Enduring Tedium: The Future of Fights Over Electronically Stored Information

Photo by Markus Spiske/temporausch.com from Pexels

By Sean F. Herrmann

“Seeking justice often involves enduring tedium.” It’s fitting that North Carolina’s first substantive legal decision on eDiscovery begins with this pithy observation. Employment litigators often lament the virtual hellscape of discovering electronically stored information (“ESI”). But the era when paper was king is long dead, and the fight is now firmly in the cyber world of custodians, native formats, and keyword searches.

For those in federal court, at least rules and precedent exist to help guide them through the dark ESI forest (especially those that find themselves before Chief Judge Frank Whitney in the Western District of North Carolina). North Carolina state court practitioners haven’t been so lucky. That is until this week. On Aug. 6, 2019, the North Carolina Court of Appeals issued its first substantive decision on ESI in Crosmun v. Trustees of Fayetteville Technical Cmty. Coll. (No. COA18-1054). Judge Lucy Inman, who authored the opinion, put it well: “This appeal presents this Court with our first opportunity to address the contours of eDiscovery within the context of North Carolina common and statutory law regarding the attorney-client privilege and work-product doctrine.” The Court ultimately reversed the trial court’s order granting Plaintiffs’ forensic expert direct access to Defendants’ ESI, but the way the Court got there and its recommendations on remand are far more important than the holding itself.

Background: The Discovery Fight That Brought Us N.C.’s First Real ESI Case

Discovery in this case started in an all-too-common way. Plaintiffs served Defendants several rounds of interrogatories and requests for production of documents and were left unsatisfied with Defendants’ responses. Defendants objected to various requests on the basis of attorney-client, work-product, and state and federal statutory privileges. A war of letters ensued and Plaintiffs alleged that Defendants had destroyed responsive ESI.

Then the story gets more exciting (relatively exciting—we’re still talking about discovery, folks). In February 2018, Plaintiffs filed a motion to compel and asked the trial court to enter an order “that the parties identify a computer forensics entity or individual who, at Defendants’ cost, will search the computer servers at FTCC to determine if Defendants have deleted emails and files pertaining to these discovery requests.”

On February 26, 2018, at the hearing on Plaintiffs’ motion, the trial court ordered a forensic examination of FTCC’s servers and asked the parties to submit a proposed order. Unsurprisingly, the parties disagreed about the text of the proposed order. Defendants viewed Plaintiffs’ first draft as too broad because it permitted Plaintiffs to search FTCC’s “computer files” for “deleted material.” Plaintiffs did not waiver, which prompted Defendants to draft a counterproposal. At this point, Plaintiffs made some slight revisions and recommended that Defendants cobble together a consent protective order. The parties weren’t able to agree on an order for the motion to compel, but Defendants agreed to draft the protective order. This also led to a back-and-forth. Plaintiffs eventually submitted the parties’ dueling proposed orders to the court, and it entered Plaintiffs’ version. The order called for a forensic examination of FTCC’s computer files by a forensic examiner, with Plaintiffs bearing the initial costs of the review. The order directed the parties to work with the examiner to agree on keywords and other search parameters for the review, which was to reach back to ESI from July 2014 to the present.

On May 21, 2018, Plaintiffs submitted a proposed forensic examination protocol to Defendants, and, on May 24, 2018, Plaintiffs also gave Defendants a proposed stipulated protective order. Having not heard from Defendants by June 4, 2018, Plaintiffs filed a combined motion to compel and motion for sanctions, asking the trial court to adopt their proposed protocol, enter the proposed protective order, shift discovery costs to Defendants, and award Plaintiffs attorneys’ fees incurred obtaining the discovery. On June 11, 2018, the parties argued Plaintiffs’ combined motions. At that hearing, the parties gave the trial court a stipulated protective order. Soon thereafter, the court entered Plaintiffs’ discovery protocol and allowed Plaintiffs’ expert, Clark Walton, to conduct a three-week forensic examination.

