? Which states are still following the 2006 FRCP language relating to ediscovery? What states don’t have any ediscovery provisions whatsoever?
We looked at each of the 50 states (plus the District of Columbia), classifying them into five color-coded areas:
- A pink state has substantially adopted the 2015 FRCP Amendments. There are three pink states: Arizona, Colorado and Wyoming.
- A yellow state is actively taking on or considering new rules: either a version of the FRCP or its own. There are four yellow states: Florida, Kansas, Mississippi and Oklahoma.
- A blue state has adopted and continues to follow the 2006 FRCP Amendments. There are 27 blue states, which includes every state not listed in another category.
- A green state marches to the beat of its own drum, using unique language and standards. There are 14 green states: Connecticut, Delaware, Georgia, Illinois, Missouri, Nebraska, Nevada, New Hampshire, New York, Pennsylvania, Rhode Island, Texas, Utah and Washington.
- A grey state signifies that the state has no ediscovery rules in place at this time. There are three grey states: Kentucky, South Dakota and West Virginia.
With so many jurisdictions, we want you to know the restrictions. From Hawaii to Virginia and Florida to Oregon, click each state to view its pertinent statutes and rules, along with suggestions for further reading about that state’s ediscovery protocols.
Ediscovery Rules & Statutes (Not Just a Pretty Map)
As we shared with you in our first blog on the 50 states of ediscovery, it has been a while since our map was updated. Some states made drastic changes, while others were happy with their own status quo. What happened in your state? Here is just a sample of what you will find.
Colorado Climbs Onboard
The Rocky Mountain State changed from grey to pink in 2015 when it adopted the then-upcoming FRCP amendments of the same year. A couple small differences remain: Colorado’s version reads Rule 26 in conjunction with Rule 1 to “secure the just, speedy, and inexpensive determination of every action.” Also, its Rule 37 does not mirror the FRCP.
Connecticut Calls its Own Shots
Some states adopted the 2015 FRCP, some did not and still others came up with their own version. Connecticut did all three, which earned it a swap from blue to green on our map. While Connecticut adopted the 2015 FRCP’s proportionality language, its sanctions wording is similar to that of the FRCP’s 2006 version. Interestingly, the state also includes an ethical requirement of “technological competence” as part of an attorney’s obligation to keep up with changes in the practice of law.
Illinois Gets Ahead of the Game
Illinois’ motto is “State Sovereignty, National Unity” and that sentiment is certainly reflected in its state Rules of Civil Procedure. Its many unique ediscovery provisions means it changed from yellow to green on our map. Illinois shares the FRCP’s emphasis on proportionality, with the state’s committee commenting that this amendment was added primarily to address the discovery of ESI. Illinois’ rules go even further by creating a list of ESI that should not be discoverable due to difficulty, but keeps its eye on the horizon by emphasizing flexibility as technology continues to advance.
Oklahoma: Amendments on the Horizon
Oklahoma adopted the 2006 FRCP in 2010. In early 2017, the state legislature proposed amendments to adopt the 2015 FRCP’s proportionality language and those amendments are still pending. Statute §12-3225 drops “liberally construed” and adds “construed, administered, and employed by courts and parties to secure” the just, speedy and inexpensive determination of action to mimic FRCP Rule 1. Its §12-3226 proposal mirrors the 2015 FRCP Rule 26(b) with one exception: it retains the phrase “reasonably calculated” just before the “relevant and proportional” wording. These proposed changes are enough to bump Oklahoma’s color from blue to yellow.
While the 50 states have rules almost as diverse as the states themselves, it is clear that the FRCP has had a role in shaping state civil procedure models. Over the next year, it is likely that more states will amend their rules to reflect the new FRCP, while others will continue to utilize their own unique standards.
If you practice in state court anywhere across the country, you need to know the discovery requirements, because they may be similar to the new FRCP or vastly different. Keep yourself in-the-know and check out each of the 50 states plus the District of Columbia today on KrolLDiscovery’s Rules and Statutes Map.
Japan and China: New Data Protection and Transfer Laws Imminent in Asia Pacific
Kate Chan, APAC ediscovery
Kate Chan, KrolLDiscovery, Legaltech News
Editor’s note: this article originally appeared in Legaltech News.
The global ediscovery community is abuzz about data protection. 2018 will usher in new data protection and transfer laws in the European Union (EU), but many ediscovery professionals are less informed about similar changes in Asia that have recently taken effect.
