Twenty-first century civil discovery looks very little like it did even a few decades ago. The explosion in technology and digital storage, not to mention the rise of the internet, social media, and connected devices, has transformed American culture—and with it, our discovery system.
A recent case illustrates this phenomenon. Hinostroza v. Denny’s, Inc.1No. 17-CV-02561, 2018 WL 3212014 (D. Nev. June 29, 2018). was a case the court referred to colloquially as a “slip and fall.”2Id. at *1. The plaintiff had suffered injuries in the accident in the defendant’s restaurant and brought suit. In the past, the primary requests for discovery from the plaintiff would have included medical bills, proof of lost wages, and depositions of witnesses, including the plaintiff. Here, however, in addition to those requests, the defendant sought all text messages, emails, and other written communications between the plaintiff and certain individuals from the date of the accident to the present (no matter their subject); all text messages or emails sent by the plaintiff in the two-day period after the accident (no matter their subject or recipient); all data from any type of Fitbit or other activity tracker device the plaintiff may have used from five years prior to the accident to date; and all social media account information from five years prior to the accident to date.3Id. at *6–8. It is no wonder that some have questioned whether the state of discovery would dissuade any plaintiffs from bringing claims for their injuries,4See Gordon v. T.G.R. Logistics, Inc., 321 F.R.D. 401, 403–04 (D. Wyo. 2017) (noting intrusiveness of request for extensive social media information, and the “substantial risk that the fear of humiliation and embarrassment will dissuade injured plaintiffs from seeking recovery for legitimate damages or abandon legitimate claims”). not to mention when they implicate personal issues like sexual harassment.5See Bottomly v. Leucadia Nat’l, 163 F.R.D. 617, 619–21 (D. Utah 1995) (finding that plaintiff in a sexual harassment case did not waive privacy interests as to matters unrelated to the case, and that the court should take caution to ensure against “a second sexual harassment by the manner of discovery”).
The rise in electronic discovery led to substantial changes in the Federal Rules of Civil Procedure (“the Rules”) in 2006 and again in 2015, aimed at problems posed by the format of electronic discovery (“e-discovery”), the problems with cost and accessibility, the risks of waiving attorney-client privilege, and the overbreadth of discovery requests.6See Richard L. Marcus, Introduction to Shira A. Scheindlin & Daniel J. Capra, Electronic Discovery and Digital Evidence 4–19 (3d ed. 2015). The Rules highly encourage cooperation among counsel to discuss e-discovery issues early and resolve them without motions practice.7Fed. R. Civ. P. 16, 26(f). The Rules also encourage judges to be hands-on in controlling the discovery process and using their discretion to limit overreach.8Kenneth J. Withers, Electronically Stored Information: The December 2006 Amendments to the Federal Rules of Civil Procedure, 7 Sedona Conf. J. 1, 2 (2006). An entire e-discovery industry has arisen to handle the vast amounts of data that often must be gathered, reviewed, culled, and produced.9See, e.g., KLDiscovery,https://perma.cc/B3U8-W3UF.
Amid all these changes, little attention has been paid to privacy as opposed to time and expense.10Some recent scholarship has focused on the privacy implications of civil discovery as opposed to its breadth and expense. SeeBabette Boliek, Prioritizing Privacy in the Courts and Beyond, 103 Cornell L. Rev. 1101, 1104–07 (2018) (arguing that judges should consider privacy and cybersecurity rights of third parties when they order discovery of sensitive material); Chad DeVeaux, A Tale of Two Searches: Intrusive Civil Discovery Rules Violate the Fourth Amendment, 46 Conn. L. Rev. 1083, 1087 (2014) (“[While c]ommentators have sacrificed untold forests lamenting [modern discovery’s] economic costs . . . comparatively little ink has been spilled exploring the extensive invasion of personal privacy entailed by the reach of contemporary document production rules.”); Robert D. Keeling & Ray Mangum, The Burden of Privacy in Discovery, 20 Sedona Conf. J. 415, 423 (2019) (noting that pre-2015 amendments to the scope of civil discovery focused on economic factors instead of privacy, and advocating for privacy as an aspect of proportionality); Agnieszka McPeak, Social Data Discovery and Proportional Privacy, 65 Clev. St. L. Rev. 61, 61–62 (2016) (arguing that courts should limit discovery of social media data by taking into account the burden on privacy rights); Allyson H. Stuart, Finding Privacy in a Sea of Social Media and Other E-Discovery, 12 Nw. J. Tech. & Intell. Prop. 149, 171 (2014) (noting that the new proportionality rules could protect privacy as a burden to be considered under Rule 26(b)(1)). The Rules do not provide for explicit protection against discovery based on privacy,11Privacy protection has been found implicit in Rule 26(c) and its allowance of protective orders based on annoyance, embarrassment, oppression, or undue burden. Seattle Times Co. v. Rhinehart, 467 U.S. 20, 35 n.21 (1984) (“Although [Rule 26(c)] contains no specific reference to privacy or to other rights or interests that may be implicated, such matters are implicit in the broad purpose and language of the Rule.”). Courts have also found privacy to be a basis for limits on scope under the renewed emphasis on proportionality under Rule 26(b). See infra Section II.A.1. with the exception of redaction of personal information under Rule 5.2.12Fed. R. Civ. P. 5.2. (providing for redaction of personal information when filing electronically with the court). There has long been the idea that privacy protection exists against government searches and seizures, but that there is no such concept in civil discovery.13See Seattle Times, 467 U.S. at 30 (“The Rules do not differentiate between information that is private or intimate and that to which no privacy interests attach. Under the Rules, the only express limitations are that the information sought is not privileged, and is relevant to the subject matter of the pending action. Thus, the Rules often allow extensive intrusion into the affairs of both litigants and third parties.”). However, close analysis of cases reaching back to the adoption of the Rules shows that federal courts have in fact used privacy rationales to protect against discovery in many areas. District courts in particular have developed an interpretation of the Rules that protects litigants and non-litigants from discovery; courts have developed certain categories of protected information based on a balancing of the right to privacy against the need for the information in the context of the litigation.14Because of the final judgment rule (28 U.S.C. § 1291) and the harmless error rule (28 U.S.C. § 2111), there is little appellate review of discovery decisions in federal courts. There is the ability to seek a writ of mandamus from the court of appeals directing the lower court to vacate a production order, but it is rarely used. See United States v. Jicarilla Apache Nation, 564 U.S. 162, 168 (2011). Some early cases used the collateral order doctrine to review discovery orders, but the Supreme Court rejected such use of interlocutory appeals. Mohawk Indus., Inc. v. Carpenter, 558 U.S. 100, 114 (2009). State courts, on the other hand, have a richer body of law on discovery issues because of the availability of interlocutory appeals of such orders. See infra Section I.C.2; see also Jonathan M. Redgrave, Keltie Hays Peay & Mathea K.E. Bulander,Understanding and Contextualizing Precedents in E-Discovery: The Illusion of Stare Decisis and Best Practices to Avoid Reliance on Outdated Guidance, 20 Rich. J.L. & Tech. 1, 5 (2014) (“[B]ecause discovery disputes are a matter for trial courts, and opinions and orders on discovery matters are interlocutory in nature, few cases have been reviewed by appellate courts. Thus, issues in e-Discovery have been largely handled on a case-by-case basis, with little in the way of guiding precedent.”). This law derives from Supreme Court precedent, from public policy represented in federal and state statutes, and from discretionary judicial application of the Rules. This Article unearths this body of law from its surprising obscurity. With a firm grounding in the foundations and justifications for federal protection of privacy in discovery, and in light of recent Supreme Court doctrine, the Article describes how privacy arguments can address increasingly intrusive discovery demands.
I. Privacy in Federal Discovery
Civil discovery in federal courts largely began with the passage of the Rules in 1938. Prior to the promulgation of the Rules, “[i]nquiry into the issues and the facts before trial was narrowly confined and was often cumbersome in method.”15Hickman v. Taylor, 329 U.S. 495, 500–01 (1947). As the Supreme Court noted in Hickman v. Taylor,16329 U.S. 495 (1947). the new Rules switched focus from the pleadings to the discovery phase “as a device for ascertaining the facts, or information as to the existence or whereabouts of facts, relative to those issues” so that “civil trials in the federal courts no longer need be carried on in the dark,” clearing the way, “consistent with recognized privileges, for the parties to obtain the fullest possible knowledge of the issues and facts before trial.”17Id. at 501. But with that increase in fact-finding ability came an increase in potential for invasions of privacy. Hickman itself recognized a form of privacy protection in the work product doctrine, finding it necessary to afford attorneys a zone of privacy within which to prepare their cases.18Id. at 511–12.
Protections for privacy in discovery can be divided into two broad categories. One is protection for information or communications deemed confidential,19Courts have often used terms like “confidential,” “secret,” or “private” interchangeably in discussing discovery. See N.Y. Stock Exch., Inc. v. Sloan, No. 71CV2912, 1976 WL 169086, at *3 & n.3 (S.D.N.Y. Oct. 21, 1976) (referring to employee evaluations as “confidential,” as invasive of “employee privacy,” and as protected by a “qualified privilege”). Here, I use the term “confidential” to mean communications made under the impression that they would be kept from third parties. See Daniel J. Solove & Neil M. Richards, Rethinking Free Speech and Civil Liability, 109 Colum. L. Rev. 1650, 1669 (2009). while not rising to the level of privilege.20Privilege, as defined in the law of evidence, is specifically protected from discovery in the Rules. Fed. R. Civ. P. 26(b)(5); see also United States v. Reynolds, 345 U.S. 1, 6 (1953) (“We think it should be clear that the term ‘not privileged,’ as used in Rule 34 [now Rule 26(b)], refers to ‘privileges’ as that term is understood in the law of evidence.”). Work product protection itself falls within this category.21Unlike attorney-client privilege, work product production can be overcome by a showing of substantial need and inability to obtain the information elsewhere. Fed. R. Civ. P. 26(b)(3). In addition to Hickman, this privacy protection can be traced to common law doctrine recognizing “secrecy” in business processes and commercial information as well as legislative provisions protecting against disclosure to the public. This right to confidentiality in discovery was affirmed by Supreme Court case law and has evolved to protect many aspects of information privacy.
The second category giving rise to privacy protection for discovery is based on Supreme Court interpretation of the constitutional right to privacy in intimate or otherwise highly personal matters, including marriage, contraception, sexual activity, medical information, family relations, and other personal information. In addition, the Constitution protects against compelled disclosure of information that would violate a person’s First Amendment rights, such as freedom of association. This Part describes that historical protection, which is also reflected in various stages in changes to the Rules.
A. Early Privacy Protection in Discovery
Even before the Rules were promulgated, early case law recognized that there should be limits on discovery of private or “secret” matters.22Developments in the Law – Discovery, 74 Harv. L. Rev. 940, 1008 (1961) (noting areas involving “income tax returns, grand jury transcripts, and trade secrets,” where courts had to reconcile “the interests in disclosure and secrecy”). One such early case was E. I. Du Pont de Nemours Powder Co. v. Masland,23244 U.S. 100 (1917). where the Supreme Court found that a company should not have to disclose “secret processes” as part of the litigation to anyone other than opposing counsel and the judge.24Id. at 101, 103 (upholding an injunction against disclosing any of the plaintiffs’ “secret processes” to experts or witnesses during discovery but allowing judge discretion as to whether to allow later disclosure). Those secrets had been communicated to the defendant “through a special confidence that he accepted,” and the defendant should not “fraudulently abuse the trust reposed in him.”25Id. at 102. The Court upheld an injunction against the disclosure of trade secrets “to experts or witnesses produced during the taking of proofs—but excepting the defendant’s counsel,” it being understood “that if, in the opinion of the trial judge, it is or should become necessary to reveal the secrets to others it will rest in the judge’s discretion to determine whether, to whom, and under what precautions, the revelation should be made.”26Id.at 103; see also Neil M. Richards & Daniel J. Solove, Privacy’s Other Path: Recovering the Law of Confidentiality, 96 Geo. L.J. 123, 136 (2007) (discussing confidentiality as an early precursor to our privacy torts, and its later splintering into a number of protections, including for what we call trade secrets).
Later cases cited Du Pont de Nemours as support for the discretion of the trial court to allow limits on disclosure of discovery to others to protect a litigant, including by the use of in camera proceedings.27Herold v. Herold China & Pottery Co., 257 F. 911, 917 (6th Cir. 1919) (“[D]isclosure can usually be made under such regulations on the part of the trial judge as will furnish reasonably adequate protection against publicity.”); id. (“[The lower court] recognized that ‘it would have been better, had there been a voluntary or compulsory disclosure in camera of what each party claims as a trade secret.’”). When courts denied motions to prohibit discovery of trade secrets, they nonetheless emphasized limits to protect privacy, and the extent to which the lower court had discretion to condition disclosure.28See Cities Serv. Oil Co. v. Celanese Corp. of Am., 10 F.R.D. 458, 461 (D. Del. 1950) (denying a motion to prevent discovery based on trade secrets in an infringement action, “although as much privacy as possible might be preserved by compelling disclosure no farther than to the judge himself, or to his delegated master or auditor.”); id. at 460 (“[T]he extent to which the disclosure of secrets will be compelled is a matter largely resting upon the court’s discretion.”); Ferguson v. Ford Motor Co., 8 F.R.D. 414, 416 (S.D.N.Y. 1948) (“[T]he judge’s discretion is very wide in the determination whether, to whom, and under what precautions the revelation should be made.” (citing Du Pont de Nemours, 244 U.S. 100)). When the Rules were promulgated twenty years after Du Pont de Nemours, Rule 30(b) (the equivalent of modern Rule 26(c)) included the right of a court to protect against discovery of “secret processes, developments, or research.”29Until 1970, Rule 30(b) authorized a protective order directing that “secret processes, developments, or research need not be disclosed.” Wagner Mfg. Co. v. Cutler-Hammer, Inc., 10 F.R.D. 480, 485 (S.D. Ohio 1950).
Courts extended the rationale for protection of a business’s secrets to its financial records.30Richland Wholesale Liquors, Inc. v. Joseph E. Seagram & Sons, Inc., 40 F.R.D. 480, 482–83 (D.S.C. 1966) (requiring a “compelling need” for the discovery of financial records). As one court put it when denying a party’s motion for production of extensive financial records:
While i[t] may be true that, in the language of the vernacular, a party involved in a lawsuit under the present Federal Rules may be required, when entering Court, to “put all his cards upon the table”, this is no basis for assuming that he must also put all his clothes upon the table. A litigant is entitled to some privacy on matters not directly relevant to the lawsuit.31Serv. Liquor Distribs., Inc. v. Calvert Distillers Corp., 16 F.R.D. 344, 347 (S.D.N.Y. 1954) (“Certain items from those documents may be relevant, but this is no reason for giving the plaintiff a roving commission to get not merely those items but also all the details of a business that may have no relevancy to the lawsuit, but which would be delectable nuggets of information for a competitor.”).
This protection for financial information was found to be particularly strong when documents were sought from third parties. In Hecht v. Pro-Football, Inc.,3246 F.R.D. 605 (D.D.C. 1969). the District Court for the District of Columbia quashed subpoenas seeking profit and loss statements of a non-party, noting that the requests “seek private financial records of persons who are not parties to this action.”33Id. at 606–07. Without attribution, the court noted that “[t]he right of privacy and the right to keep confidential one’s financial affairs is well recognized.”34Id. at 607 (“It seems to be part of human nature not to desire to disclose them.”). While the Rules contemplate “liberal disclosure,” discovery is not unlimited: “There must be restrictions to protect individuals in their natural privacy.”35Id.; see also Premium Serv. Corp. v. Sperry & Hutchinson Co., 511 F.2d 225, 229 (9th Cir. 1975) (finding no abuse of discretion in quashing subpoena for non-party business documents).
The rationale for protecting confidentiality of business information extended to the context of employee evaluations and confidential business reports, shielding from disclosure to allow for candid evaluation. In New York Stock Exchange, Inc. v Sloan,36No. 71CV2912, 1976 WL 169086 (S.D.N.Y. Oct. 21, 1976). a court gave two reasons for preventing the discovery of an accounting firm’s employee evaluations. “First, revealing the contents of these evaluations, which were prepared without input by their subjects, and which are the kind of materials which the employees justifiably expect to be kept confidential, would invade the employees’ privacy.”37Id. at *3. The second “broader purpose” was that if discovery of such documents were “generally allowed [in civil litigation], firms might cease to frankly criticize and rate their own performance, for fear that any written evaluations they make might be used against them or their employees in a lawsuit.”38Id.