This protocol would soon move to the center of the Court’s decision, so it merits some unpacking. In short, it gave Mr. Walton deep and direct access to Defendants’ ESI:

  1. Mr. Walton would physically access, either at his offices or at FTCC, all FTCC devices on which responsive material might be found or from which responsive material may have been deleted;
  2. From those devices, Mr. Walton would create searchable mirror images and keep those images in his custody (the “Search Images”);
  3. Mr. Walton would run search terms “and other search parameters” desired by Plaintiffs through the Search Images to identify responsive data (the “Keyword Search Hits”);
  4. Mr. Walton would then remove non-user and other non-responsive system files from the Keyword Search Hits consistent with standard computer forensics practice;
  5. Using six search terms identified by Plaintiffs in their proposed protocol, Mr. Walton would then screen out any potentially privileged documents from the Keyword Search Hits (the “Privilege Search Hits”);
  6. Mr. Walton would immediately deliver those documents not flagged in the Privilege Search Hits to Plaintiffs for their review, while Defendants would review the Privilege Search Hits and create a privilege log for all items in the Privilege Search Hits that they believed to be privileged;
  7. Finally, Defendants would provide Plaintiffs with the privilege log and any documents from the Privilege Search Hits that Defendants determined were not actually subject to a privilege.

Keep in mind, Mr. Walton was not a court appointed special master or expert. He was acting as Plaintiffs’ expert and agent.

The Decision: Involuntary Privilege Waiver in the ESI Context Is Improper

The Court held that the trial court abused its discretion by compelling discovery through Plaintiffs’ protocol because it gave Mr. Walton—Plaintiffs’ agent—direct access to potentially privileged information without allowing Defendants an opportunity to avoid waiving those privileges.

To get there, Judge Inman began by explaining just how sparse North Carolina authority is on eDiscovery—there’s little beyond: “discovery of [ESI] stands on equal footing with discovery of paper documents.” N.C. R. Civ. P. 34, Comment to the 2011 Amendment (2017). In fact, the Court explained that no statute, procedural rule, or North Carolina appeals court decision has ever defined eDiscovery’s parameters as they relate to the protection of potentially privileged information and documents. With nothing in the State to turn to, “decisions by courts in other jurisdictions as well as the universally persuasive authority, common sense.”

Drawing on these sources, the Court found that ordering a forensic examination of a “recalcitrant” responding party’s computers is an often-used approach to resolving ESI disputes. However, courts ordering such examinations must be mindful potential intrusiveness, especially with respect to privileges. Yet, the Court emphasized that these examinations “may be warranted when there exists some factual basis to conclude that the responding party has not met its duties in the production of discoverable information.”

The Court turned to the attorney-client and work-product privileges and laid out, how they can be waived. Specifically, the attorney-client privilege is the client’s alone to waive and it is not the privilege of the court or a third party. Information protected by the work-product doctrine can only be discoverable if the discovering party shows “substantial need of the materials” and “is unable without undue hardship to obtain the substantial equivalent of the materials by other means.”

The Court held that Plaintiffs’ protocol amounted to an involuntary waiver of these privileges. First, it gave Plaintiffs’ expert direct access to Defendants’ ESI with no regard for Defendants’ privileges. Second, the protocol also directed responsive documents to be delivered directly to Plaintiffs without affording Defendants a chance to first review the documents. Because North Carolina generally prohibits courts from compelling a party to waive or violate its privilege, these two provisions made the trial court’s order improper.

On remand, the Court gave the trial court two recommendations on how to proceed. First, it suggested that it appoint a special master or court-appointed independent expert to conduct the forensic examination as an officer of the court. Second, it stated, “the trial court may wish to provide Defendants with some opportunity, however expedited given the position of the case, to review the Keyword Search Hits prior to production to Plaintiffs.” The Court further suggested that the trial court order that “any documents produced under the protocol adopted are confidential within the meaning of the Protective Order and that any disclosure of privileged information under the protocol is subject to clawback without waiver of any privilege or work-product immunity.”