Japan: Land of the Rising Sun
Japan’s Act on the Protection of Personal Information (APPI) stands as one of Asia’s oldest data protection laws and has remained unchanged since it went into effect in the early 2000s. The decision to enact Japanese amendments to the APPI was most likely influenced by three factors: a significant increase in the volume of data being created, a rise in data breaches and illegal sale of private information and a pressure to update policies in light of the EU’s work on the General Data Protection Regulation (GDPR).
A word of warning: The APPI amendments went into full effect on May 30, 2017 and Japanese authorities expect companies to make immediate changes. Below are some key provisions of the APPI amendments in Japan.
1. Creation of the Personal Information Protection Commission: The amended APPI went into partial effect in 2016, creating the Personal Information Protection Commission (PPC) as a central, independent regulatory authority with enforcement powers.
2. Two new classifications: Two information classifications will determine whether data can be transferred and if the owner of that information can give consent to its transfer: sensitive information and anonymized information. Sensitive information (information about a person’s race, creed, social status, medical records, criminal history, etc.) receives enhanced regulatory protection, with the person’s content required before such data can be transmitted. Anonymized information (personal information where there is no possibility of identifying the person) can be transmitted with restrictions but without the express consent of the individual.
3. “Opt-in” is now “opt-out”: The current rules require the user’s permission before personal data can be transferred. Under the amendments, companies can share data without permission if they disclose certain information to the user beforehand, such as the nature and purpose of the personal data being provided, and the way the data is being provided. The company transferring the information must also give the user the option to opt out of the transfer before it occurs. Businesses must disclose to the PPC if they will continue to default to an “opt-out” policy, or change the process transferring information to a third party. The PPC will make these changes known to the public.
4. International data transfer policy: For the first time, the APPI will address international information sharing. Any company transferring personal records outside Japan’s borders will need the user’s permission and opting out will not be an option unless the foreign jurisdiction has similar privacy standards.
5. Sanctions for noncompliance: The PPC is enacting a two-tiered criminal penalty measure into the APPI and its guidelines. A negligent violation will bring about an enforcement notice ordering the company to either correct the issue or halt data transfer operations. Failure to comply may result in imprisonment up to six months or a fine up to JPY 300,000. Intentionally stealing or providing personal information for a dishonest purpose may result in a direct penalty of up to one year in prison or a fine up to JPY 500,000.
China: The Red Dragon
In early June 2017, the People’s Republic of China is implemented its controversial Cybersecurity Law. The government is becoming more involved with data protection and strengthening enforcement. Up until now, its current rules have not been clearly defined or regularly enforced, so it is important to keep up with developments or risk getting caught off guard.
Unlike Japan’s focus on protecting data, China turns its attention to the network operators managing data. Below are some key facets to its new policy.
1. Data stored in mainland China: The new law insists that Chinese citizens’ “personal information” and “important data” be stored on servers within its borders. Any companies claiming an exception that is “truly necessary” must undergo a security assessment before information can be released. This will affect the majority of foreign companies that operate in China; in particular, those that use their global infrastructure and IT resources to operate their business in China, as the original data collected, including business data and customer data, within China will typically be stored directly in the data centers or servers physically located overseas. For example, many global companies are still using email servers located outside China for their China operations.
2. Law applies to network product and service providers: The majority of the new law’s provisions apply to “Critical Information Infrastructure Operators” (CIIO) possessing data critical to China’s security. Industries predominantly targeted in this new definition include financial, transportation, health care, utilities and telecommunications.
3. Stronger data protection provisions: Supplementing existing data privacy guidelines in China, network operators must first obtain their clients’ consent before collecting and disclosing personal information, including the reason for the disclosure, and take measures to ensure the security of personal information. Companies need to ensure that an appropriate framework is established for collecting and using data, demonstrating that any data collected has a proper purpose and that its use can be explained in detail. Companies should also ensure appropriate security and protection measures are in place to safeguard the data as well as incident response procedures for responding and reporting any breach.
4. Security examinations: All network providers must pass a “network security examination.” This includes specific requirements that network operators must follow when purchasing new network systems.
5. Severe consequences for noncompliance: While specific penalties are unknown at this time, cancellation of a business license is part of the current regulations. Additionally, the new regulations require CIIO’s to establish violation reporting mechanisms, suggesting that China is taking the new law very seriously.
In instances where there are concerns with removing data from China, or the company premises themselves, a mobile solution may be the answer. Over the past couple of years, mobile technology has become incredibly powerful, facilitating processing, filtering and analysis onsite. Onsite mobile solutions can also be used in tandem with traditional processing by acting as a cost-effective method of segregating and filtering out personal information, sensitive company data or privileged documents early on and prevent unwanted disclosure. When conducting ediscovery or internal investigations in China, companies must review and clear any state secrecy or data privacy concerns, and redact sensitive information prior to sharing it out of the country. This, in turn, reduces the risks and costs associated with over-collection by culling irrelevant data and focusing on what is relevant or responsive.