The court analogized this protection to that afforded by courts to hospital boards’ records evaluating medical procedures and performance; of income tax returns; of a broker’s confidential records of client names and transactions of clients; and of internal reports analyzing a corporation’s affirmative action efforts in employment.39Id. In each of these cases, “the policies in favor of confidentiality—protecting individuals’ expectations of privacy and/or promoting free communication of candid evaluations and criticisms within an organization—have been deemed strong enough to justify restrictions on liberal pretrial discovery.”40Id. The court found that this protection could be overcome only by a showing of clear relevance and exceptional necessity.41Id. at *4 (citing Cooper v. Hallgarten & Co., 34 F.R.D. 482, 483–84 (S.D.N.Y. 1964)). In Cooper v. Hallgarten & Co., which was relied on by the Sloan court, Judge Weinfeld found “the production of tax returns should not be ordered unless it clearly appears that they are relevant to the subject matter of the action or to the issues raised thereunder, and, further, that there is a compelling need therefore because the information contained therein is not otherwise readily obtainable.” Sloan, 1976 WL 169086, at *4 (quoting Cooper, 34 F.R.D. at 483–84).
Sloan was followed by Stabilus, A Division of Fichtel & Sachs Industries, Inc. v. Haynsworth, Baldwin, Johnson & Greaves, P.A.,42144 F.R.D. 258 (E.D. Pa. 1992). which declined the defendant law firm’s discovery request for the plaintiff’s employment records, citing confidentiality and burden. Like in Sloan, the discovery was not relevant to the main issue of the action, and was overly broad and unduly burdensome.43Id. at 267. Modern cases too follow this precedent for protection of employee performance reviews based on the likelihood that they contain sensitive and private information.44See Kampfe v. PetSmart, Inc., 304 F.R.D. 554, 559 (N.D. Iowa 2015) (finding employer’s interest in discovering potentially relevant information concerning allegations of misconduct outweighed employee’s heightened privacy interest in her personnel files from her other employer); Fieldwood Energy, L.L.C. v. Diamond Servs. Corp., No. 14-650, 2015 WL 1415501, at *1 (E.D. La. Mar. 27, 2015) (denying production of personnel files of non-parties); DaCosta v. City of Danbury, 298 F.R.D. 37, 41 (D. Conn. 2014) (“‘Courts have generally characterized personnel files as confidential and found it appropriate to enter protective orders governing their use in litigation because of the inherent potential for harm or embarrassment if the information is revealed.’ This includes data such as income information, medical history and disciplinary history.” (citations omitted) (quoting Duling v. Gristede’s Operating Corp., 266 F.R.D. 66, 71–72 (S.D.N.Y. 2010))); Mulligan v. Provident Life & Accident Ins. Co., 271 F.R.D. 584, 594; (E.D. Tenn. 2011) (noting that defendants would not be compelled to produce employee performance reviews which contained no mention of plaintiff or his claim); id. (“While performance reviews may contain relevant information, however, they may also contain sensitive and private information. Accordingly, the courts within our circuit have been reluctant to allow their discovery.”).
Another early area of privacy in discovery was protection for income tax returns. This protection for individual financial records was based on the policy against public disclosure represented in the Internal Revenue Code. As the District Court for the Southern District of New York noted in Kingsley v. Delaware, Lackawanna & Western Railroad Co.,4520 F.R.D. 156 (S.D.N.Y. 1957). “[t]he purpose of the [Internal Revenue Code of 1954, 26 U.S.C. § 6103,] is to prevent the disclosure of confidential information to those who do not have a legitimate interest in it.”46Id. at 158. However, disclosure is warranted where the plaintiff put his income at issue: “once a person has made the amount of his income an issue in litigation it becomes a legitimate subject of inquiry and he can no longer claim that the information contained in his returns is confidential.”47Id. In contrast, the court in Wiesenberger v. W. E. Hutton & Co.4835 F.R.D. 556 (S.D.N.Y. 1964). denied a discovery request for the plaintiff’s tax returns in a case alleging Securities Act violations where the plaintiff had not put his income at issue:
There is no privilege for income tax returns but the courts have been reluctant to order their production. People are normally opposed to the invasion of their privacy by exposure of the details contained in an income tax return. In the hands of the Government, these returns are confidential. 26 U.S.C. § 7213(a). Unless clearly required in the interests of justice, litigants ought not to be required to submit such returns as the price for bringing or defending a lawsuit.49Id. at 557–58; see also Premium Serv. Corp. v. Sperry & Hutchinson Co., 511 F.2d 225, 229 (9th Cir. 1975) (finding no abuse of discretion in quashing subpoena for non-party business documents and individual tax returns); United Motion Theatre Co. v. Ealand, 199 F.2d 371, 371 (6th Cir. 1952) (per curiam) (modifying an order to produce to delete “copies of all tax returns (including state employment and Federal Income, excess profits, with-holding, social security, payroll, excise and amusement or admission tax), and all related documents, memoranda and supporting data”); Fed. Sav. & Loan Ins. Corp. v. Krueger, 55 F.R.D. 512, 514 (N.D. Ill. 1972) (“[While there is no absolute privilege against production,] it is the opinion of this court that the statutes cited reflect a valid public policy against disclosure of income tax returns. This policy is grounded in the interest of the government in full disclosure of all the taxpayer’s income which thereby maximizes revenue. To indiscriminately compel a taxpayer to disclose this information merely because he has become a party to a lawsuit would undermine this policy.”).
As discussed below, this recognition of protection in discovery based on legislative confidentiality has been extended to other statutes in addition to the Income Tax Code.50See infra Section I.C.1.
All of these protections recognized by early courts were adopted in subsequent amendments to the Rules, or approved by reference in the advisory committee notes. In 1970, the Rules were amended to include for the first time several general limitations on the scope of discovery.51See 8 Charles Alan Wright, Arthur R. Miller & Richard L. Marcus, Federal Practice and Procedure § 2003 (3d ed. 2010) (noting that the 1970 amendments to the Rules included a significant rearrangement as well as the first general provision for a limitation on overall scope in Rule 26).
First, in adopting Rule 26’s standard for scope, the Advisory Committee noted existing case law limiting discovery that is otherwise within its purview, including restrictions on discovery of tax returns.52Fed. R. Civ. P. 26 advisory committee’s note to 1970 amendment. Rule 26(c) (transferred from 30(b)) confers broad powers on the courts to regulate or prevent discovery even though the materials sought are within the scope of 26(b), and these powers have always been freely exercised. For example, a party’s income tax return is generally held not privileged, and yet courts have recognized that interests in privacy may call for a measure of extra protection. Similarly, the courts have in appropriate circumstances protected materials that are primarily of an impeaching character. These two types of materials merely illustrate the many situations, not capable of governance by precise rule, in which courts must exercise judgment. The new subsections in Rule 26(b) do not change existing law with respect to such situations. Id.
Rule 26(c) (transferred from 30(b)) confers broad powers on the courts to regulate or prevent discovery even though the materials sought are within the scope of 26(b), and these powers have always been freely exercised. For example, a party’s income tax return is generally held not privileged, and yet courts have recognized that interests in privacy may call for a measure of extra protection. Similarly, the courts have in appropriate circumstances protected materials that are primarily of an impeaching character. These two types of materials merely illustrate the many situations, not capable of governance by precise rule, in which courts must exercise judgment. The new subsections in Rule 26(b) do not change existing law with respect to such situations.
Second, in explaining a change to the Rules requiring disclosure of insurance coverage as conducive to settlement, the Advisory Committee noted that the disclosure would not extend to “other facts concerning defendant’s financial status,” partly because it “does not involve a significant invasion of privacy.”53Id. This acknowledges the invasion of privacy that courts had found from general disclosures of financial information.
Third, the new Rules added language to comport with work product protection found in Hickman, reflecting “the trend of the cases by requiring a special showing, not merely as to materials prepared by an attorney, but also as to materials prepared in anticipation of litigation or preparation for trial by or for a party or any representative acting on his behalf.”54Id.; see also Hobley v. Burge, 433 F.3d 946, 949 (7th Cir. 2006) (“The purpose of the qualified privilege for attorney work product, which is codified in Federal Rule of Civil Procedure 26(b)(3), is to establish a zone of privacy in which lawyers can analyze and prepare their client’s case free from scrutiny or interference by an adversary. . . . An attorney has an independent interest in privacy [of documents covered by work-product privilege], even when the client has waived its own claim, as long as invoking the privilege would not harm the client’s interests.”).
Finally, the Rules were revised to add a specific reference for protection of trade secrets “and other confidential commercial information,” again reflecting construction of protective orders by case law.55Fed. R. Civ. P. 26 advisory committee’s note to 1970 amendment.
The new reference to trade secrets and other confidential commercial information reflects existing law. The courts have not given trade secrets automatic and complete immunity against disclosure, but have in each case weighed their claim to privacy against the need for disclosure. Frequently, they have been afforded a limited protection.56Id.
Thus, rules revisions codified or approved of the protection shown by the courts for confidential commercial information based on case law and public policy represented by legislative disclosure limitations.
B. Constitutional Privacy
Next, the series of Supreme Court cases recognizing a constitutional right to privacy led to lower courts’ protection for discovery requests that implicate that right.
The first Supreme Court case to find a constitutional dimension to the protection of privacy in discovery was NAACP v. Alabama.57NAACP v. Alabama ex rel. Patterson, 357 U.S. 449 (1958). There, the Supreme Court found a constitutional right to privacy which allowed the National Association for the Advancement of Colored People (“NAACP”) to refuse to disclose membership lists.58Id. at 466. Alabama sought an injunction against the NAACP to prevent it from doing further business in the state, and sought an order requiring the group to produce its membership lists.59Id. at 452–53. The state supreme court upheld sanctions against the NAACP for refusing to comply with that order.60Id. at 453–54. In reversing those sanctions, the U.S. Supreme Court found that the Due Process Clause protects a litigant from compelled disclosure of membership in an organization pursuant to a state court discovery order:
It is beyond debate that freedom to engage in association for the advancement of beliefs and ideas is an inseparable aspect of the “liberty” assured by the Due Process Clause of the Fourteenth Amendment, which embraces freedom of speech. . . . Compelled disclosure of membership in an organization engaged in advocacy of particular beliefs is of the same order. Inviolability of privacy in group association may in many circumstances be indispensable to preservation of freedom of association, particularly where a group espouses dissident beliefs.61Id. at 460, 462.
Therefore, the Court held that the NAACP was not required to comply with a discovery order where that order would conflict with its members’ rights “to pursue their lawful private interests privately and to associate freely with others in so doing.”62Id. at 466.
In Seattle Times Co. v. Rhinehart,63467 U.S. 20 (1984). the Court considered whether a newspaper had a right to disseminate lists of a religious group’s donors and members that had been compelled in discovery in a defamation case against the newspaper.64Id. at 22, 24–26. The trial court ordered the group to identify the donors, and issued a protective order that prohibited public dissemination of the information.65Id. at 27. The Supreme Court affirmed the protective order against public disclosure, noting the breadth of discovery often allowed in civil court and the necessity for protection against further dissemination:
It is clear from experience that pretrial discovery by depositions and interrogatories has a significant potential for abuse. This abuse is not limited to matters of delay and expense; discovery also may seriously implicate privacy interests of litigants and third parties. The Rules do not distinguish between public and private information. . . .
There is an opportunity, therefore, for litigants to obtain—incidentally or purposefully—information that not only is irrelevant but if publicly released could be damaging to reputation and privacy.66Id. at 34–35 (footnote omitted).
Where sensitive information is disclosed in discovery, public dissemination may be limited in the court’s discretion.
Courts have followed these decisions in protecting from disclosure information protected by the First Amendment like the names of a day laborers’ organization.67See Centro de la Comunidad Hispana de Locust Valley v. Town of Oyster Bay, 954 F. Supp. 2d 127, 141 (E.D.N.Y. 2013) (challenging prohibition on workers from stopping vehicles to solicit work in action by day laborers organizations, issuing a protective order to prevent discovery of the organization’s members, finding the invasion of privacy from the infringement on the organization’s associational rights outweighed the Town’s need for the discovery), aff’d, 868 F.3d 104 (2d Cir. 2017). In addition, courts have cited Seattle Times as authority for limitations on discovery pursuant to Rule 26(c) based on privacy concerns, whether or not they have a constitutional basis.68See Battle v. District of Columbia, 303 F.R.D. 172, 173–74 (D.D.C. 2014) (declining to order defendant to submit an intimate picture of himself, but citing Seattle Times as a precedent for discretion under Rule 27(c) “to balance plaintiff’s need for discovery against defendant’s valid privacy concerns”); Slate v. Am. Broad. Cos., 802 F. Supp. 2d 22, 26–27 (D.D.C. 2011) (upholding decision to sequester hard drives containing sensitive, private files of non-parties, and citing Seattle Times as authority for limiting disclosure of such personal information under Rule 26(c)), aff’d, 584 F. App’x 2 (D.C. Cir. 2014) (per curiam).
A series of Supreme Court cases recognizing a constitutional right to privacy in certain intimate relationships and personal decisions led courts to deny compelled disclosure related to litigants’ personal lives. First, in Griswold v. Connecticut,69381 U.S. 479 (1965). the Court struck down a law prohibiting married couples from using contraception, and first recognized the Constitution’s “zones of privacy,” which include the right of association, the right to be free from unreasonable searches and seizures, among others:
The present case, then, concerns a relationship lying within the zone of privacy created by several fundamental constitutional guarantees. And it concerns a law which, in forbidding the use of contraceptives rather than regulating their manufacture or sale, seeks to achieve its goals by means having a maximum destructive impact upon that relationship.70Id. at 484–85.
Later cases helped clarify what was included in that “zone of privacy.” In considering whether a New York Act violated constitutionally protected privacy between doctor and patient, the Court in Whalen v. Roe71429 U.S. 589 (1977). recognized that the individuals whose information was required to be shared by their doctors had two interests that implicated privacy.72Id. at 598–99. They included both “the individual interest in avoiding disclosure of personal matters, and . . . the interest in independence in making certain kinds of important decisions.”73Id. at 599–600 (footnotes omitted). Subsequent courts have referred to these as interests in “confidentiality” and in “autonomy.” See Barry v. City of New York, 712 F.2d 1554, 1558–59 (2d Cir. 1983); Plante v. Gonzalez, 575 F.2d 1119, 1128 (5th Cir. 1978). With respect to the former, the Court noted that the Act implicated “the right of an individual not to have his private affairs made public by the government” and “the right of an individual to be free in action, thought, experience, and belief from governmental compulsion.”74Whalen, 429 U.S. at 599 n.24. As to the second interest, the Court quoted Justice Brandeis’s famous dissent in Olmstead v. United States,75277 U.S. 438 (1928). characterizing “‘the right to be let alone’ as ‘the right most valued by civilized men,’” and quoted the finding in Griswold that “the First Amendment has a penumbra where privacy is protected from governmental intrusion.”76Whalen, 429 U.S. at 599 n.25 (first quoting Olmstead, 277 U.S. at 478 (Brandeis, J., dissenting); and then quoting Griswold, 381 U.S. at 483).
In Roe v. Wade,77410 U.S. 113 (1973). the Court summarized its previous decisions determining that, while the Constitution does not explicitly mention any right of privacy, such a right does exist and applies to “personal rights that can be deemed ‘fundamental’ or ‘implicit in the concept of ordered liberty,’” and “has some extension to activities relating to marriage; procreation; contraception; family relationships; and child rearing and education.”78Id. at 152–53 (citations omitted). “This right of privacy, [based] in the Fourteenth Amendment’s concept of personal liberty and restrictions upon state action . . . is broad enough to encompass a woman’s decision whether or not to terminate her pregnancy.”79Id. at 153.
Courts have cited to Whalen in refusing to allow discovery. In Mann v. University of Cincinnati,80824 F. Supp. 1190 (S.D. Ohio), aff’d, 152 F.R.D. 119 (S.D. Ohio 1993), aff’d per curiam, 114 F.3d 1188 (6th Cir. 1997). the university improperly issued subpoenas for the plaintiff’s medical records in a sexual harassment suit.81Id. at 1202. The court found that the plaintiff had a constitutionally protected interest in her medical records, and after an in camera review, found that the highly personal records were not entitled to discovery:
There can be no question that the aforementioned information is of such a private nature that a constitutional right to privacy exists. In a civilized society in the year 1993, where vast amounts of personal information are contained not only in medical files but in computerized data banks or other massive government files, much of which is personal in character and potentially embarrassing or harmful if disclosed, the constitutional right to privacy is surely as significant as the protection of commercial information specifically recognized by Rule 45(c)(3)(B)(i).82Id. at 1199 (citation omitted); see also Cockrum v. Johnson, 917 F. Supp. 479, 481–83 (E.D. Tex. 1996) (finding that the privacy interest of an imprisoned father in letters with his daughter outweighed governmental needs and could not be subject to discovery); Dist. Ct. v. Judd, 256 P.3d 687, 689 (Colo. 2011) (en banc) (finding that financial documents identifying compensation are not subject to discovery with limited exceptions).