Takeaways: A Fine Starting Point

Crosmun will be a game changer for how North Carolina employment attorneys go about eDiscovery in state court. It’s helpful to note what the Court did not do. It did not hold that court-ordered forensic examinations of recalcitrant parties’ ESI are improper. In fact, it suggested it as an acceptable practice. That’s not to say that compelling parties should have carte blanche. Even where a party’s bad behavior in discovery necessitates a forensic examination, courts must ensure that they do not inadvertently force unwilling waivers of attorney-client or work-product privileges.

The Court further made clear that a well-crafted protective order can go a long way in alleviating the concerns at issue in this decision. Federal Rule of Evidence 502(d) allows “[a] federal court [to] order that the privilege or protection is not waived by disclosure connected with the litigation pending before the court—in which event the disclosure is also not a waiver in any other federal or state proceeding.” This Rule is helpful when federal courts order forensic examinations, but North Carolina has nothing like this. Yet, Litigants can achieve the same goal by agreeing on protective orders. In this case, the trial court entered a protective order, but the Court found it to be insufficient because it applied to a narrow set of documents and its claw-back provision was insufficient. If the goal is to obtain the requested ESI, be pragmatic, flexible, and sensitive to the opponent’s privilege concerns when tailoring the protective order.

Finally, Crosmun’s biggest legacy will likely be the flood of ESI and eDiscovery citations sprinkled throughout Judge Inman’s opinion. Like the exotic fruits and vegetables Customs and Border Protection prohibits bringing home from abroad, these nuggets of foreign authority will flourish in our virgin judicial soil and find their way into briefs throughout the State for years to come. Below is a sampling of Court of Appeals-approved foreign citations and publications that lawyers on both sides of these fights can be expected to import for the foreseeable future:

The Sedona Principles, Third Edition: Best Practices, Recommendations & Principles for Addressing Electronic Document Production, 19 Sedona Conf. J. 1, 56 (2018)

Wynmoor Community Council, Inc. v. QBE Ins. Co., 280 F.R.D. 681, 687 (S.D. Fla. 2012) (citing Bennett v. Martin, 186 Ohio App.3d 412, 425, 928 N.E.2d 763 (10th District 2009)); see also In re Ford Motor Co., 345 F.3d 1315, 1317 (11th Cir. 2003) (vacating the district court’s order to provide the requesting party unlimited, direct access to the responding party’s databases without any protocol for the search, including no search terms, and finding that direct access is not permissible without a factual finding of non-compliance with discovery rules).

Exec. Air Taxi Corp. v. City of Bismarck, 518 F.3d 562, 569 (8th Cir. 2008) (holding that the district court did not abuse its discretion in declining to order a forensic analysis of a computer because the responding party had provided all relevant documents in hard copy and forensic discovery could disclose privileged documents)

Bank of Mongolia v. M & P Global Fin. Servs., Inc., 258 F.R.D. 514, 520-21 (S.D. Fla. 2009) (adopting a protocol that contained provisions designed to protect the producing parties’ privileges, including an express holding that production to a court-appointed third-party expert would not constitute waiver and allowing the producing parties to conduct a prior privilege review of all documents to be produced)

Adair v. EQT Prod. Co., Nos. 1:10CV00037, 1:10CV00041, 2012 WL 2526982, *4 (W.D. Va. June 29, 2012) (ordering an eDiscovery protocol that did not include an opportunity for prior privilege review of produced documents solely because other protective and clawback orders entered in the case “protect any inadvertently produced privileged documents from waiver and any nonrelevant documents from use or disclosure outside this litigation”)

Fed. R. Evid. 502(d).

Playboy Enterprises, Inc. v. Welles, 60 F. Supp. 2d 1050, 1054 (S.D. Cal. 1999) (holding that because the forensic examination would be performed by an independent third party and the producing party would have the opportunity to review for privilege prior to any production, their “privacy and attorney-client communications will be sufficiently protected”).

Genworth Financial Wealth Mgmt., Inc. v. McMullan, 267 F.R.D. 443, 449 (D. Conn. 2010) (ordering a forensic examination by a neutral, court-appointed expert and allowing the producing party an opportunity to review for privilege prior to production).