As legal and technology professionals in law firms and corporations prepare for the data protection implications of the EU GDPR, do not disregard important changes afoot in Asia. Most importantly, seek guidance from local, in-country experts, prepared to help you collect, host and transport data in investigations, litigation or regulatory matters around the world.
Modern Ediscovery: Making Sweet Music in the Virtual Age
Who wants a flip phone when you can have the latest smartphone in your pocket? No one wants to be seen as behind-the-times in this technology-driven age. When it comes to ediscovery, we want to be modern, too. In fact, we must be modern; outdated methods will simply get you (and your client) in trouble.
Recently, I had the pleasure of presenting a webinar, Ediscovery Program Management: From Vinyl to Virtual, with two ediscovery gurus – one a former colleague and one a current colleague. Along with Josh Zylbershlag, ediscovery litigation services director at Paul, Weiss, Rifkind, Wharton & Harrison LLP and Tom Barce, director of consulting services at KrolLDiscovery, we explored the history of the music industry, comparing it to our own “vinyl to virtual” shift in the ediscovery industry. Are you still conducting ediscovery the same way you would buy music off the racks in the record store? Or, have you adapted to digital download or a streaming subscription?
- Information Governance: Are you still managing huge file servers with no idea what’s on them, or are you an organization that creates, uses and governs information with an eye toward accessibility?
- Legal Hold: Has your corporation adopted legal hold policies and guidelines? Have you taken it virtual by subscribing to technology solutions with effective legal hold management?
- Collection: What about your collection processes? Are you sending droves of people to collect data every time there is a new case or are you leveraging modern remote collection technology and centralized discovery databases?
- Search and Analysis: Is it time to update your review practices? Are you still in the dinosaur age, not using electronic workflow and batching, dynamic data profiling, innovative search analytics, predictive coding and sampling?
Our goal in this webinar: to make sweet music at each stage of the EDRM by discussing modern ediscovery practices. Want more to learn more? Watch the webinar today!
The Sedona Conference Commentary on Proportionality
As discussed in a blog back in January, 2017 is the year of proportionality.
The Sedona Conference Working Group on Electronic Document Retention & Production (WG1) recently released a new version of its publication, The Sedona Conference® Commentary on Proportionality in Electronic Discovery. This is the working group’s third iteration of this publication and is intended to address the 2015 amendments to the Federal Rules of Civil Procedure (FRCP).
This latest version focuses on the amendments to FRCP Rules 26 and 37, emphasizing the importance of proportionality in discovery. The authors note the balance of burden against benefit, stress that reasonableness depends heavily upon the facts within each case and underscore the importance of proactive communication between the parties throughout the litigation process. Additionally, the prominence of proportionality means that the amount in controversy is now only one of many factors that courts use to define the scope of discovery.
Specifically, the Sedona publication examines six proportionality principles:
- The burdens and costs of preserving relevant electronically stored information should be weighed against the potential value and uniqueness of the information when determining the appropriate scope of preservation.
- Discovery should focus on the needs of the case and generally be obtained from the most convenient, least burdensome and least expensive sources.
- Undue burden, expense or delay resulting from a party’s action or inaction should be weighed against that party.
- The application of proportionality should be based on information rather than speculation.
- Nonmonetary factors should be considered in the proportionality analysis.
- Technologies to reduce cost and burden should be considered in the proportionality analysis.
This updated document is another valuable resource for litigation teams dealing with the implications of the 2015 FRCP amendments. Commendations to the drafting team, and all those involved in the Sedona Conference!
Spring Digest: Everything You Need to Know (so far!) in 2017
Ediscovery has been busy this year. We’re only five months in and we’ve already seen developments in predictive coding, proportionality standards and ediscovery practices around the world.
Before you head off on your summer vacation, take a minute to refresh yourself on some of the hottest topics in ediscovery so far this year.
Proportionality is Key
One of the most significant amendments to the Federal Rules of Civil Procedure back in 2015 was a new requirement for discovery to be “proportional to the needs of the case.” Today, counsel must ensure that their discovery requests are specific and add value to their case in relation to the accompanying expense.
Australia Gets in the Predictive Coding Game
First the United States, then Ireland and England, and now Australia. Predictive coding (also known as TAR) continues to spread around the world as courts encourage parties to consider technology to discover and inspect documents.