Courts also rely upon this case law to delineate rough boundaries for the type of privacy interest that is protected from disclosure. In addition to privacy rights against discovery of medical records,83See In re Sealed Case (Medical Records), 381 F.3d 1205, 1215 (D.C. Cir. 2004) (“[When evaluating good cause under Rule 26,] interests in privacy may call for a measure of extra protection.” (quoting Fed. R. Civ. P. 26 advisory committee’s note to 1970 amendment)); St. Clair v. Washington, No. C05-341, 2006 WL 8454842, at *2 (W.D. Wash. Jan. 30, 2006) (“Notwithstanding the court’s decision that [state statutes] do not impose limits on discovery in a federal question case, the court recognizes that disclosure may touch on privacy rights, particularly in the context of medical files.”); Mann, 824 F. Supp. at 1195–97 (finding a constitutional privacy right regarding a patient’s medical records). courts have protected the identity of parties involved in claims about contraception rights;84See Stormans, Inc. v. Selecky, 251 F.R.D. 573, 576–78 (W.D. Wash. 2008) (ordering protection under 26(c) for the identity of pharmacies refusing to sell Plan B). personal information concerning medical, sexual, and contraceptive histories and practices;85Farnsworth v. Procter & Gamble Co., 758 F.2d 1545, 1545, 1548 (11th Cir. 1985) (affirming district court’s protective order under 26(c) denying the defendant access to information about participants in health studies, including their “medical histories, sexual practices, contraceptive methods, pregnancy histories, [and] menstrual activity”). the identity of participants in medical studies;86Id. at 1547–48; see also Johnson v. Thompson, 971 F.2d 1487, 1497 (10th Cir. 1992) (upholding the denial of discovery of names of participants in a medical study due to privacy interests of the individual participants). the identity of blood donors in cases alleging disease from transfusions;87Estate of Hoyle v. Am. Red Cross, 149 F.R.D. 215, 217 (D. Utah 1993) (finding plaintiff infected with disease during transfusion not entitled to disclosure of blood donor’s name because of “the strong interest against intrusion into one’s private life”); Rasmussen v. S. Fla. Blood Serv., Inc., 500 So. 2d 533, 537–38 (Fla. 1987) (finding privacy interests of blood donors outweighed victim’s interest in discovering donors’ identities). personal letters between a father and child;88Cockrum v. Johnson, 917 F. Supp. 479, 481–83 (E.D. Tex. 1996) (finding good cause for issuing protective order against production of letters written by petitioner to his daughter while in prison, based on the “zone of familial privacy”). diagnostic and mental evaluation files of children;89Lora v. Bd. of Educ., 74 F.R.D. 565, 585–87 (E.D.N.Y. 1977). records of employee drug use;90Burka v. N.Y.C. Transit Auth., 110 F.R.D. 660, 664–65 (S.D.N.Y. 1986). and a party’s sexual history.91Allen v. G.D. Searle & Co., 122 F.R.D. 580, 582 (D. Or. 1988).
While Whalen concerned disclosure of information regarding drug prescriptions, which arguably is included in the intimate matters protected generally in the cases above, Whalen also indicated that the right to avoid disclosure of personal information went beyond those intimate spaces:
We are not unaware of the threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks or other massive government files. The collection of taxes, the distribution of welfare and social security benefits, the supervision of public health, the direction of our Armed Forces, and the enforcement of the criminal laws all require the orderly preservation of great quantities of information, much of which is personal in character and potentially embarrassing or harmful if disclosed. The right to collect and use such data for public purposes is typically accompanied by a concomitant statutory or regulatory duty to avoid unwarranted disclosures. Recognizing that in some circumstances that duty arguably has its roots in the Constitution, nevertheless New York’s statutory scheme, and its implementing administrative procedures, evidence a proper concern with, and protection of, the individual’s interest in privacy.92Whalen v. Roe, 429 U.S. 589, 605 (1977) (emphasis added) (footnotes omitted).
This passage suggests that the Constitution protects not only information concerning intimate relationships and decisions, but also personal and potentially embarrassing information relating to finances, government benefits, military service, and criminal activity.
In United States Department of Justice v. Reporters Committee for Freedom of Press,93489 U.S. 749 (1989). the Court confirmed that Whalen’s recognition of a constitutional privacy interest included “keeping personal facts away from the public eye,” and that protected facts went beyond the zone of intimacy.94Id. at 769. Just as Whalen recognized that a centralized computer file of names and addresses of people obtaining prescription drugs “posed a ‘threat to privacy,’” so too did the publication of a person’s rap sheet information.95Id. at 770–71 (“The privacy interest in a rap sheet is substantial.”). This “substantial” privacy interest was implicated by the Constitution in addition to the Freedom of Information Act’s (“FOIA”) privacy exemption.96Id.
In addition, the Supreme Court’s decision in Nixon v. Administrator of General Services97433 U.S. 425 (1977). affirmed a constitutional right to privacy in personal communications. There, the former president challenged a law requiring that he turn over documents and tape recordings accumulated during his terms of office.98Id. at 425–26. While affirming the constitutionality of the law, the Court nevertheless recognized that “a very small fraction” of Nixon’s papers were in fact private and deserved protection.99Id. at 459. Those included “extremely private communications between him and, among others, his wife, his daughters, his physician, lawyer, and clergyman, and his close friends.”100Id. (internal quotation marks omitted).
Subsequent courts have read these cases as authority for privacy against disclosure of personal matters that are not strictly “intimate.”101See Burka v. N.Y.C. Transit Auth., 110 F.R.D. 660, 664, 667 (S.D.N.Y. 1986) (finding a privacy right in discovery dispute regarding defendant employee and applicant files but that it is outweighed by the need for the information and diminished by use of a protection order). In Tavoulareas v. Washington Post Co.,102724 F.2d 1010 (D.C. Cir. 1984). the Court of Appeals for the District of Columbia reviewed a lower court order unsealing a number of discovery documents in a libel action.103Id. at 1011–12. The court reviewed decisions from the Fifth Circuit finding a right to financial privacy,104Id. at 1020 (citing Plante v. Gonzalez, 575 F.2d 1119 (5th Cir. 1978)). and from the Third Circuit finding a right to privacy in medical records.105Id. (citing United States v. Westinghouse Elec. Corp., 638 F.2d 570 (3d Cir. 1980)). The court then found that the plaintiff had a constitutionally protected privacy interest in avoiding public disclosure of the discovery material:
The significance in this context of the Supreme Court’s decisions in Whalen and Nixon v. A.G.S., and of the Third and Fifth Circuits’ respective decisions in Westinghouse and Plante, lies in their explicit recognition of the constitutional right to avoid disclosure of personal matters. In the discovery process, individuals are often forced by the court to disclose the kind of personal information deserving privacy protection under these decisions. An individual’s constitutional privacy interest can thus be implicated by the discovery process to the same extent it is implicated by disclosure requirements of statutes. In both instances, the government is forcing disclosure of personal information.106Id. at 1020–21 (footnote omitted).
That right to privacy in the discovery process outweighed any First Amendment right the newspaper may have to publicize the information.
C. Public Policy of Privacy in Discovery
Protection for privacy has evolved as the legislature has instituted new privacy laws, including what many courts refer to as “statutory publication shelters.”107Friedman v. Bache Halsey Stuart Shields, Inc., 738 F.2d 1336, 1344–45 (D.C. Cir. 1984). These ordinarily apply where legislation requires the production of information to the government or to the public, but places limitation on further disclosure or carves out exceptions to public disclosure.108Id. at 1343–45. Courts deem such legislative determinations of confidentiality to be worthy of privacy protection against discovery.109See Chamber of Com. v. Legal Aid Soc’y of Alameda Cnty., 423 U.S. 1309, 1311–12 (1975) (Douglas, J., in chambers) (finding a possible privilege against production under Rule 26 based on statutory limitations on disclosure of information obtained by EEOC from general contractors, including affirmative action and compliance reports); id. (“[T]he congressional purpose of confidentiality, protected by criminal sanctions, is not to be lightly circumvented.”). It is possible for such statutes to create privileges.110See Baldrige v. Shapiro, 455 U.S. 345, 361 (1982) (finding that Congress intended the confidentiality provisions of the Census Act to constitute a “privilege” within the meaning of discovery provisions of the Rules). More commonly, they instead give rise to protection to be balanced against the need for the discovery. As the Court of Appeals for the District of Columbia put it:
[S]tatutory publication shelters may have some application to discovery. These protected interests reflect a congressional judgment that certain delineated categories of documents may contain sensitive data which warrants a more considered and cautious treatment. In the context of discovery of government documents in the course of civil litigation, the courts must accord the proper weight to the policies underlying these statutory protections, and to compare them with the factors supporting discovery in a particular lawsuit.111Friedman, 738 F.2d at 1344.
One such statutory publication shelter is represented by the exceptions to required disclosure under FOIA. The statute shines light onto government operations by requiring agencies to provide documents on request, with some important exemptions. An agency need not provide “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy,” or “records or information compiled for law enforcement purposes, but only to the extent that the production of such [materials] . . . could reasonably be expected to constitute an unwarranted invasion of personal privacy.”1125 U.S.C. § 552(b)(6)–(7)(C). FOIA exemptions have been persuasive to courts considering privacy arguments against discovery. As the District of Columbia Court of Appeals found in Friedman v. Bache Halsey Stuart Shields, Inc.,113738 F.2d 1336 (D.C. Cir. 1984). in the context of subpoenas directed to the Securities and Exchange Commission and the Commodity Futures Trading Commission for investigatory files, exemption from disclosure under FOIA does not automatically mean that “the information is privileged within the meaning of rule 26(b)(1) and thus not discoverable in civil litigation.”114Id. at 1344. Instead, the district court may consider such FOIA exceptions “as congressional underscoring of the government’s interest in protecting sensitive investigatory information.”115Id. at 1344–45; see also Inmates of Unit 14 v. Rebideau, 102 F.R.D. 122, 128–29 (N.D.N.Y. 1984) (noting in the context of a request for personnel files of defendant prison guards that a FOIA exemption “does not automatically constitute a ‘privilege’ within the meaning of the Federal Rules of Civil Procedure” but is a reason to give protection to personal information within such files).
Courts also find a public policy of protection from discovery represented by the Privacy Act,1165 U.S.C. § 552a(b) (“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [without an applicable exception] . . . .”). which protects against disclosure information prepared for government agencies.117See U.S. Dep’t of Just. v. Reps. Comm. for Freedom of the Press, 489 U.S. 749, 766–67 (1989); Adelman v. Brady, No. 89-4714, 1990 WL 39147, at *1–2 (E.D. Pa. Mar. 28, 1990) (noting in claim based on Age Discrimination and Employment Act that the effect of the Privacy Act on a request from the IRS for records of employees was to reflect a public policy of protection); id. (“Thus, as is true with respect to other statutory publication bans, the applicability of the Privacy Act to the materials requested is a relevant factor for the District Court to consider in determining the appropriate scope and manner of discovery in a given case.”); Boudreaux v. United States, No. Civ.A. 97-1592, 1999 WL 499911, at *2 (E.D. La. July 14, 1999) (ordering the production of documents in camera so that the court could determine the legitimacy of its objections “in the considered and cautious manner contemplated by the Privacy Act”). In Laxalt v. McClatchy,118809 F.2d 885 (D.C. Cir. 1987). the Court of Appeals for the District of Columbia Circuit addressed the discovery of Federal Bureau of Investigation (“FBI”) files. Defendants sought the records to help prove the truth of allegedly libelous statements they had printed suggesting that the plaintiff’s associates had ties to organized crime.119Id. at 886. The court rejected the argument that the Privacy Act created a privilege against discovery, but found that because records are subject to the Act, the district court’s use of its discretion under Rule 26(c) “may in many cases be weightier than in the usual discovery context.”120Id. at 889. Specifically, “when the District Court considers a request for a Privacy Act order in the discovery context it must consider the use of protective orders and the possibility of in camera inspection,” and should also consider notifying any affected nonparties.121Id.
Finally, courts have protected disclosure of medical records based both on Supreme Court precedent for protection of medical privacy122See infra Section II.A.2. but also based on the Health Insurance Privacy Authorization Act (“HIPAA”). In St. John v. Napolitano,123274 F.R.D. 12 (D.D.C. 2011). an action alleging employment discrimination on the basis of national origin and age and retaliation, the defendant Department of Homeland Security sought the production of the plaintiff employee’s medical records for a nine-year period.124Id. at 15. The court required disclosure of only a portion of those records having a logical connection to the employee’s claims of injury:
[M]edical records are likely to contain sensitive personal information, a fact underscored by the existence of statutory confidentiality provisions, like those of the HIPAA Privacy Rule. Accordingly, the plaintiff has demonstrated that the burden of producing such records and the harm to the plaintiff’s privacy interests from the disclosure significantly outweighs any marginal relevance for the majority of the time period for which the defendant seeks records.125Id. at 17 (citations omitted); see also Taylor v. Altoona Area Sch. Dist., No. 05-CV-350, 2008 WL 11511749, at *2 (W.D. Pa. Oct. 10, 2008) (“While there is no federal common law doctor-patient privilege, medical records still invoke weighty privacy concerns, as evidenced by the federal government’s enactment of HIPA [sic] regulations; therefore, this Court will balance the privacy concerns of the Defendant with the discovery interests of the Plaintiff.”); E.E.O.C. v. Bos. Mkt. Corp., No. 03-4227, 2004 WL 3327264, at *5 (E.D.N.Y. Dec. 16, 2004) (prohibiting defendant’s ex parte communications with the plaintiff’s medical doctors which, “while not expressly prohibited by HIPAA, create . . . too great a risk of running afoul of that statute’s strong federal policy in favor of protecting the privacy of patient medical records”).
Other relevant federal statutes that protect against disclosure include the Children’s Online Privacy Protection Act;12615 U.S.C. §§ 6501–6506 (protecting personal information from and about children). the Fair Credit Reporting Act;12715 U.S.C. §§ 1681–1681u (limiting access to and use of credit reports). the Family Education Rights and Privacy Act;12820 U.S.C. § 1232g (protecting educational records). the Gramm-Leach-Bliley Act;12915 U.S.C. §§ 6801–6809 (protecting nonpublic personal information held by financial institutions). the Cable Communications Policy Act;13047 U.S.C. § 551 (protecting personally identifiable information collected from cable subscribers). the Video Privacy Protection Act;13118 U.S.C. § 2710 (protecting rental and sale records of video tapes and similar audio-visual materials). the Employee Polygraph Protection Act;13229 U.S.C. §§ 2001–2009 (prohibitions on employers’ use of lie detectors). the Stored Communications Act;13318 U.S.C. §§ 2701–2713 (imposing limits on access to email, voicemail, and text messages once they are no longer in transit). the Genetic Information Nondiscrimination Act;13442 U.S.C. §§ 2000ff to 2000ff–11 (regulating use of genetic information). and the Right to Financial Privacy Act.13512 U.S.C. §§ 3401–3423 (limiting access to bank records). Statutory publication shelters do not ordinarily create privileges against discovery production, but they are strong evidence of congressional intent to protect certain personal or otherwise confidential information.136See Laxalt v. McClatchy, 809 F.2d 885, 889 (D.C. Cir. 1987) (“These protected interests reflect a congressional judgment that certain delineated categories of documents may contain sensitive data which warrants a more considered and cautious treatment.” (quoting Friedman v. Bache Halsey Stuart Shields, Inc., 738 F.2d 1336, 1344 (D.C. Cir. 1984))). Courts therefore require a stronger showing for the production of such information.137See infraSection I.C.3.
