Reaching into the Cloud for Discoverable ESI

• Author: Brian A. Zemil
• Pages: 20-20

20 | SECTION OF LITIGATIO N

CIVIL PROCEDURE UPDATE

Published in Litigation News Volume 45, Number 3, Spring 20 20. © 2020 by the Ameri can Bar Association. Re produced with per mission. All rights re served. This info rmation or any porti on thereof may not be c opied or disseminated in any

form or by any means or sto red in an electronic da tabase or retrieval sy stem without the ex press writt en consent of the Amer ican Bar Associatio n.

My last article disc ussed whether a party control s

a third party’s electronically stored information

(ESI) and the p otential consequences of its loss.

A related issue concern s control of a litigant’s ESI

possessed by ema il service providers (e.g., Google

and Microsoft) and so cial media companies (e.g., Twitter and

Facebook) (referred to individual ly as “internet service provider”

and collectively as “providers”). Such providers store E SI on the

cloud, which typic ally exists in more than one physica l location.

Obtaining a l itigant’s ESI from a provider requires an ass essment

of the legal duties impo sed by discovery requests and the ef fect

of the provider’s control on those duties.

Federal statutes su ch as the Stored Communications Ac t

(SCA) and the Elec tronic Communications Privac y Act dic-

tate whether a provider ca n release an account holder’s ESI to

another. The SCA govern s two types of online serv ices: (1) elec-

tronic commun ication services (ECS) (i.e., “any serv ice which

provides to users thereof t he ability to send or receive wire or

electronic com munications”) and (2) remote computing services

(RCS) (i.e., “the provision to the public of computer stora ge or

processing ser vices by means of an electronic c ommunications

system”). 18 U.S.C. §§ 2510(15), 2711(2).

Civil subpoenas c annot require ECS or RCS providers to

produce the “content” of a litigant’s private ES I (non-content

information is avail able under the SCA—such as the nu mber

of times viewed or acc essed—that may be mean ingful to your

case). Rather, that ESI c an only be legally obtained (1) by using

the Federal Rules to comp el a party (Rule 34) or a third par ty

(Rule 45) to produce ESI that it cont rols or (2) with consent from

the sender, recipient, addre ssee, or subscriber who has the lega l

capacity to consent.

Courts wi ll typically quash subpoenas t hat purportedly

require providers to produce E SI without the consent of the user.

A social media prov ider’s terms of service may signal whether a n

account user controls it s social media content. Where the t erms

do not address control, the u ser generally has the legal right to

obtain its socia l media information from the provider.

Courts have compel led parties or third part ies to consent to

disclose ESI a nd other documents in another’s poss ession:

Thomas v. Deloi tte Consulting LP, No. 3-02-c v-

0343, 2004 U.S. Dist. LEX IS 29154 (N.D. Tex. June

14, 2 004) . The court held that it can order d isclosure

of information from who ever controls the com-

munication, even i f that person is not a party in the

proceeding. T he court ruled that two subpoe naed

third part ies controlled bank statements and c hecks

held by their banks (also t hird parties), ordered the

subpoenaed part ies to exercise their legal rights to

obtain the reques ted documents, and, altern atively,

ordered the subpoenaed pa rties to execute autho-

rizations so th at the requested documents could be

obtained dire ctly from the banks.

Flagg v. City of Det roit, No. 05-74253, 2008 U.S.

Dist. LEXI S 21923 (E.D. Mich. Mar. 20, 20 08).

The court held th at it has the authority to order

a person to produce docu ments, and it can order

that person to give conse nt so someone else can

disclose docu ments and communications on thei r

behalf. The cou rt ordered the defendant to produce

text messages s tored with its third-part y provider

because the mes sages were within the defendant’s

control. Rejecti ng the defendant’s argument that it

could withhold its cons ent, the court reasoned that

the defendant’s Rule 34 oblig ation overcame its

disinclinat ion to exercise control over the text mes-

sages. The cour t noted that because the court was

uncertai n that it had the authority to compel the

defendants to consent to d isclosure by the provider,

it instead ordered the pla intiff to “reformulate his

third-par ty subpoena as a Rule 34 request for pro-

duction direc ted at the Defendant.”

Negro v. Superi or Court of Santa Clara Count y,

230 Cal. App. 4th 879 (2014). The state appellate

court held that the S CA does not allow a provider

to refuse to produce a litig ant’s ESI in response to

a subpoena, so long as a cour t order compels that

litigant to consent to di sclosure and the litigant has

complied with that order.

United States v. M artin, No. CR-14-00678, 2015

U.S. Dist. LEX IS 94754 (D. Ariz. July 21, 2015). The

court ruled i n a criminal case that so cial media com-

panies control mes sages on their websites regard-

less of their locat ion on the cloud. But some courts

have quashed subpoenas to providers s eeking the

release of electronic commun ications. See, e.g., In re

Subpoen a Duces Tecum to AOL, LLC , 550 F. Supp.

2d 606 (E.D. Va. 200 8).

When seekin g documents protected by the SCA , parties

need to identify who c an consent to their disclosure. Even

those who do not possess t hose documents might have suf-

cient control to consent to the ir disclosure. If a third par ty

does not have that control, pa rties must look for others who

have both the ability to co nsent and even indirect control over

those document s. Once identied, such individua ls can be

compelled to consent to di sclosure.

Reaching into the Cloud for

Discoverable ESI

By Brian A. Zemil , Litigation News A ssociate Editor