Using Cellebrite in Mobile Phone Investigations
You need not be a computer wizard to appreciate the volumes of relevant data housed on the mobile device in your hand. The standards and technology for extracting mobile device data are still progressing, variable and slightly confusing. KrolLDiscovery’s Jason Bergerson answers common questions around specific technology and processes in mobile phone investigations.
Ediscovery Around the World
Throughout this year, KrolLDiscovery will be diving deep into ediscovery practices around the world. We hope you’ll join us as we explore data collection, privacy, proportionality and production practices in the Americas, EMEA and APAC. So far, we’ve stopped in Australia, Ireland, Canada, the U.K. and Germany to discuss some ediscovery trends in each locale.
Be sure to sign up for updates from The Ediscovery Blog to stay on top of everything ediscovery.
May 2017 Ediscovery Case Summaries
The Court Denies the Plaintiff’s Patently Overbroad Discovery Requests
Rockwell Med., Inc. v. Richmond Bros., 2017 U.S. Dist. LEXIS 57313 (E.D. Mich. Apr. 14, 2017)
Court “Rather Reluctantly” Intervenes in Discovery Dispute, Prefers the Use of TAR Before Culling by Search Terms
FCA US LLC v. Cummins, Inc., 2017 U.S. Dist. LEXIS 45212 (E.D. Mich. Mar. 28, 2017)
Sanctions Decision Generates “Considerable Heat” and Split of Authority; Supreme Court Ultimately Reverses $2.7 Million Award
Goodyear Tire & Rubber Co. v. Haeger, 137 S. Ct. 1178 (Apr. 18, 2017)
Dialing the Wrong Number Has Its Consequences: Court Grants Motion to Compel Against Debt Collector
Meredith v. United Collection Bureau, Inc., 2017 U.S. Dist. LEXIS 56783 (N.D. Ohio Apr. 13, 2017)
Hold the Phone: No Sanctions for Destroyed ESI When Content Is Unknown and Other Routes to Discover ESI Are Available
Zamora v. Stellar Mgmt. Grp., 2017 U.S. Dist. LEXIS 55361 (W.D. Mo. Apr. 11, 2017)
WannaCry Ransomware Hits Computers – What Now?
What many security experts have long warned became a reality last Friday: over 220,000 computers were infected by a new strain of ransomware. The infection affected several British hospitals, French car maker Renault and the German state-owned railroad operator Deutsche Bahn. Although a kill switch has stopped the spread of this version of ransomware, the fix is only temporary. The WannaCry ransomware virus, once activated, encrypts files, drives and entire networks. After the computer is infected, a message is displayed on the screen telling the user that the computer and its data are locked and can only be unlocked by paying a ransom in the form of the crypto currency Bitcoin.
The virus was able to spread so quickly because the blackmailers used a zero-day gap in the Windows operating system. This is a security vulnerability in all OS versions since Windows XP for which Microsoft released an important security bulletin and important patches in March with security update MS17-010, which can be found here: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx.
Due to the ransomware attack, Microsoft released new patches to fix the security gap, which can be found here: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/.
All users, whether companies or individuals, are advised to install the appropriate patch for their respective Windows system as soon as possible.
If infected by ransomware…
Even with the best precautions and policies in place, it is possible to fall victim to a ransomware attack. In the event that your data is held hostage by ransomware, here is some advice to keep in mind:
- Remain calm. Rash decisions could cause further data loss. If you discover a ransomware infection and suddenly cut power to a server, versus powering it down properly, you could lose additional data.
- Check your most recent set of backups. If they are in-tact and up-to-date, the data recovery becomes easier to restore to a different system.
- Never pay the ransom; attackers may not unlock your data. There are many cases of ransomware victims paying a ransom and not receiving their data in return. Rather than running this risk, companies should work with data recovery experts who may be able to regain access to the data by reverse engineering the malware.
- Contact a specialist for advice and to explore recovery options. Experts can examine your scenario to see if they have a solution already in place or if they may be able to develop one in time.
To date, engineers at KrolLDiscovery have identified over 225 variations of ransomware that infect user devices, with more variations created every day. The team of engineers at KrolLDiscovery work around the clock to identify and find a solution for each type of ransomware.
50 States: Civil Procedure Rules in State Court – Part 1
The 2015 FRCP Amendments have been in effect for over a year and federal courts have been increasingly vocal in the areas of proportionality, spoliation and sanctions. Have states followed suit?
The last time KrolLDiscovery rolled out a comprehensive look at state ediscovery rules was after the 2006 FRCP Amendments. Back then, we saw that some states had been quick to address ediscovery, with many states adding their own unique flavor. Fast forward to the 2015 FRCP Amendments: Are states adopting the new language in their civil procedure rules or are they taking their own approaches?