When a federal court sits in diversity, it applies federal procedural law but otherwise applies the law of the state, including the state’s privilege law.138Fed. R. Evid. 501. Protection of privacy in discovery is treated as a subset of privilege law; therefore, when a federal court sits in diversity, it applies the privacy law of the state where it sits.139Id. (“The common law—as interpreted by United States courts in the light of reason and experience—governs a claim of privilege unless any of the following provides otherwise: the United States Constitution; a federal statute; or rules prescribed by the Supreme Court. But in a civil case, state law governs privilege regarding a claim or defense for which state law supplies the rule of decision.”). In contrast, where federal and state claims are joined, all privacy objections are governed by federal law.140Martinez v. Walt Disney Co., No. SACV 11-00214, 2012 WL 12913739, at *1 (C.D. Cal. Aug. 8, 2012) (applying Fed. R. Evid. 501 and holding that where “federal and state claims are joined,” privilege and privacy objections are governed by federal law). Even when federal law applies, however, courts often take into consideration state laws and policies protecting privacy interests.141See Deitchman v. E.R. Squibb & Sons, Inc., 740 F.2d 556, 560–61 (7th Cir. 1984) (finding persuasive an Illinois statute protecting confidentiality of health department data); Martin v. Conner, 287 F.R.D. 348, 351 (D. Md. 2012) (noting that the existence of state privacy laws disfavoring disclosure of internal affairs records is a factor in determining whether to require production); Brown v. City of Oneonta, 160 F.R.D. 18, 20 (N.D.N.Y. 1995) (finding persuasive state law limiting disclosure of crime victim identities); Burka v. N.Y.C. Transit Auth., 110 F.R.D. 660, 663–64 (S.D.N.Y. 1986) (concluding that privacy claims were governed by federal law, but “the policies underlying state evidentiary privileges must still be given serious consideration”); Lora v. Bd. of Educ., 74 F.R.D. 565, 569 (E.D.N.Y. 1977) (finding that while federal law governs privacy rights to students’ files, “New York’s view of the matter and the expectations of its professionals and its patients may not be ignored”); Tech v. United States, 284 F.R.D. 192, 202 (M.D. Pa. 2012) (noting while state privacy laws do not control a discovery dispute in federal court, consideration of such laws is relevant); Robinson v. Magovern, 83 F.R.D. 79, 91 (W.D. Pa. 1979) (finding state law statutes and privileges persuasive in deciding whether to compel discovery); St. Clair v. Washington, No. C05-341, 2006 WL 8454842, at *2 (W.D. Wash. Jan. 30, 2006) (providing that while state laws did not impose a limit on discovery in this federal question case, such laws are indicative of privacy rights). For example, in In re Sealed Case (Medical Records),142381 F.3d 1205 (D.C. Cir. 2004). the District of Columbia Court of Appeals reviewed a decision ordering production of files of a mentally disabled man in the possession of the city’s agency for disabilities.143Id. at 1207. In addition to finding that some of the records were protected by the psychotherapist-patient privilege, the court found that non-privileged records also presented an intrusion into the man’s legitimate privacy interests.144Id. at 1214–16. The court found persuasive a decision from the Seventh Circuit that relied on a state evidentiary privilege in protecting against the disclosure of medical records: “Particularly relevant here, the Seventh Circuit held that ‘[t]he fact that quashing the subpoena comports with Illinois’ medical-records privilege’ was a ‘factor in favor of the district court’s action.’”145Id. at 1216 (quoting Nw. Mem’l Hosp. v. Ashcroft, 362 F.3d 923, 932 (7th Cir. 2004)). The Third Circuit too had found that, while inapplicable to a federal claim, a state mental health records privilege was persuasive in the application of limits on discovery under Rule 26(c).146Id. (citing Pearson v. Miller, 211 F.3d 57, 65 (3d Cir. 2000)). Therefore, on remand, the district court was ordered to weigh the need for the records against the substantial privacy interests that were implicated.147Id. at 1217–18 (noting that the records at issue were “hugely invasive” of the mentally disabled man’s privacy).
Many states have a robust history of privacy protection in discovery. First, there are more appellate decisions in state courts regarding discovery disputes where litigants are permitted interlocutory appeals from adverse decisions.148See Forman v. Henkin, 93 N.E.3d 882, 885–86 (N.Y. 2018) (discussing a court order regarding discovery of Facebook information that was appealed to appellate court and then to New York’s highest court). Second, many states have rights to privacy pursuant to their state constitutions and apply that law to limit disclosure of personal information.149States with constitutional rights to privacy include Alaska, Arizona, California, Florida, Hawaii, Illinois, Louisiana, Montana, South Carolina, and Washington. Kevin C. McAdam & John R. Webb, Privacy: A Common Law and Constitutional Crossroads, Colo. Law., June 2011, at 55, 56 n.27.
For example, California’s constitution provides that one of its people’s inalienable rights is “pursuing and obtaining . . . privacy.”150Cal. Const. art. I, § 1. Pursuant to that provision, California protects against disclosure of, among other things, sexual information;151See Tien v. Super. Ct., 43 Cal. Rptr. 3d 121, 128 (Ct. App. 2006). tenure files and related discussions;152See Kahn v. Super. Ct., 233 Cal. Rptr. 662, 674 (Ct. App. 1987). and non-party contact information.153See Williams v. Super. Ct., 398 P.3d 69, 84 (Cal. 2017). In Valley Bank of Nevada v. Superior Court,154542 P.2d 977 (Cal. 1975). the Supreme Court of California considered whether a litigant could obtain discovery of confidential customer bank information. The court found that such information was discoverable in a proper case, but that the bank must first take measures to locate the customer and give him an opportunity to challenge the discovery.155Id. at 977. The court construed its constitution to protect “one’s confidential financial affairs as well as . . . the details of one’s personal life.”156Id. at 979. Because the state’s rules of civil procedure providing for protective orders offered inadequate protection against disclosure of third party bank records implicating that right to privacy, the court instituted the additional notice requirement.157Id. at 979 (“The protection of [privacy] should not be left entirely to the election of third persons who may have their own personal reasons for permitting or resisting disclosure of confidential information received from others.”).
Florida’s constitution protects every person’s “right to be let alone and free from governmental intrusion into the person’s private life.”158Fla. Const. art. I, § 23. The Florida Supreme Court has noted, in the context of discovery, that “[a]lthough the general concept of privacy encompasses an enormously broad and diverse field of personal action and belief, there can be no doubt that the Florida amendment was intended to protect the right to determine whether or not sensitive information about oneself will be disclosed to others.”159Rasmussen v. S. Fla. Blood Serv., Inc., 500 So. 2d 533, 536 (Fla. 1987) (footnote omitted). Litigants have successfully argued for the privacy of blood donors’ identities,160See id. at 535, 537–38. financial records of taxpayers,161See Higgs v. Kampgrounds of Am., 526 So. 2d 980, 981 (Fla. Dist. Ct. App. 1988). employee records,162See CAC-Ramsay Health Plans, Inc. v. Johnson, 641 So. 2d 434, 435 (Fla. Dist. Ct. App. 1994). and other confidential materials like ethics committee records.163See Dade Cnty. Med. Ass’n v. Hlis, 372 So. 2d 117, 118 (Fla. Dist. Ct. App. 1979).
Colorado state courts restrict discovery on the basis of the federal constitution and have protected personnel files, computers, sexual history, tax returns, and financial records.164See Dist. Ct. v. Judd, 256 P.3d 687, 691 (Colo. 2011). Texas courts recognize privacy rights in discovery based on the federal and state constitutions, which protects medical records and personal records.165See In re Crestcare Nursing & Rehab. Ctr., 222 S.W.3d 68, 72–73 (Tex. App. 2006). Washington,166See T.S. v. Boy Scouts of Am., 138 P.3d 1053, 1058 (Wash. 2006) (holding that a higher showing must be made for discovery that implicates state constitutional right to privacy, although this right is distinguishable from a privilege). Alaska,167See State v. Doe, 378 P.3d 704, 705–06 (Alaska 2016) (concluding that the lower court erred in compelling disclosure of records regarding non-parties without balancing the interest in privacy rights against disclosure in an action against the state’s children’s services department for negligent placement with foster parent). and Montana168See City of Bozeman v. McCarthy, 447 P.3d. 1048, 1057 (Mont. 2019) (finding Montana’s constitutional right to privacy protects against disclosure of employment personnel records). also protect privacy based on their state constitutions.
a. Clear Relevancy Rather Than Mere Impeachment
Federal courts have developed balancing tests under Rule 26(c) in deciding whether to order discovery when requests implicate privacy interests described above.169See Battle v. District of Columbia, 303 F.R.D. 172, 173–74 (D.D.C. 2014) (balancing plaintiff’s need for discovery against defendant’s valid privacy concerns regarding intimate photographs); St. John v. Napolitano, 274 F.R.D. 12, 16 (D.D.C. 2011) (limiting disclosure of medical records in employment discrimination case, where burden and harm to privacy interests significantly outweighed any marginal relevance for majority of time period sought); Keith H. v. Long Beach Unified Sch. Dist., 228 F.R.D. 652, 657 (C.D. Cal. 2005) (“Resolution of a privacy objection . . . requires a balancing of the need for the information sought against the privacy right asserted.” (quoting Soto v. City of Concord, 162 F.R.D. 603, 616 (N.D. Cal. 1995))). Where discovery does implicate privacy, it will only be granted where there is compelling need and inability to obtain the discovery elsewhere.170See Aliotti v. Vessel Senora, 217 F.R.D. 496, 497–98 (N.D. Cal. 2003) (holding that while the plaintiff’s income tax returns “are clearly relevant under Fed. R. Civ. P. 26(b)(1) in order to properly assess lost earnings, maintenance, and cure, Defendant has not met its burden of establishing a compelling need” based on the existence of “less intrusive means by which Defendant can obtain the needed information which have not been exhausted”); Cooper v. Hallgarten & Co., 34 F.R.D. 482, 483–84 (S.D.N.Y. 1964) (requiring heightened showing of relevance and compelling need for production of tax returns). To overcome privacy interests, some courts require that the discovery be “clearly” relevant,171N.Y. Stock Exch., Inc. v. Sloan, No. 71CV2912, 1976 WL 169086, at *4–5 (S.D.N.Y. Oct. 21, 1976) (denying disclosure of employee records where party seeking them “failed to make the requisite showing of clear relevancy”). or that it go to the “heart of the case.”172See Richards of Rockford, Inc. v. Pac. Gas & Elec. Co., 71 F.R.D. 388, 390 (N.D. Cal. 1976) (finding plaintiff’s interest in discovery of confidential employee interviews outweighed by public interest in confidentiality, noting one factor in balancing between discovery and non-disclosure to be “whether the information sought goes to the heart of the claim”); Sneirson v. Chem. Bank, 108 F.R.D. 159, 161 (D. Del. 1985) (concluding that there is no right to privacy against bank records in a case where the bank records went to the very heart of the subject matter of the case); Stabilus, A Div. of Fichtel & Sachs Indus. v. Haynsworth, Baldwin, Johnson & Greaves, P.A., 144 F.R.D. 258, 267 (E.D. Pa. 1992) (declining discovery request for employment records where they were “not relevant to the main issue of the action”); Robinson v. Magovern, 83 F.R.D. 79, 89 (W.D. Pa. 1979) (finding that, even though the documents sought deserve protection, “the subject matter of the discovery goes to the heart of the issues in this case”).
On the other hand, courts often deny discovery where the requested information merely goes to impeachment.173See Aliotti, 217 F.R.D. at 498 (rejecting the argument that the defendant was entitled to the plaintiff’s tax returns for impeachment purposes, noting that courts have protected against discovery of “materials that are primarily of an impeaching character” (quoting Fed. R. Civ. P. 26 advisory committee’s note to 1970 amendment)); Hedenburg v. Aramark Am. Food Servs., No. C06-5267, 2007 WL 162716, at *2 (W.D. Wash. Jan. 17, 2007) (declining to allow search of plaintiff’s computer, noting “Defendant is hoping blindly to find something useful in its impeachment of the plaintiff”). The 1970 advisory committee note to Rule 26, referring to “broad powers o[f] the courts to regulate or prevent discovery,” noted that “the courts have in appropriate circumstances protected materials that are primarily of an impeaching character.”174Fed. R. Civ. P. 26 advisory committee’s note to 1970 amendment. In early cases, the party in possession of impeaching materials sometimes argued that they did not need to disclose those materials to the other party.175See Indus. Elec. Sales & Serv., Inc. v. Comm’r of Internal Revenue, 65 T.C. 844, 845 (1976). More commonly, parties have been successful in opposing discovery when the requesting party is seeking it for purposes of impeachment.176See Higgs v. Kampgrounds of Am., 526 So. 2d 980, 981–82 (Fla. Dist. Ct. App. 1988).
In one case arising out of questionable practices of a religious non-profit corporation, a defendant sought numerous documents from the plaintiff regarding examination of candidates for priesthood and correspondence with the local Archdiocese.177Coyne v. Houss, 584 F. Supp. 1105, 1106 (E.D.N.Y. 1984). The court noted that the information “is obviously intended for use in impeaching the credibility of the plaintiff,” and discussed case law regarding such discovery.178Id. While previous decisions questioned whether impeachment material was relevant to the action under Rule 26(b)(1),179Id. at 1106–07. the court found that it was a proper subject for discovery, albeit subject to protection as going to collateral matters.180Id. at 1107, 1109 (explaining how deposition examinations of a non-party witness “must be had on a matter relevant to the subject matter” because “collateral matters [do not come] within the scope of the rules” (quoting Lynch v. Pollak, Inc., 1 F.R.D. 120, 121 (S.D.N.Y. 1939))).
Another court noted that when a party seeks discovery of employee performance reviews, the party’s purpose made a difference in the determination of whether to order disclosure of such “sensitive and private information.”181SeeMulligan v. Provident Life & Accident Ins., 271 F.R.D. 584, 594 (E.D. Tenn. 2011). In the context of an Employee Retirement Income Security Act disability benefits case, where performance reviews are sought “as evidence of employee credibility, training or qualifications,” courts are less likely to allow discovery than if there is an allegation of historical bias.182See id. at 594 (“The Court is not inclined to allow the intrusive exploration of such collateral issues on the slight chance it might reveal some evidence of bias.”).
b. Evidentiary Influences
In balancing privacy against the need for discovery, courts have also been persuaded by policy represented in the Federal Rules of Evidence (“FRE”). In Cook v. Yellow Freight System, Inc.,183132 F.R.D. 548 (E.D. Cal. 1990). the court denied a request for the production of confidential settlement negotiations, in part based on the policy underlying FRE 408 that makes inadmissible evidence regarding offers of compromise in order to show liability.184Id. at 554 (“Evidence of (1) furnishing or offering or promising to furnish, or (2) accepting or offering or promising to accept, a valuable consideration in compromising or attempting to compromise a claim which was disputed as to either validity or amount, is not admissible to prove liability for or invalidity of the claim or its amount.” (quoting Fed. R. Evid. 408)). While FRE 408 is addressed to admissibility at trial rather than discoverability, the court found the same considerations applicable, including the public policy in favor of promoting voluntary resolution of disputes by respecting confidentiality of such discussions.185See id. at 554.
In Bottomly v. Leucadia National,186163 F.R.D. 617 (D. Utah 1995). the court denied discovery from a sexual harassment plaintiff where the request went to the plaintiff’s character under FRE 404187Id. at 620; see also Fed. R. Evid. 404. and would violate the prohibition on admission of evidence of victims’ sexual history under FRE 412.188Bottomly, 163 F.R.D. at 620; see also Fed. R. Evid. 412. The court found that the Rules of Evidence “are directly pertinent as to what matter is calculated to lead to admissible evidence,” and that, under FRE 404, “matter that is not related to causation and extent of damage, but which merely goes to plaintiff’s character is outside of proper bounds of discovery.”189See Bottomly, 163 F.R.D. at 619–20; see also Fed. R. Evid. 404. Other courts have also limited discovery requests that would violate the restriction on use of evidence of other sexual relations embodied in FRE 412.190See e.g., Coates v. Mystic Blue Cruises Inc., No. 11 C 1986, 2012 WL 3860036, at *1–2 (N.D. Ill. Aug. 9, 2012); see also Fed. R. Evid. 412.
c. Third Party Protection
Finally, many courts provide special protection when discovery requests implicate the privacy of third parties.191See Slate v. Am. Broad. Cos., 802 F. Supp. 2d 22, 26–27 (D.D.C. 2011) (noting that some of the files at issue contained confidential and personal information of unrepresented non-parties), aff’d, 584 Fed. App’x 2 (D.C. Cir. 2014); see also Finkle v. Howard Cnty., No. SAG-13-3236, 2014 WL 6835628, at *1–2 (D. Md. Dec. 2, 2014) (denying “unfettered ‘fishing expedition’ into the personal communications of non-party employees”). The Supreme Court in Seattle Times noted the need for protecting against discovery abuse that could harm privacy interests of third parties.192See Seattle Times Co. v. Rhinehart, 467 U.S. 20, 35 (1984) (“The Rules do not distinguish between public and private information. Nor do they apply only to parties to the litigation, as relevant information in the hands of third parties may be subject to discovery.”). So even when a plaintiff’s rights in her sexual history are outweighed by the defendant’s right to discovery, the court may limit that discovery to protect the identity of third party sexual partners.193See Allen v. G.D. Searle & Co., 122 F.R.D. 580, 582 (D. Or. 1988). Third party financial records are given greater protection,194See Hecht v. Pro-Football, Inc., 46 F.R.D. 605, 607 (D.D.C. 1969). as are files concerning non-party students.195See Lora v. Bd. of Educ., 74 F.R.D. 565, 567, 570, 572 (E.D.N.Y. 1977) (explaining that diagnostic and evaluation files of non-party students are afforded greater constitutional privacy rights). Courts also protect the identity of non-parties from counsel seeking class members.196See Bryant v. City of New York, No. 99CIV11237, 2000 WL 1877082, at *2–4 (S.D.N.Y. Dec. 27, 2000); see also Jeff Kosseff, The Elusive Value: Protecting Privacy During Class Action Discovery, 97 Geo. L.J. 289, 321 (2008).
d. Protective Measures
Courts have broad discretion under Rule 26(c) in making determinations regarding discovery that implicates privacy.197Fed. R. Civ. P. 26 advisory committee’s note to 1993 amendments (adding “the burden or expense of the proposed discovery outweighs its likely benefit,” to the rule with the intention “to provide the court with broader discretion to impose additional restrictions on the scope and extent of discovery”); see also Cook v. Yellow Freight Sys., Inc., 132 F.R.D. 548, 552 (E.D. Cal. 1990) (noting the court’s “broad discretionary powers to fashion discovery in a manner that is suitable to the actions before it”). Courts may find that discovery should be denied completely.198See Cockrum v. Johnson, 917 F. Supp. 479, 483 (E.D. Tex. 1996) (finding that plaintiff’s privacy interest in letters he wrote to his daughter while in prison outweighed the state’s need for them, and “only an order preventing discovery altogether will adequately protect the privacy interests of [the plaintiff]”). Alternatively, courts may also fashion protective orders,199See Stormans, Inc. v. Selecky, 251 F.R.D. 573, 576–77 (W.D. Wash. 2008) (protecting against disclosure of identities of pharmacies refusing to sell Plan B, considering seven factors in weighing privacy interests against public interest in disclosure). order redactions of personally identifiable or private information,200Mehl v. Blanas, 241 F.R.D. 653, 656–58 (E.D. Cal. 2007) (requiring removal of “home address, home telephone number, Social security number and other sensitive information of persons who are or have been judges, district attorneys, peace officers, or other persons employed in the criminal justice system”). order a phased discovery process,201SeeMulligan v. Provident Life & Accident Ins., 271 F.R.D. 584, 594 (E.D. Tenn. 2011) (noting that many courts utilize a phased discovery process, only allowing discovery of performance reviews where other discovery suggests bias). or view potential discovery in camera before allowing disclosure.202See Boudreaux v. United States, No. Civ.A.97-1592, 1999 WL 499911, at *2 (E.D. La. July 14, 1999) (ordering documents produced in camera so the court could determine legitimacy of its objections to disclosure based on the Privacy Act); Taylor v. Altoona Area Sch. Dist., No. 05-CV-350, 2008 WL 11511749, at *2 (W.D. Pa. Oct. 10, 2008) (ordering an in camera inspection of medical records, upon which the court “will determine which information should be turned over to Defendant, and which information should remain secret in deference to the weight[y] privacy concerns of the Plaintiff”). The flexibility of these measures lends itself to the ever-evolving technology that has changed the face of discovery.
II. Privacy in Modern Discovery
This Part traces the principles of privacy just discussed into the current era of discovery. Section A focuses on changes to discovery across the 2006 and 2015 Amendments to the Rules and how they apply to cell phones, social media, fitness tackers, and other internet-based technologies. Section B explains the Fourth Amendment case law surrounding the constitutional right to privacy over one’s digital life, which has shaped how courts address similar privacy questions in discovery proceedings. Section C applies these principles more precisely to modern discovery requests. Ultimately, courts should be more protective of requested material when those requests concern personal, intimate matters, require a higher showing of relevance for that information, and apply the mosaic theory of privacy to limit requests of broad, aggregate sets of data.
A. Discovery Today
Discovery in both federal and state courts faced a sea change203See Fed. R. Civ. P. 26 advisory committee’s note to 2015 amendment (“What seemed an explosion in 1993 has been exacerbated by the advent of e-discovery.”). with the advent of electronically stored information (“ESI”).204Scheindlin & Capra, supra note 6, at 51 (“‘E-discovery’ is simply the discovery of information and data that is stored electronically, including email, instant messages, social networking content, and any other electronic information that may be stored on desktops, laptops, file servers, mainframes, smart phones, home computers, in the cloud, or on a variety of other platforms (commonly referred to collectively as electronically stored information, or ‘ESI’).”). The focus of civil discovery first changed with the proliferation of email in the 1990s.205See Marcus, supra note 6, at 9. In the Zubulake line of cases, Judge Scheindlin in the Southern District of New York addressed this issue in a systemized manner, delineating the obligations of counsel and litigants as to preservation and issuance of a litigation hold;206Zubulake v. UBS Warburg LLC (Zubulake V), 229 F.R.D. 422, 432–34 (S.D.N.Y. 2004); Zubulake v. UBS Warburg LLC (Zubulake IV), 220 F.R.D. 212, 216–18 (S.D.N.Y. 2003). readily accessible ESI and form of production;207Zubulake v. UBS Warburg LLC (Zubulake III), 216 F.R.D. 280, 284–89 (S.D.N.Y. 2003); Zubulake v. UBS Warburg LLC (Zubulake I), 217 F.R.D. 309, 316–23 (S.D.N.Y. 2003). spoliation of ESI;208Zubulake V, 229 F.R.D. at 430–31. and sanctions for abuse.209Id. at 436–38; Zubulake IV, 220 F.R.D. at 219–21. In the meantime, the Sedona Conference was bringing together judges, scholars and practitioners to best address the wave of ESI.210The Sedona Conference, founded by Richard Braman in 1997, is a nonprofit research and educational institute with a mission “to move the law forward in a reasoned and just way through the creation and publication of nonpartisan consensus commentaries and through advanced legal education for the bench and bar.” Sedona Conference, https://perma.cc/WG35-DN7U. This, along with five years of study by the Civil Rules Advisory Committee (“Advisory Committee”), led to changes in the Rules in 2006 that “recognize some fundamental differences between paper-based document discovery and the discovery of [ESI, and] continue a trend . . . since the 1980’s of expanding the role of judges in actively managing discovery to sharpen its focus, relieve its burdens, and reduce costs on litigants and the judicial system.”211Withers, supra note 8, at 2.
After those changes, complaints about ESI persisted, leading the Advisory Committee to convene a conference in 2010 (“the Duke Conference”).212See Marcus, supra note 6, at 18. A subcommittee from that event summarized the complaints:
[S]erious, even grave problems persist in enough cases to generate compelling calls for further attempts to control excessive discovery. The geometric growth in potentially discoverable information generated by electronic storage adds still more imperative concerns.213Advisory Committee on Civil Rules, Report to the Standing Committee, in Committee on Rules of Practice and Procedure 226 (2013), https://perma.cc/UVY8-HEK3.
The Duke Conference, including judges, lawyers and academics, came to the conclusion that the system should be improved in four areas: “increased cooperation among litigants during the pretrial process; greater proportionality in discovery; earlier and more active management of cases by judges; and improved guidance on the preservation and loss of [ESI].”214Fed. Jud. Ctr., Amendments to the Federal Rules of Practice and Procedure: Civil Rules 2015—Overview (Video Transcript) (2015), https://perma.cc/P5RD-ZGNN. This resulted in Rules amendments in 2015 to address these four areas.
Proportionality has been a part of the Rules since 1983, when Rule 26(b) first required that courts consider whether “the discovery sought [was] unreasonably cumulative or duplicative” and whether “the discovery [was] unduly burdensome or expensive, taking into account the needs of the case, the amount in controversy, limitations on the parties’ resources, and the importance of the issues at stake in the litigation.”215Fed. R. Civ. P. 26(b)(1); see also Keeling & Mangum, supra note 10, at 418. In 1993, two additional proportionality factors were added, regarding burden or expense and importance of the proposed discovery.216Fed. R. Civ. P. 26(b) advisory committee’s note to 2015 amendment. But that same amendment divided the proportionality factors into a separate section of Rule 26(b), lending the impression that they were separate limitations on discovery, to be considered apart from the primary rule governing scope.217See Keeling & Mangum, supra note 10, at 420. This was remedied in 2015, when the Rules were again revised to put proportionality back in prominence as an element of scope under 26(b). The current version of the Rule provides for three threshold elements of scope:
Parties may obtain discovery regarding any [(1)] nonprivileged matter that is [(2)] relevant to any party’s claim or defense and [(3)] proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit. Information within this scope of discovery need not be admissible in evidence to be discoverable.218Fed. R. Civ. P. 26(b) (emphases added).
While the Rules revisions generally addressed the tremendous rise in ESI volume and costs with emphasis on judicial intervention, cooperation, and reduction in scope, they did not give specific attention to issues of privacy.219See Keeling & Mangum, supra note 10, at 423 (noting that “early discussion of the proportionality factors focused primarily on economic factors” with surprisingly “little mention of privacy interests”); Commentary, The Sedona Conference Commentary on Proportionality in Electronic Discovery, 14 Sedona Conf. J. 155, 166–67 (2013) (“In civil actions that are essentially private disputes (such as most breach of contract or traditional tort actions), nonmonetary factors are usually irrelevant.”). However, as discovery’s intrusiveness has pervaded not just vast storage databases and email but chronicles of individuals’ personal lives, privacy has received more attention. Commentators have advocated for privacy to be a factor in the proportionality equation,220See Keeling & Mangum, supra note 10, at 426–27 (“With the re-emphasis on proportionality brought about by the 2015 amendments and the growing public debate over the importance of privacy . . . there has been a clear trend by courts and commentators toward recognition of privacy interests as an integral part of the proportionality analysis required by Rule 26(b)(1).”); McPeak, supra note 10, at 75 (“[T]he rules’ emphasis on proportionality should encompass non-pecuniary burdens imposed by broad discovery, including the burdens on individual privacy rights.” (footnote omitted)); Stuart, supra note 10, at 171–72 (noting that the new proportionality rules could protect privacy as a burden to be considered under Rule 26(b)(1)). and courts have followed suit.221See Henson v. Turn, Inc., No. 15-CV-01497, 2018 WL 5281629, at *5–6 (N.D. Cal. Oct. 22, 2018) (discussing privacy and proportionality in the context of a request for inspection of a mobile phone); Gordon v. T.G.R. Logistics, Inc., 321 F.R.D. 401 (D. Wyo. 2017) (finding social media discovery requests implicate privacy interests and require consideration of proportionality); In re Xarelto (Rivaroxaban) Prods. Liab. Litig., 313 F.R.D. 32, 36 (E.D. La. 2016) (finding that the plaintiff cannot discover a non-party employee’s personnel file “without an individualized showing of relevancy, proportionality, and particularity”). Privacy has also featured prominently in recent Fourth Amendment case law, which has in turn influenced discovery decisions.
As in the slip and fall case discussed in the Introduction, modern discovery goes far beyond what we consider typical documents and communications. Litigants increasingly focus on sources of discovery that have the capacity to reveal a great deal of information, much of it highly personal. This Section discusses current case law involving privacy of some common types of modern discovery.
a. Cell Phones
As the Supreme Court has recognized, cell phones are ubiquitous.222See United States v. Jones, 565 U.S. 400, 428 (2012) (Alito, J., concurring in the judgment); see also infra Section II.B. The Court in Riley was faced with evidence from both a “smart phone” (“a cell phone with a broad range of other functions based on advanced computing capability, large storage capacity, and Internet connectivity”), Riley v. California, 573 U.S. 373, 379 (2014), and a “flip phone” (“a kind of phone that is flipped open for use and that generally has a smaller range of features than a smart phone”), id. at 380. This discussion is applicable to cell phones in general, although much of the technology is currently available only with a smart phone. Courts find a strong privacy interest in the content of those devices, particular when a party seeks a forensic examination of the phone.223See John v. Goetz, 531 F.3d 448, 459–60 (6th Cir. 2008) (citing cases and concluding that the “compelled forensic imaging orders here fail[ed] to account properly for . . . significant privacy and confidentiality concerns”); Hespe v. City of Chicago, No. 13 C 7998, 2016 WL 7240754, at *4 (N.D. Ill. Dec. 15, 2016) (“Numerous courts have also recognized this need to ‘guard against undue intrusiveness’ and to be ‘cautious in requiring’ the forensic inspection of electronic devices, in order to protect privacy interests.”). Like inspection of litigants’ hard drives and other computer systems,224See In re Anthem, Inc. Data Breach Litig., No. 15-md-02617, 2016 WL 11505231, at *1 (N.D. Cal. Apr. 8, 2016) (finding in claim arising out of a cyberattack that request for access to all plaintiffs’ computer systems that connect to the internet is not proportional and that “the burden of providing access to each plaintiff’s computer system greatly outweighs its likely benefit”); Kickapoo Tribe of Indians v. Nemaha Brown Watershed Joint Dist. No. 7, 294 F.R.D. 610, 619 (D. Kan. 2013) (denying the request for forensic mirror imaging of computers and other electronic devices personally owned by current and former District Board members, employees, and staff because of “significant concerns regarding the intrusiveness of the request and the privacy rights of the individuals to be affected”). inspection of cell phones implicates privacy rights, privileged communications, and non-relevant information.225See Bratcher v. Navient Sols., Inc., 249 F. Supp. 3d 1283, 1285–86 (M.D. Fla. 2017) (denying production of consumer’s cell phone for inspection, on basis that information in call-blocking application on phone was allegedly responsive to discovery request seeking summary of events related to action); Hiscox Dedicated Corp. Member v. Matrix Grp. Ltd., Inc., No. 09-CV-2465-T-33, 2011 WL 13150168, at *2 (M.D. Fla. June 14, 2011) (“[T]here is no ‘routine right of direct access to a party’s electronic information system.’ . . . The Eleventh Circuit has held that absent ‘a factual finding of some non-compliance with [the] discovery rules,’ direct access is unwarranted.” (first quoting Fed. R. Civ. P. 34 advisory committee’s notes to 2006 amendments; then quoting In re Ford Motor Co., 345 F.3d 1315, 1317 (11th Cir. 2003))). Courts are therefore reluctant to order litigants to submit their cell phones to their opponent for purposes of forensic examination absent necessity for purposes of finding highly relevant evidence, or proof of spoliation.226See In re Apple Inc. Device Performance Litig., No. 18-md-02827, 2019 WL 3973752, at *2–4 (N.D. Cal. Aug. 22, 2019) (upholding order authorizing forensic imaging of devices in order to allow outside experts to performance-test the devices pursuant to strict privacy protocol, noting that plaintiffs put their devices at issue when they chose to sue Apple over intrusion and trespass to devices because of software updates, and the interest in forensic performance testing outweighed their significant privacy interests in their devices); Hespe, 2016 WL 7240754, at *5 (declining to order forensic examination of plaintiff’s electronic devices in sexual discrimination case where the request to search plaintiff’s devices was “a ‘blind’ attempt to ‘find something useful [for their] impeachment of the plaintiff’ [rather than] a request to search devices that have been shown to contain information going to ‘the heart of the case’” (quoting Hedenburg v. Aramark Am. Food Servs., No. C06-5267, 2007 WL 162716, at *2 (W.D. Wash. Jan. 17, 2007))); A.M. Castle & Co. v. Byrne, 123 F. Supp. 3d 895, 900–01 (S.D. Tex. 2015). Courts also find a strong privacy interest in cell phone records.227See Smith v. Pefanis, No. 08-CV-1042, 2008 WL 11333335, at *3 (N.D. Ga. Oct. 30, 2008) (quashing subpoena seeking plaintiff’s cell phone records, noting that “[w]hile defendants may be able to establish the relevance of some of plaintiff’s phone records, they have not shown any reason that they should be granted unrestricted access to plaintiff’s entire personal cell phone records during the time period specified in the subpoena”); Sovereign Partners Ltd. v. Rest. Teams Int’l, Inc., No. 99 Civ. 0564, 1999 WL 993678, at *4 (S.D.N.Y. Nov. 2, 1999) (“The fact that the telephone records contain relevant information and are not privileged does not mean, however, that they are subject to unlimited discovery. The records undoubtedly include substantial data not pertinent to any aspect of this litigation, including information about personal phone calls . . . . This raises significant privacy concerns.”). Courts have been strongly persuaded by recent Supreme Court Fourth Amendment doctrine in finding privacy rights in this data.228See infra Section II.C.2.
b. Social Media
Social media use has grown from 5% of American adult users in 2005 to 72% in 2021.229Woodrow Hartzog has defined social media as “any digital communication technology utilizing the Internet to connect people for social reasons.” Woodrow Hartzog, Social Data, 74 Ohio St. L.J. 995, 996 (2013). By far the most prominent social media site in the United States, and in litigation disputes, is Facebook. Social Media Fact Sheet, Pew Rsch. Ctr. (Apr. 7, 2021), https://perma.cc/UW96-DAE8. The nature of social media, including the candid quality of comments and photographs, make it catnip for all sorts of litigants,230Richard Marcus noted two indications of the importance of Facebook to divorce law, a 2011 New York Times story called “Divorce Lawyers’ New Friend: Social Networks,” and a 2014 Doonesbury cartoon in which Mark Zuckerberg is pictured as saying, “Did you know that in addition to all its other great uses, Facebook is now cited in over a third of all divorce filings?” Marcus, supra note 6, at 2. particularly defendants seeking to impeach the credibility of injured plaintiffs.231See Stuart, supra note 10, at 152–53.