At KrolLDiscovery, we have been looking at each states’ civil procedure rules, and we are excited to bring you the first of our updates. Here is the latest on what three states have been doing since the 2015 FRCP Amendments were enacted.
Texas, An Ediscovery Pioneer
The Lone Star State was one of the first jurisdictions to enact ediscovery rules and it lives up to its name by writing its own rules. Currently, its focus is on the spoliation of evidence, as the current rules are not clearly defined. In April 2016, the Texas Supreme Court requested review of a proposal that would solve this problem. No decisions have been made yet, but it has joined federal courts in making this a central discovery issue in 2017.
Examine current information on state ediscovery rules in Texas.
Massachusetts Takes One Step Forward with Rule 1
In Massachusetts, lawmakers initially proposed adopting the 2015 FRCP Amendments and the issue was intensely debated. Ultimately, the state decided to stick with the 2006 language, but made an exception for Rule 1, placing equal responsibility on the parties and the courts to “ensure the just, speedy, and inexpensive determine of every action,” promoting cooperation among litigants.
Look at developments in state ediscovery rules in Massachusetts.
New York Does Its Own Thing
New York has adopted its own ediscovery framework by adding subtle ESI accommodations to its existing rule language. For example, it adds an entire section addressing ediscovery from non-parties and requires counsel for parties who anticipate ediscovery to be “sufficiently versed in . . . their clients’ technological systems to discuss [ediscovery issues] competently” at pretrial conferences.
Learn more about state ediscovery rules in New York.
Over the next month, we will work to update each of the 50 states on our Rules and Statutes Map. If you are tracking ediscovery provisions in state courts, stay tuned throughout the next month for further updates!
Germany: The Hub of European Ediscovery Technik
Guten Tag!
From information about predictive coding in Australia and Ireland to cooperation in Canada and data protection in the UK, KrolLDiscovery is your international ediscovery resource.
The next stop on our ediscovery world tour is Germany. As a leader in technology exports and the world’s fourth-largest economy, legal technology, privacy, security and data protection practices are a well-known and vital part of Germany’s business culture.
LITIGATION AND ENFORCEMENT IN GERMANY
Germany’s central location in the European Union and expertise in technology make it an attractive location for international business. As such, it is no surprise that international disputes and exacting governmental regulation are also a regular part of German business activities. Specifically, when it comes to litigation, German law firms are commonly managing cross-border disputes, often involving jurisdictions such as the United Kingdom and the United States where ediscovery is required in civil cases. Further, Germany’s position as a prominent global economic force means that many companies’ planned mergers will be large enough to attract the attention of the European Commission and be subject to a merger control investigation. Lastly, Germany’s own independent competition authority, the Bundeskartellamt, is one of the most active in Europe and has a reputation for its meticulous and demanding approach to investigations. For German companies facing investigations, regulatory scrutiny or cross-border litigation, ediscovery technology provides a lifeline in meeting requests for volumes of business documents.
WHAT MAKES GERMAN EDISCOVERY PRACTICES UNIQUE
What is unique about these cases is the way German lawyers are using ediscovery technology. German lawyers not only use ediscovery technology to search and analyze data to discover material facts or produce large amount of data to regulators in a short period of time. They also need the technology to redact personally identifiable information in accordance with Germany’s strict data protection laws. Data protection in Germany is primarily regulated by the Bundesdatenschutzgesetz (BDSG), which implements the European Union’s Data Protection Directive (which will be replaced by the General Data Protection Regulation in May 2018). In addition, there are state data protection laws providing legal requirements for data processing carried out by state-level public authorities or public bodies.
TIPS WHEN CONDUCTING EDISCOVERY IN GERMANY
- Prioritize information governance and know where your data is before you start a case.
- Use predictive coding. Data volumes are growing all the time and predictive coding is the most efficient way to find the right information. Regulators are not sympathetic to those who miss deadlines.
- Choose quality over cost. In multi-jurisdictional cases, mistakes come at a high cost. Choosing the cheapest providers in each company can often be a false economy. It is safer to choose an established provider with a network of local offices and experts who have experience in working collaboratively across jurisdictions.
Stay to speed on global ediscovery practices. Don’t miss this whitepaper, “A Practical Guide to Cross-Border Ediscovery.”
Patrick Garbe: Is it common practice for Canadian companies to use a data transfer ag...
Mr Alistair Ewing: They need to do this in Computer Forensics not just eDiscovery. Where ...
John L. Ries: Actually, I think at this point, it would be better for the British go...
Curt Sachs: Interesting blog reading. Thanks for educating me...
Craig Lee: Excellent article, Tom. Your comment about there not being a single te...