Courts apply traditional discovery rules to the social media context, while noting the challenge of a medium both public and private.232See Appler v. Mead Johnson & Co., No. 14-CV-166, 2015 WL 5615038, at *2–3 (S.D. Ind. Sept. 24, 2015) (noting the “unique challenge” posed by social media content “due to its relative novelty and their ability to be shared by someone besides the original poster, and the multifarious privacy settings that may be constructed to allow specifically limited viewing,” but applying traditional discovery rules, including the requirement that requests be “narrowly tailored enough to pass muster”); Tompkins v. Detroit Metro. Airport, 278 F.R.D. 387, 388 (E.D. Mich. 2012) (“I agree that material posted on a ‘private’ Facebook page, that is accessible to a selected group of recipients but not available for viewing by the general public, is generally not privileged, nor is it protected by common law or civil law notions of privacy.”). Broad requests for social media content implicate privacy concerns because people often share “the most intimate of personal details on a host of matters, many of which may be entirely unrelated to issues in specific litigation.”233Landau v. Lamas, No. 15-CV-1327, 2017 U.S. Dist. LEXIS 206158, at *13. (M.D. Pa. Dec. 15, 2017). For that reason, courts have granted tailored requests for relevant social media content, but deny requests for a litigant’s entire social media over a period of time.234See Gordon v. T.G.R. Logistics, Inc., 321 F.R.D. 401, 405–06 (D. Wyo. 2017) (denying request for motorist’s entire social media communication for three years prior to date of accident, but ordering production of all relevant social media subsequent to accident); Tucker v. Momentive Performance Materials USA, Inc., No. 13-CV-04480, 2016 WL 8252929, at *5–7 (S.D. W. Va. Nov. 23, 2016); Appler, 2015 WL 5615038, at *1–3 (while interrogatories seeking SNS content specifically involving defendant and its employees satisfied that test, the request for production of “all online profiles, postings, messages . . . and [other] online communications that refer or relate to” the allegations in the complaint or the answer, that “reveal, refer or relate to any emotion, feeling or mental state in the last five (5) years[,] or . . . events that could reasonably be expected to produce [such a state],” was “extremely vague and broad”); Palma v. Metro PCS Wireless, Inc., 18 F. Supp. 3d 1346, 1347 (M.D. Fla. 2014) (denying as overbroad a request for discovery of all posts to current and former employees’ social media accounts relating to issues in Fair Labor Standards Act action brought by employees; although social media content was generally neither privileged nor protected by right to privacy, employer did not have generalized right to “rummage at will” through information employees limited from public view (quoting Davenport v. State Farm Mut. Auto. Ins., No. 11-CV-632-J, 2012 WL 555759, at *2 (M.D. Fla. Feb. 21, 2012))). Many courts have required a “threshold showing” that social media content available to the public is inconsistent with a litigant’s claims of injury or otherwise before allowing broader discovery into non-public content.235See Potts v. Dollar Tree Stores, Inc., No. 11-CV-01180, 2013 WL 1176504, at *3 (M.D. Tenn. Mar. 20, 2013) (denying request for Facebook and other social media data, noting cases requiring a “threshold showing that the requested [Facebook] information is reasonably calculated to lead to the discovery of admissible evidence,” and finding no such “evidentiary showing that Plaintiff’s public Facebook profile contains information that will reasonably lead to the discovery of admissible evidence”); Tompkins, 278 F.R.D. at 388 (“[C]onsistent with Rule 26(b) and with [previous case law], there must be a threshold showing that the requested information is reasonably calculated to lead to the discovery of admissible evidence. Otherwise, the Defendant would be allowed to engage in the proverbial fishing expedition, in the hope that there might be something of relevance in Plaintiff’s Facebook account.”). But see Stuart, supra note 10, at 159–60 (criticizing threshold requirement as both under and over inclusive). Courts also limit such discovery to the extent it pertains to highly personal and intrusive matters like sexual content.236See Landau, 2017 U.S. Dist. LEXIS 206158, at *23 (finding scope of prisoner’s request for social media content from guards, “which would allow the plaintiff to indulge in some search of social media over a span of many months for evidence of sexual self-portraiture, would be overly broad, disproportionate, and particularly intrusive of personal privacy”); see also Spoljaric v. Savarese, 608838-2017, 2020 WL 611911, at *1–3 (N.Y. Sup. Ct. Jan. 28, 2020) (balancing potential utility of information against the privacy rights of plaintiff in request for photographs from “dating sites” Bumble and Okcupid, noting that the court would “tailor its order to avoid release of embarrassing material of limited relevancy, especially those of a romantic nature”). They also exclude from discovery certain categories of personal information included in social media profiles, like “Religious Views.”237Appler, 2015 WL 5615038, at *6 (allowing discovery of Facebook profile information with certain categories to be excluded, including “Credit Cards, Facial Recognition Data, IP Addresses, Phone Numbers, Family, and Religious Views”).
In one case, Coates v. Mystic Blue Cruises, Inc.,238No. 11 C 1986, 2012 WL 3860036 (N.D. Ill. Aug. 9, 2012). the plaintiff in a sexual harassment suit objected to producing Facebook messages that revealed intimate conversations between her and other employees.239Id. at *1. The District Court for the Northern District of Illinois found the point well-taken, as the advisory committee notes state that “[c]ourts should presumptively issue protective orders barring discovery unless the party seeking discovery makes a showing that the evidence sought to be discovered would be relevant under the facts and theories of the particular case, and cannot be obtained except through discovery.”240Id. at *2 (quoting Fed. R. Evid. 412 advisory committee’s notes to 1994 amendments). The court noted that the evidence could only have a slight bearing on the events at issue and allowed only limited discovery at that time.241Id.; see also T.C. ex rel. S.C. v. Metro. Gov’t of Nashville, No. 17-CV-01098, 2018 WL 3348728, at *8–10 (M.D. Tenn. July 9, 2018) (citing FRE 412 in denying discovery of minor plaintiffs’ sexual histories).
c. Fitbits and Other Smart Trackers
Third, the rise in the use of personal activity devices242Variously described as smart trackers, personal activity trackers, or “wearables,” these devices all use biometric technology and sensors to records their wearer’s activity. Scott Peppet describes the array of wearable sensors from electronic pedometers to sensor-laden clothing. Scott R. Peppet, Regulating the Internet of Things: First Steps Toward Managing Discrimination, Privacy, Security, and Consent, 93 Tex. L. Rev. 85, 101–02 (2014). The devices can track not only steps but sleep, heart rate, breathing patterns, skin temperature and types of athletic activity. Id. has created a new category of discovery.243See Clint Cowan, Jr., Wearable Technology Discovery in Personal Injury Cases: How Data From a Plaintiff’s Wrist Can Make a Difference in the Courtroom, Pro Te: Solutio, Spring 2017, at 26, available at https://perma.cc/T8RB-7JDU (“The use of fitness tracker data in personal injury litigation is obvious: A plaintiff claiming injury could have his claim undermined by Fitbit® data showing that he ran his customary four-mile jog, even after his alleged back injury. The wearable device compiles an extensive track record of objective data entries that can be used to undermine a claimant’s case.”); Bryan C. Garcia, Big Data on the Open Road: How the Amended Rules of Civil Procedure Will Affect Transportation Industry ESI Discovery in Federal Courts, For the Defense, December 2016, at 67, 68–69 (2016) (“[T]he defense lawyer should investigate whether a driver wore a biometric recording device, particularly when the driver’s health is potentially an issue.”); Mark Gerano, Using Data from Wearable Devices in Litigation, JD Supra (Feb. 19, 2020), https://perma.cc/65LK-ZUTD (“One does not have to look far to find examples of situations where such data could be useful to attorneys litigating a case. For instance, location data from a wearable could be used to prove when employees arrive at or leave work. Health and exercise data from a wearable could be used to show that a personal injury plaintiff is not as severely injured as the plaintiff suggests.”). Information from such devices is now a regular part of form interrogatories and document requests.244See Michael W. Rabb, A ‘Black Box’ for the Human Body, Gallivan White Boyd, https://perma.cc/6R58-KFCM (advocating “sending written discovery requests seeking detailed information on any wearable devices used or in use as well as the production of data from those devices”); Meghan A. Rigney, “Steps” for Discovery: Subpoenaing Wearable Technology Data, ABA: Prac. Points (May 14, 2019), available at https://perma.cc/YLF9-NXWJ (“Litigators need to be mindful that these [wearable health monitors] can also serve as a powerful discovery tool that should not be overlooked.”). Like social media, such trackers may contain evidence that is helpful in impeaching the credibility of plaintiffs claiming to be limited in movement.245At least one plaintiff has used this information as support for her own case. In Canada, a plaintiff’s Fitbit data was introduced to support her claim that an injury caused her active lifestyle to deteriorate below average. Parmy Olson, Fitbit Data Now Being Used in the Courtroom, Forbes (Nov. 16, 2014, 4:10 PM), https://perma.cc/KA3Q-NQKY. Information from such devices has assisted law enforcement in criminal investigations.246Fitbit data that a woman was awake and walking around in the evening contradicted her allegations of being asleep in bed and then raped, leading to misdemeanor charges against her. Kashmir Hill, Fitbit Data Just Undermined a Woman’s Rape Claim, FUSION (June 29, 2015, 2:57 PM), https://perma.cc/2J6W-BYAT.
In the few reported cases that have considered requests for smart tracker information, courts have attempted to balance requests for relevant evidence against overbroad fishing expeditions. In Bartis v. Biomet, Inc.,247No. 13-CV-00657, 2021 WL 2092785 (E.D. Mo. May 24, 2021). a case out of the Eastern District of Missouri, plaintiff Hollins was one of many who sued a manufacturer of artificial hips, alleging substantial injuries from implantation of the device, including pain and lack of mobility.248Id. at *1. After Hollins admitted in discovery that he consistently wears a Fitbit which tracks his steps, defendants requested production of all data from the Fitbit and any other wearable device.249Id. Noting the “surprisingly little precedent on this issue given the ubiquitous presence of wearable devices,”250Id. at *2. the court considered the relevance of the data regarding Hollins’ activity levels compared to the “extremely low burden of production.”251Id. Also relevant was the fact that Hollins had been inconsistent as to whether he had difficulty walking.252Id. In all, “[c]onsidering the liberal discovery rules, minimal burden of production, and limited privacy risks,”253Bartis, 2021 WL 2092785, at *2. Notably, the court allowed Hollins to “redact any information concerning his heart rate, sleep records, or physical location as such information is entirely irrelevant [to this litigation] and raises privacy concerns.” Id. at *3. the court found in favor of production of a portion of the Fitbit data:
A plaintiff’s wearing of an activity tracker like a Fitbit does not warrant a fishing expedition into the data from such device. But in this case, the extent of Hollins’ physical activity is relevant to his claims of long-term physical injury. Hollins broadly alleges that he suffers long-term pain and lack of physical mobility due to the allegedly defective hip implant. Hollins’ supposed ability to walk or jog short distances without discomfort does not render the Fitbit data completely irrelevant, as the data could reveal that Hollins is walking or jogging substantial distances.254Id. at *2 (citation omitted) (ordering all data, including step counts, from his Fitbit from the time he began wearing the device through the present date, but allowing redaction of heart rate, sleep records, or location information).
In contrast, a New York state court denied a request for Fitbit data from a plaintiff who claimed injuries arising out of a motor vehicle accident resulting in impairment of quality of life and ability to enjoy leisure activities.255Spoljaric v. Savarese, No. 608838-2017, 2020 WL 611911 (N.Y. Sup. Ct. Jan. 28, 2020). The defendant sought all data pertaining to the plaintiff’s Fitbit device, in addition to all photographs the plaintiff had posted to social media since the accident. While authorizing some of the discovery, the court denied the request for plaintiff’s Fitbit records, as defendant “failed to meet the threshold standard that such disclosure was reasonably calculated to yield information material and necessary to her defense.”256Id. at *3. While defendant justified the request based on deposition testimony from the plaintiff that he had lost weight since the accident, plaintiff had also testified that he very rarely checked his Fitbit: “As diet, not just exercise, is a more important component of weight loss, this argument had little ‘weight.’ On this record, it appeared to the court that this request was merely an overly broad ‘fishing expedition,’ not based upon any supportable evidence.”257Id.
d. Other Discovery from the Internet of Things
Wearables like Fitbit are only one category of the immense market known as the Internet of Things (“IoT”).258The term “Internet of Things” is attributed to the technologist Kevin Ashton, who in 1998 referred to the addition of radio-frequency identification and sensors to everyday objects as the creation of an “Internet of Things.” Kevin Ashton, That ‘Internet of Things’ Thing, RFID J. (June 22, 2009), https://perma.cc/NL6C-WNHD; see also Andrew Guthrie Ferguson, The Internet of Things and the Fourth Amendment of Effects, 104 Calif. L. Rev. 805, 813–18 (2016) (discussing the history of the Internet of Things from the use of RFID tags to wireless sensor networks to cellular, Wi-Fi and other data networks). Researchers expect the number of IoT devices in 2021 to reach 46 billion, a 200% increase compared to 2016.259Nick Galov, How Many IoT Devices Are There in 2021? [All You Need to Know], TechJury (Jan. 4, 2022), https://perma.cc/9UZ4-H96H. The total number of IoT connections will reach 83 billion by 2024.260IoT Connections to Reach 83 Billion by 2024, Driven by Maturing Industrial Use Cases, Juniper Rsch. (Mar. 31, 2020), https://perma.cc/9SBH-GBZC. Experts predict that by 2025 we will have an “Internet of Medical Things” with sensors and devices for patient health monitoring and a “flying Internet of Things” with drones in wide use for surveillance, exploration and delivery tasks.261Janna Anderson, Lee Rainie & Emily A. Vogels, Experts Say the ‘New Normal’ In 2025 Will be Far More Tech-Driven, Presenting More Big Challenges, Pew Rsch. Ctr. (Feb. 18, 2021), https://perma.cc/7AQW-5WHD.
Law enforcement have used data from the wider IoT to help with their investigations. They have sought data from smart speakers to recreate a crime scene,262In Arkansas, police issued a warrant to Amazon for audio recordings and transcripts of communications between a murder suspect’s Echo device and Amazon’s Alexa Voice Service. See Sylvia Sui, State v. Bates: Amazon Argues that the First Amendment Protects Its Alexa Voice Service, Harv. J.L. & Tech. Digest (Mar. 25, 2017), https://perma.cc/U8EC-YLJ4. and have used alarm systems263David Owens, Judge Allows Fitbit Evidence into Richard Dabate Murder Trial, Denies Request to Move Trial or Bar Ellington Residents from Jury, Hartford Courant (Jan. 27, 2020), https://perma.cc/W5XS-JVCC (noting evidence from wife’s Fitbit and from the alarm system in couple’s house contradicted husband’s story about the circumstances of her death, leading to his charges for her murder) . and pacemakers264Data that police obtained from an Ohio man’s pacemaker in February 2017 contradicted his claim to have been sleeping at the time a fire was set in his house, leading to charges against him for arson and insurance fraud. See John G. Browning & Lisa Angelo, Alexa, Testify: New Sources of Evidence from the Internet of Things, 82 Tex. Bar J. 506, 506 (2019). to confirm the veracity of a suspect’s story.265In Australia, a murder victim’s Apple watch helped investigators point the finger at her daughter-in-law, whose story about a group of men invading the home and attacking her did not line up with the activity and heart rate information on the watch. Rhett Jones, Apple Watch Health Data Is Being Used as Evidence in an Australian Murder Trial, Gizmodo (Apr. 2, 2018, 5:45 PM), https://perma.cc/ZAK3-GQ6G. It is only a matter of time before the explosion in IoT devices leads to regular civil discovery into smart speakers, smart home alarm systems, and smart home health monitors. Civil defense lawyers already tout the importance of discovery into virtual assistants like Alexa and Siri and have added to draft interrogatories questions about the existence of such devices.266Robert D. Lang & Lenore E. Benessere, Alexa, Siri, Bixby, Google’s Assistant, and Cortana Testifying in Court, 74 J. Mo. Bar 20, 21 (2018) (“It cannot be overstated how valuable this [virtual assistant] information can be to gain insight into a plaintiff’s everyday activities, which is often the essential element of most personal injury claims.”).
All of these subjects of modern discovery push the boundaries of privacy. Technology enables the gathering and storage of vast amounts of information that create digital chronicles of individuals’ personal lives. This phenomenon has been the focus of recent Supreme Court decisions in the Fourth Amendment context.
B. Supreme Court Case Law on Privacy and Technology
Under the discovery rules, there is no concept of “reasonable expectation of privacy.”267See United States v. Bell, 217 F.R.D. 335, 343 (M.D. Pa. 2003) (rejecting a Fourth Amendment argument against compelled disclosure, noting that “[t]here is no ‘right of privacy’ privilege against discovery in civil cases”). A diary entry is perfectly discoverable if it is relevant.268See DeVeaux, supra note 10, at 1088–89, 1089 n.23 (listing cases where courts ordered production of diaries). A statement shouted from a rooftop is not discoverable if irrelevant. Instead, the rules speak in terms of privilege.269See Fed. R. Civ. P. 26(b). Federal courts recognize that privacy interests are implicated in the discovery rules and that courts should protect privacy interests as part of their issuance of protective orders,270Seattle Times Co. v. Rhinehart, 467 U.S. 20, 34–35 (1984) (“Because of the liberality of pretrial discovery permitted by Rule 26(b)(1), it is necessary for the trial court to have the authority to issue protective orders conferred by Rule 26(c). It is clear from experience that pretrial discovery by depositions and interrogatories has a significant potential for abuse. This abuse is not limited to matters of delay and expense; discovery also may seriously implicate privacy interests of litigants and third parties. The Rules do not distinguish between public and private information. Nor do they apply only to parties to the litigation, as relevant information in the hands of third parties may be subject to discovery.”); id. at 35 n.21 (“Rule 26(c) includes among its express purposes the protection of a ‘party or person from annoyance, embarrassment, oppression or undue burden or expense.’ Although the Rule contains no specific reference to privacy or to other rights or interests that may be implicated, such matters are implicit in the broad purpose and language of the Rule.”). but do not treat discovery as constrained by the Fourth Amendment. However, concepts of privacy have inevitably overlapped. Many courts refer to “expectations of privacy” in the context of civil discovery.271See DeVeaux, supra note 10, at 1083, 1097–101 (arguing that civil discovery rules compelling the production of private documents violate the Fourth Amendment); see also Jordana Cooper, Beyond Judicial Discretion: Toward A Rights-Based Theory of Civil Discovery and Protective Orders, 36 Rutgers L.J. 775, 780–81 (2005); Kosseff, supra note 196, at 321; Anna McMullen, Search, Seizure, and Snapchat: How the Fourth Amendment Fits Within the Evolving World of Civil E-Discovery, 26 Wm. & Mary Bill Rts. J. 187, 189 (2017) (advocating using Fourth Amendment precedent to analogize to civil litigants’ obligations to produce ESI).
In addition, recent Supreme Court cases construing the Fourth Amendment in the context of Global Positioning System (“GPS”) trackers and cell phone search and surveillance have influenced courts’ view of civil discovery as to those devices.272See Henson v. Turn, Inc., No. 15-CV-01497, 2018 WL 5281629, at *6 (N.D. Cal. Oct. 22, 2018); Bakhit v. Safety Marking, Inc., No. 13CV1049, 2014 WL 2916490 (D. Conn. June 26, 2014). These decisions have two broad implications for civil discovery. First, discovery as to devices with GPS technology and vast amounts of information, like cell phones, is fundamentally different from other kinds of discovery. Second, the view of privacy as vitiated by any third-party communication is outdated in today’s technology world.
In United States v. Jones,273565 U.S. 400 (2012). the Supreme Court found that the attachment of a GPS tracking device to an individual’s vehicle constituted a search within the meaning of the Fourth Amendment.274Id. at 404, 413. Justice Scalia’s opinion for the majority declined to decide whether the subsequent use of the GPS device to monitor the vehicle’s movements on public streets would alone have violated the Fourth Amendment in the absence of the physical trespass.275See id. at 412–13. In her concurrence, Justice Sotomayor made clear that she believed such surveillance to implicate Fourth Amendment concerns given its pervasive nature:
GPS monitoring generates a precise, comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations. . . .
. . . .
I would take these attributes of GPS monitoring into account when considering the existence of a reasonable societal expectation of privacy in the sum of one’s public movements. I would ask whether people reasonably expect that their movements will be recorded and aggregated in a manner that enables the government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on.276Id. at 415–16 (Sotomayor, J., concurring).
In addition, Justice Sotomayor expressed the view that previous Supreme Court precedent finding an individual has no reasonable expectation of privacy in information voluntarily conveyed to third parties, like bank records, is “ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.”277Id. at 417. She analogized to the intrusiveness of data concerning the web sites searched by an individual or purchases made online, and stated that “all information voluntarily disclosed to some member of the public for a limited purpose” should not, for that reason alone, be devoid of Fourth Amendment protection.278Id. at 418.
Two years later, in Riley v. California,279573 U.S. 373 (2014). the Court found that officers’ warrantless search of digital information on a suspect’s cell phone incident to an arrest was unreasonable under the Fourth Amendment.280Id. at 386. In distinguishing the search of a cell phone from a pat-down search for weapons or other personal property necessary to preserve as evidence, Chief Justice Roberts noted how different the cell phone is from any technology that was part of its previous Fourth Amendment jurisprudence, and adopted Justice Sotomayor’s reasoning in her Jones concurrence.281Id. at 385 (“[M]odern cell phones . . . are now such a pervasive and insistent part of daily life that the proverbial visitor from Mars might conclude they were an important feature of human anatomy. A smart phone of the sort taken from Riley was unheard of ten years ago; a significant majority of American adults now own such phones.”).
The Court noted that cell phones “are in fact minicomputers that also happen to have the capacity to be used as a telephone,” and also function as “cameras, video players, rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps, or newspapers.”282Id. at 393. The quantity of data capable of being stored on such devices is “immense,” with the average 16-gigabyte phone able to hold “millions of pages of text, thousands of pictures, or hundreds of videos.”283Id. at 393–95. The implications of this storage capacity are profound:
First, a cell phone collects in one place many distinct types of information—an address, a note, a prescription, a bank statement, a video—that reveal much more in combination than any isolated record. Second, a cell phone’s capacity allows even just one type of information to convey far more than previously possible. The sum of an individual’s private life can be reconstructed through a thousand photographs labeled with dates, locations, and descriptions; the same cannot be said of a photograph or two of loved ones tucked into a wallet. Third, the data on a phone can date back to the purchase of the phone, or even earlier. A person might carry in his pocket a slip of paper reminding him to call Mr. Jones; he would not carry a record of all his communications with Mr. Jones for the past several months, as would routinely be kept on a phone.284Id.
In addition to the quantity a cell phone is capable of storing, the quality of data that many users’ phones contain implicates all sorts of privacy interests. This includes the concerns about GPS technology, internet search, and browsing history that Justice Sotomayor noted in Jones. There is also a wealth of applications (“apps”) on a cell phone which “offer a range of tools for managing detailed information about all aspects of a person’s life:”
There are over a million apps available in each of the two major app stores; the phrase “there’s an app for that” is now part of the popular lexicon. The average smart phone user has installed 33 apps, which together can form a revealing montage of the user’s life.285Riley, 573 U.S. at 396.
In sum, the degree to which a search of a cell phone implicates its owner’s privacy interests is out of all proportion to that implicated by the search of a physical object,286See id. at 393 (“Modern cell phones, as a category, implicate privacy concerns far beyond those implicated by the search of a cigarette pack, a wallet, or a purse.”). since cell phones “place vast quantities of personal information literally in the hands of individuals.”287Id. at 386.
Most recently, in Carpenter v. United States,288138 S. Ct. 2206 (2018). the Court considered whether the Government’s actions in accessing historical cell phone records was merely gathering of data in which the suspects had no reasonable expectation of privacy, or instead constituted a search under the Fourth Amendment. In finding the actions constituted a search, the Court was strongly influenced by the fact that this was not ordinary surveillance of a suspect’s movements, or gathering of traditional records provided to a third party, but instead a “comprehensive chronicle of the user’s past movements.”289Id. at 2211. The nature of the information produced by cell-site location technology is “a new phenomenon: the ability to chronicle a person’s past movements through the record of his cell phone signals.”290Id. at 2216. Indeed, the information here raised even greater privacy concerns than the GPS monitoring in Jones because of the reality of cell phone usage.291Id. at 2218 (“[H]istorical cell-site records present even greater privacy concerns than the GPS monitoring of a vehicle we considered in Jones.”). Individuals “compulsively carry cell phones with them all the time,” beyond just public places, “into private residences, doctor’s offices, political headquarters, and other potentially revealing locales.”292Id.
Second, the Court addressed concerns about the third-party doctrine that were raised in Jones.293United States v. Jones, 565 U.S. 400, 417–18 (2012) (Sotomayor, J., concurring). It found that the waiver of privacy protection dictated by Smith294Smith v. Maryland, 442 U.S. 735 (1979). and Miller295United States v. Miller, 425 U.S. 435 (1976). was not simply a question of whether information was “knowingly shared” with another.296See Carpenter, 138 S. Ct. at 2219. Also important is “the nature of particular documents sought” and the capabilities of the information contained therein.297Id. Applying the third-party doctrine here would constitute an extension of that doctrine “to a distinct category of information” that goes beyond the “limited capabilities” of bank checks or telephone call logs:
[T]his case is not about “using a phone” or a person’s movement at a particular time. It is about a detailed chronicle of a person’s physical presence compiled every day, every moment, over several years. Such a chronicle implicates privacy concerns far beyond those considered in Smith and Miller.298Id. at 2219–20.
Thus, Carpenter finds that the intrusive, comprehensive nature of the information contained in records generated by new technology requires a new way of approaching the Fourth Amendment. Government seizure of ordinary paper records is simply not analogous.
Commentators have described this way of viewing privacy as the “mosaic theory,” since individual bits of information that may themselves not implicate privacy in the aggregate add up to a comprehensive chronicle of a person’s life.299The term “mosaic theory” was coined by Orin Kerr in a 2010 discussion of United States v. Maynard, 615 F.3d 544 (D.C. Cir. 2010), aff’d sub nom. 565 U.S. 400 (2012). Orin S. Kerr, The Mosaic Theory of the Fourth Amendment, 111 Mich. L. Rev. 311, 313 n.5 (2012); see also Orin Kerr, D.C. Circuit Introduces “Mosaic Theory” of Fourth Amendment, Holds GPS Monitoring a Fourth Amendment Search, Volokh Conspiracy (Aug. 6, 2010, 2:46 PM), https://perma.cc/FDJ2-2XFH. In 1989, the Supreme Court recognized that a compilation of information that was publicly available could nonetheless be considered private in the context of a FOIA exemption. In Reporters Committee, the Supreme Court considered whether the exemption for law enforcement records which could constitute an invasion of personal privacy could extend to a person’s “rap sheet” held by the FBI.300U.S. Dep’t of Just. v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 754–56 (1989). In finding that it could, the Court rejected the argument that the events summarized in a rap sheet have been previously disclosed to the public, and therefore have no privacy attributes:
According to Webster’s initial definition, information may be classified as “private” if it is “intended for or restricted to the use of a particular person or group or class of persons: not freely available to the public.” Recognition of this attribute of a privacy interest supports the distinction, in terms of personal privacy, between scattered disclosure of the bits of information contained in a rap sheet and revelation of the rap sheet as a whole. The very fact that federal funds have been spent to prepare, index, and maintain these criminal-history files demonstrates that the individual items of information in the summaries would not otherwise be “freely available” either to the officials who have access to the underlying files or to the general public. Indeed, if the summaries were “freely available,” there would be no reason to invoke the FOIA to obtain access to the information they contain.301Id. at 763–64 (footnote omitted).
There are implications of this theory too in the civil discovery context. In addition to discovery of cell phone information, where courts have already applied recent Supreme Court doctrine in protecting against broad examination,302See Henson v. Turn, Inc., No. 15-CV-01497, 2018 WL 5281629 (N.D. Cal. Oct. 22, 2018); Bakhit v. Safety Marking, Inc., No. 13CV1049, 2014 WL 2916490 (D. Conn. June 26, 2014). other types of discovery should be viewed through this lens, including social media, health tracker data, and other information from devices connected to the IoT.
C. A Modern Framework for Privacy Protection in Discovery
The historical analysis discussed above offers some important insights for current arguments about privacy in discovery. First, privacy rights in discovery are protected by the Constitution when requests touch on personal, intimate matters, or implicate rights to association like donor or membership lists, and are protected by public policy when they implicate state or federal statutory confidentiality provisions. Second, when such privacy rights are implicated, courts should require a higher showing of relevance as opposed to discovery that is solely for purposes of impeachment or is otherwise “collateral.” Courts should apply higher limits still when private information is sought from or implicates the rights of third parties. And third, even where information sought does not fall within traditional notions of confidentiality or constitutional zones of intimacy, the totality of what is comprised within broad sets of data may implicate privacy pursuant to the mosaic theory. All three of these bases for restriction are proper subjects for arguments that discovery is not proportional under Rule 26(b), or should be protected under Rule 26(c).
Courts should restrict discovery that implicates privacy interests based on the Constitution and public policy. First, a litigant’s right to privacy is implicated by compelled disclosure of her association—be it political, economic, religious or cultural affiliation.303See NAACP v. Alabama ex rel. Patterson, 357 U.S. 449, 466 (1958). Associational indicators abound in a person’s smartphone, where website browsing history, GPS location information, and apps can indicate membership in political or religious organizations.304See Carpenter v. United States, 138 S. Ct. 2206, 2222 (2018); United States v. Jones, 565 U.S. 400, 417 (2012) (Sotomayor, J., concurring). As Justice Sotomayor noted in her Jones concurrence, GPS data can disclose “trips to the psychiatrist, the plastic surgeon, the abortion clinic, the AIDS treatment center, the strip club, the criminal defense attorney, the by-the-hour motel, the union meeting, the mosque, synagogue or church, the gay bar and on and on.”305Jones, 565 U.S. at 415 (quoting People v. Weaver, 909 N.E.2d 1195, 1199 (N.Y. 2009)). As Chief Justice Roberts described in Riley, “[t]here are apps for Democratic Party news and Republican Party news; apps for alcohol, drug, and gambling addictions; apps for sharing prayer requests; apps for tracking pregnancy symptoms; apps for planning your budget; apps for every conceivable hobby or pastime; apps for improving your romantic life.”306Riley v. California, 573 U.S. 373, 396 (2014). While Jonesand Riley dealt with GPS information on a tracking device or cell phone, such technology is also available on wearable fitness trackers like Fitbit307Adrienne So, The 13 Best Fitness Trackers and Watches for Everyone, Wired (Dec. 10, 2021, 10:00 AM), https://perma.cc/88J7-DV5R (noting that the Fitbit Charge 5, like more expensive models has built-in GPS technology). and smart watches like Apple Watch.308Id.
Social media content can also reveal protected association, be it in a person’s profile, groups she follows, or posts she likes.309See Agnieszka A. McPeak, Social Media, Smartphones, and Proportional Privacy in Civil Discovery, 64 U. Kan. L. Rev. 235, 239–40 (2015). While a lot of this information is freely shared, at least with “friends,” there are instances in which people use privacy settings to conceal associations they do not wish to share. Professor Woodrow Hartzog has written about two students at the University of Texas whose use of Facebook resulted in their sexual preferences being inadvertently revealed to other users, including their parents.310Hartzog, supra note 229, at 1000. Despite their use of privacy settings, Facebook revealed to all their “friends” that they had been added to the student Facebook group “Queer Chorus.”311Id. Social media groups are as wide-ranging as the apps described by Chief Justice Roberts in Riley.312See Heidi Thorne, What Are Social Media Groups?, TurboFuture (Jan. 27, 2021), https://perma.cc/Z67G-GWFU. Some of those groups are limited in membership and maintain confidentiality.313Id. (“On Facebook, an alert pops up when you attempt to share information posted in a secret group. That reminds members that a secret group is secret.”). The simple question or interrogatory asking what social media accounts a person uses can implicate associational interests, as there are social media networks based on religion,314Godinterest, The Christian Social Network (2019)—Where Social Networking Is More Spiritual Than Social, PRNewswire (Jan. 28, 2019, 7:58 AM), https://perma.cc/VX7W-KK46. sexuality,315Eva Cordin, Best Gay Dating Sites: Top 7 LGBTQ+ Dating Apps of 2021, Island Now, (June 6, 2021), https://perma.cc/K4P5-HEE3. and gender identification.316TransPal calls itself “The First Social Network for Transgender.” TransPal,https://perma.cc/V9MV-DL7D.
b. Zones of Intimacy
Second, discovery should be protected where it implicates constitutional zones of intimacy, including marriage, procreation, contraception, family relationships, child rearing and education, health, and sexuality.317See Whalen v. Roe, 429 U.S. 589, 598 n.23, 599 n.24, 600 (1977); Roe v. Wade, 410 U.S. 113, 152–53 (1973). Smartphones are the primary communication tool for most people, who use their phones to send emails, text messages, or mobile app messages to spouses, children, and other family members and loved ones. Some of those communications can be quite explicit.318Sara Anne Hook & Cori Faklaris, Oh, Snap! The State of Electronic Discovery Amid the Rise of Snapchat, WhatsApp, Kik, and Other Mobile Messaging Apps, 63 Fed. Law. 64, 67 (2016) (noting that Snapchat in particular has “a reputation as an app of choice for those sending sexually explicit or other sensitive content”). Health or medical information is stored on smartphone apps or web browsing history.319See United States v. Jones, 565 U.S. 400, 417 (2012) (Sotomayor, J., concurring).
Discovery of social media content can also reveal very personal information such as sexual orientation.320Woodrow Hartzog has written about two students at the University of Texas whose use of Facebook resulted in their sexual preferences being inadvertently revealed to other users, including their parents. Despite their use of privacy settings, Facebook revealed to all their “friends” that they had been added to the student Facebook group “Queer Chorus.” Hartzog, supra note 229, at 1000. Wearable devices and other health sensors have the capacity to reveal a great deal about a person.321So, supra note 307. Apple Watch lets you track your menstrual cycle, measure your blood oxygen, track your ECG, text, make calls, and pay for things seamlessly. Many such devices track blood pressure, blood sugar levels, body temperature, heart rate, and breathing activity, all of which can indicate problems like disease.322See Peppet supra note 242, at 104. Wearables, somewhat notoriously, can also track sexual activity.323See Nicole Chauriye, Wearable Devices as Admissible Evidence: Technology is Killing Our Opportunity to Lie, 24 Cath. U. J.L. & T. 495, 503 (2016) (citing Leena Rao, Sexual Activity Tracked by Fitbit Shows Up in Google Search Results, TechCrunch (July 3, 2011 12:02 PM),
https://perma.cc/79EX-NN8C) (discussing a 2011 scandal when the data of several people who had worn Fitbits during sexual activity was made available through Google search results)). More cutting-edge digestible and implantable devices provide information about all manner of bodily functions.324Peppet, supra note 242, at 103–04. And information from smart speakers and home security cameras could reveal information only limited by the imagination.325See Elle Xuemeng Wang, Erecting a Privacy Wall Against Technological Advancements: The Fourth Amendment in the Post-Carpenter Era, 34 Berkeley Tech. L.J. 1205, 1233–35 (2019).
c. Other Privacy Interests
Third, discovery is subject to protection when it implicates other personal information protected by the Constitution or by public policy. This includes financial information, employee files, criminal activity files, military service files, personnel and medical files, and credit information.326See Whalen v. Roe, 429 U.S. 589, 605 (1977). For additional discussion, see supra Section II.C. Many people use banking apps or store personal medical or financial files on their smartphones.327See McPeak, supra note 309, at 245. Fitbits and other health trackers clearly risk disclosure of medical information.328See Chauriye, supra note 323, at 505–06.
Discovery requests for private information should generally be justified by a clear showing of relevance to a party’s claim or defense and compelling need. Courts should limit discovery where it would go to impeachment or violate a policy of the Rules of Evidence. This should be an aspect of proportionality: the greater the connection between the discovery and the “heart of the claim,” the more likely it is to be granted. In contrast, when discovery is less connected to the claim, the balance tips in favor of privacy and against disclosure.
One case shows a court properly weighing the use of the discovery in determining whether to allow a broad, invasive request. In Hedenburg v. Aramark American Food Services,329No. C06-5267, 2007 WL 162716 (W.D. Wash. Jan. 17, 2007). a gender discrimination claim, the defendant sought a “mirror image” of the plaintiff’s home computer in the effort to “probe the veracity” of her claims.330Id. at *1. The court distinguished other cases where courts had allowed such a search as being “where the contents of the computer go to the heart of the case.”331Id. at *2. In contrast, the defendant here was “hoping blindly to find something useful in its impeachment of the plaintiff.”332Id.
In a recent decision from the Northern District of California, Henson v. Turn, Inc.,333No. 15-CV-01497, 2018 WL 5281629 (N.D. Cal. Oct. 22, 2018). plaintiff subscribers to Verizon’s cellular and data services brought a data-privacy class action alleging that defendant Turn engaged in an illegal practice of placing “zombie cookies” on users’ devices to track their web browsing and application use in order to tailor advertisements to them.334Id. at *2. Turn sought production from the plaintiffs of all mobile devices they used during the class period to access the internet (or complete forensic images of the devices), data regarding their web browsing history, and data regarding any cookies stored on or deleted from their devices.335Id. at *3. The court first noted the importance of a person’s cell phone to his or her daily life:
Users increasingly use a single mobile device — a smartphone or a tablet — for their online activities, including web browsing, reading the news, listening to radio content, accessing their banking information and managing their finances, shopping online, using GPS for directions and traffic updates, communicating over email and social networks, and reading sites like WebMD to assess their medical condition.336Id. at *1.
Web browsing information in particular is “inextricably linked to personal information” since it “can reveal her location, interests, purchases, employment status, sexual orientation, financial challenges, medical conditions, and more.”337Id. at *2 (quoting Complaint at 9–10, Henson, 2018 WL 5281629 (No. 15-CV-01497).
In denying the request for production of the phones for inspection, the court found the request called for information that is both not relevant and is disproportional to the needs of the case.338Id. at *5. As to relevance, the request “threatens to sweep in documents and information that are not relevant to the issues in this case, such as the plaintiffs’ private text messages, emails, contact lists, and photographs.”339Henson, 2018 WL 5281629, at *5. As to proportionality, the court noted the growing number of cases and commentators to recognize that privacy interests can be an important consideration, “particularly in the context of a request to inspect personal electronic devices.”340Id. The court quoted widely from Riley.341Id. at *6 (citing Riley v. California, 573 U.S. 373, 401–03 (2014)). In particular, the court found that Turn’s request for production of web browsing history and cookie data implicated “significant privacy concerns.”342Id. at *8.
Similarly, in a decision from the District of Connecticut, the court denied a plaintiff’s motion to inspect the cell phone of a supervisor in a racial discrimination suit, without first using other discovery devices.343Bakhit v. Safety Marking, Inc., No. 13CV1049, 2014 WL 2916490, at *3 (D. Conn. June 26, 2014). While the plaintiff had an interest in discovery regarding racists jokes and texts shared via the phone, the defendant’s privacy interest in the data stored there outweighed the interest in disclosure.344Id. at *2–3. Again, the court was persuaded by the Supreme Court’s opinion in Riley, “which recognized, albeit in the criminal context, the privacy concerns implicated by the modern cell phone.”345Id. at *3.
In contrast, a Florida court upheld an order allowing a defendant to examine the cell phone of a woman killed in a car accident in litigation brought by her family.346Antico v. Sindt Trucking, Inc., 148 So. 3d 163, 168 (Fla. Dist. Ct. App. 2014). The court recognized the decedent’s privacy interests in the cell phone, but found the order narrowly tailored its request to allow discovery based on the highly relevant issue of whether the decedent was texting at the time of the accident.
[W]here personal information is involved as in this case, the trial courts’ discretion to permit discovery “must be balanced against the individual’s competing privacy interests to prevent an undue invasion of privacy.” Courts have reversed rulings for not adequately accounting for privacy interests in the inspection of electronic storage devices. . . .
But, contrary to Petitioner’s argument, privacy rights do not completely foreclose the prospect of discovery of data stored on electronic devices. Rather, limited and strictly controlled inspections of information stored on electronic devices may be permitted.347Id. at 166 (citations omitted).
In this context, therefore, the narrowly tailored order was appropriate because of the close nexus between the relevant private data and the heart of the case.
A primary reason many litigants seek social media discovery and data from wearables or smart speakers is to attack credibility. Defense attorneys freely recommend to each other to seek information from a plaintiff’s social media, Fitbit, or Alexa for purposes of impeachment.348See Lang & Benessere, supra note 266, at 21 (“Defense attorneys know that, when it suits plaintiff’s interests, plaintiffs often do not provide a wealth of information regarding their past day-to-day activities. Armed with a compendium of plaintiffs’ virtual assistants’ searches, however, defense counsel can refresh plaintiffs’ recollections regarding what people did on a certain day, even whether plaintiffs tried to call 911 for help, thereby leading to more effective and meaning questioning.”); see also Garcia, supra note 243, at 69 (“[T]he defense lawyer should investigate whether a driver wore a biometric recording device, particularly when the driver’s health is potentially an issue.”). Such requests should carry less weight in the proportionality balance than when the discovery is relevant to the claim.
Finally, as part of its balancing, courts should be careful to protect against discovery that implicates privacy of third parties. All the modern subjects of discovery have the potential to reveal a great deal of information about people other than the owner of the phone, social media account, activity tracker, or smart speaker. Cell phones contain communications with and photographs of other parties. Social media content reveals interactions, associations, and photographs with friends who may be using privacy settings or interacting in a “group” that promised privacy.349See Thorne, supra note 312. Fitness trackers may be used to share fitness and health information with others.350See David Nield, How to Lock Down Your Health and Fitness Data, Wired (Nov. 17, 2019, 7:08 AM), https://perma.cc/WCR7-N2RZ (noting that fitness applications can share user data). It goes without saying that smart speakers and cameras do not choose to record only certain users and could capture conversations and images of any person in proximity to the device.
Lastly, courts should recognize that modern discovery may not fit traditional notions of privacy as secrecy.351SeeUnited States v. Jones, 565 U.S. 400, 418 (2012) (Alito, J., concurring) (advocating that “Fourth Amendment jurisprudence cease to treat secrecy as a prerequisite for privacy”). Clearly, Supreme Court case law provides strong support for privacy rights in cell phones, GPS data, and cell site location information, particularly when requests span a long period of time. GPS capability can be found not only in smartphones but in other devices like fitness trackers and Apple watches.352Pat Augustine, Wearable Evidence: Why the Pennsylvania Judiciary Should Require a Warrant to Search Wearable Technology, 17 Pitt. J. Tech. L. & Pol’y 1, 2 (2017) (“[W]earable technology may take the form of a bracelet or watch and can be worn throughout the day and night. The device follows the consumer closely, collecting data about the consumer’s every move, painting a picture of everything that happens to the consumer throughout their day.” (footnotes omitted)).
In addition, the mosaic theory can apply to other types of discovery that have been seen as deserving of no privacy protection. Social media in particular, even when protected by privacy settings,353I have argued elsewhere that courts should take into account a person’s use of privacy settings on social networks when deciding to allow discovery of such content. See Stuart, supra note 10, at 168. has been described by courts as having no privacy interest because of its communicative and public nature.354In the oral argument for the petitioner in Riley, Chief Justice Roberts remarked, “There’s no real there’s no any privacy interest in a Facebook account is at least diminished because the point is you want these things to be public and seen widely.” Transcript of Oral Argument at 10, Riley v. California, 573 U.S. 373 (2014) (No. 13-132). But not all social network sites are as “public” as others.355Elpha is a place where “women in tech . . . talk easily and candidly online.” Jamie Spencer, 101 Social Networking Sites You Need to Know About in 2022, MakeAWebsiteHub.com (May 10, 2021), https://perma.cc/F5HL-CLU4. On Open Diary, “[d]iaries can be private, public, or open to friends only.” Id. MeWe: “[t]outed as the ‘Next-Gen Social Network,’ MeWe is all about privacy.” Id. In addition, when aggregated, a person’s social media content becomes a picture of that person’s entire life.356See McPeak, supra note 309, at 245 (articulating that mundane details combine to form “intimate portrait of [one’s personal] life”).
In a thoughtful opinion from the District of Wyoming, the court considered a broad request by defendants in a motor vehicle accident for social media directed against the plaintiff, who sought damages based on physical injuries, traumatic brain injury, posttraumatic stress disorder, anxiety and depression.357Gordon v. T.G.R. Logistics, Inc., 321 F.R.D. 401, 402 (D. Wyo. 2017). The court noted the changes in discovery wrought by broad increases in data, and by social media in particular:
Social media presents some unique challenges to courts in their efforts to determine the proper scope of discovery of relevant information and maintaining proportionality. While it is conceivable that almost any post to social media will provide some relevant information concerning a person’s physical and/or emotional health, it also has the potential to disclose more information than has historically occurred in civil litigation. While we can debate the wisdom of individuals posting information which has historically been considered private, we must recognize people are providing a great deal of personal information publicly to a very loosely defined group of “friends,” or even the entire public internet. People have always shared thoughts and feelings, but typically not in such a permanent and easily retrievable format. No court would have allowed unlimited depositions of every friend, social acquaintance, co-employee or relative of a plaintiff to inquire as to all disclosures, conversations or observations. Now far more reliable disclosures can be obtained with a simple download of a social media history.358Id. at 403.
The court looked to previous decisions for guidance in balancing against overbroad discovery all while recognizing the defendants’ “legitimate interest in discovery which is important to the claims and damages it is being asked to pay,” including information “which reveals that the plaintiff is lying or exaggerating his or her injuries.”359Id. at 404. Tying the analysis to the proportionality requirement in Rule 26, the court denied discovery of the plaintiff’s entire Facebook history, but ordered production of “relevant history which addresses Plaintiff’s significant emotional turmoil, any mental disability or ability, or relate significant events which could reasonably be expected to result in emotion distress.”360Id. at 406 (footnote omitted). Social media requests should be limited to avoid revealing an aggregate chronicle of a person’s life.
Moreover, discovery requests of different media can themselves combine to create an exceedingly comprehensive picture of a person’s life over a span of time. In the Hinostroza case discussed in the Introduction, the defendant sought five years of Fitbit and social media data, which could reveal the plaintiff’s movements, religious and political associations, dating habits, sexual preferences, fertility, health, exercise and sleeping habits—a mosaic of her entire life for a five-year period.361Hinostroza v. Denny’s Inc., No. 17-CV-02561, 2018 WL 3212014, at *5 (D. Nev. June 29, 2018). The court in fact limited the social media discovery to one year (still a much longer period than the GPS tracking at issue in Jones), and ordered further information about plaintiff’s search for Fitbit data.362Id. at *6.
As in the Fourth Amendment context, discovery has been upended by changes in technology. Information that was not capable of creation is now saved automatically in vast databases. Formerly private communications are now shared in semi-public fora. People’s movements, bodily functions—indeed, their entire lives—are chronicled by devices on their wrists or their countertops. Courts can and should apply privacy protections when this data is sought in discovery.
Text messages and other communications may be private if they implicate personal relationships or otherwise intrude on the zone of intimacy. Fitbit data intrudes on privacy of medical and other personal information, and may include GPS data that gives a detailed record of a user’s activity every day. Social media account information too could offer a detailed portrait of a user’s life, and could implicate associational and other constitutional privacy rights. Finally, all of these discovery requests risk the privacy of third parties. These considerations are appropriate for a court in balancing the need for the discovery—including how relevant it is to the claim—against the intrusion into the privacy of the party and others. The law gives courts the discretion to say this comprehensive, intrusive discovery is not proportional.