MARIA-ELENA JAMES, Magistrate Judge.
The parties in this putative privacy class action recently filed three Joint Discovery Letters outlining various disputes. Dkt. Nos. 112, 113, 122. In the first Letter, they dispute whether Defendant Facebook, Inc. must produce documents regarding how it monetarily values information obtained by allegedly scanning putative class members' private Facebook messages. Dkt. No. 112 ("RFP Ltr."). In their second Letter, they dispute whether Facebook must produce an interrogatory response and related documents about how Facebook processes users' private messages. Dkt. No. 113 ("Rog/RFP Ltr."). The Court held a telephonic hearing on these matters on September 29, 2015. Dkt. No. 118. Subsequently, the parties filed an additional letter disputing whether Plaintiffs may take Facebook's Rule 30(b)(6) deposition concerning certain of its interrogatory responses. Dkt. No. 122 ("Dep. Ltr."). Having considered the parties' positions, relevant legal authority, and the record in this case, the Court issues the following Order.
Plaintiffs allege that Facebook "has systematically intercepted Facebook users' private Facebook messages without their consent[,]" in violation of the Electronic Communications Privacy Act ("ECPA" or the "Wiretap Act") and the California Invasion of Privacy Act ("CIPA"). Consol. Am. Compl. ("CAC") ¶ 1, Dkt. No. 25.
According to Plaintiffs, whenever a private Facebook message contains a Uniform Resource Locator ("URL"), Facebook uses a software application called a "web crawler" to scan the URL. Id. ¶ 25. Plaintiffs allege that "when their ostensibly private messages contained links to other websites, . . . Facebook scanned those messages and then analyzed the URL in the link." Id. ¶ 4. If the website contained a Facebook "Like" button,
The deadline to file the class certification and summary judgment motions is November 15, 2013. Dkt. No. 117.
Federal Rule of Civil Procedure 26 provides that a party may obtain discovery "regarding any nonprivileged matter that is relevant to any party's claim or defense." Fed. R. Civ. P. 26(b)(1). "Relevant information need not be admissible at the trial if the discovery appears reasonably calculated to lead to the discovery of admissible evidence." Id. A court "must limit the frequency or extent of discovery otherwise allowed by [the Federal] rules" if "(i) the discovery sought is unreasonably cumulative or duplicative, or can be obtained from some other source that is more convenient, less burdensome, or less expensive; (ii) the party seeking discovery has had ample opportunity to obtain the information by discovery in the action; or (iii) the burden or expense of the proposed discovery outweighs its likely benefit, considering the needs of the case, the amount in controversy, the parties' resources, the importance of the issues at stake in the action, and the importance of the discovery in resolving the issues." Fed. R. Civ. P. 26(b)(2)(C).
"The court may, for good cause, issue an order to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense," including by (1) prohibiting disclosure or discovery; (2) conditioning disclosure or discovery on specified terms; (3) preventing inquiry into certain matters; or (4) limiting the scope of disclosure or discovery to certain matters. Fed. R. Civ. P. 26(c)(1). "Rule 26(c) confers broad discretion on the trial court to decide when a protective order is appropriate and what degree of protection is required." Seattle Times Co. v. Rhinehart, 467 U.S. 20, 36 (1984).
The first dispute concerns Interrogatory No. 8 of Plaintiffs' Second Set of Interrogatories and Request for Production of Documents ("RFP") No. 41. Interrogatory No. 8 asks Facebook to
Dkt. No. 113-1 at 9-10 (Plaintiffs' Second Set of Interrogatories). Plaintiffs generally define "Objects and Associations" as "metadata structures that Facebook generates to catalog its users` online activity." Rog/RFP Ltr. at 2 n.1. Plaintiffs' RFP No. 41 seeks "[a]ll Documents and [electronically stored information ("ESI")] relied upon, reviewed, or referenced by [Facebook] in answering Interrogatory No. 8." Dkt. No. 113-2 at 8.
After meeting and conferring with Facebook, Plaintiffs narrowed the requests to focus on only 19 private messages, communicated by the named Plaintiffs; Facebook searched for the specified messages, but located only 16 of them. Rog/RFP Ltr. at 1-2.
Facebook objects and refuses to produce more or different documents, asserting that Plaintiffs' requests are irrelevant, overbroad, and burdensome. Id. at 3-5. Its primary objection appears to be that "
Facebook also argues it has already produced the Objects and Associations relevant to Plaintiffs' allegation of scanning of URLs to increase the "Like" count on webpages. Id. at 4. Facebook states that "Plaintiffs' Complaint challenges a very specific practice—namely, the alleged `scanning' of URLs sent in `private messages' to increase the `like' counter on third-party websites before the end of 2012." Id. (emphasis omitted). Facebook also points to Plaintiffs` proposed class definition, which is limited to "Facebook users located within the United States who have sent or received private messages that included URLs." Id. (emphasis omitted); CAC ¶ 59. Facebook thus argues Plaintiffs' request for "the production of any `objects' and `associations' related to these [19] messages," not just those related to URLs contained in those messages, has "no conceivable relevance to Plaintiffs' allegations of `scanning' URLs to increase the `like' counter." Id. (emphasis in the original).
In response, Plaintiffs assert their requests "are narrowly tailored to provide specific examples of how Facebook's message-scanning practices work, complementing the source code already provided by Facebook." Id. at 3. They further contend the "information not only allows Plaintiffs to determine the extent to which their message content was acquired, stored and used, but also to measure these data points against Facebook's defenses that all message scanning and content acquisition at issue was conducted within the ordinary course of its business."
Finally, Facebook objects on grounds that "much of the information [sought] is not accessible without undue burden." Rog/RFP Ltr. at 5. Facebook contends that "[e]xtracting the data comprising objects and associations into producible form [is something] Facebook's systems were never designed to do;" and that "Facebook's there is no readily identifiable list of th[e] information" sought in subparts (E) and (F) of Interrogatory No. 8. Id. at 4-5. Consequently, Facebook asserts its "busy and valuable technical employees must take considerable time away from their normal job duties to search for information that is not readily accessible (if it is accessible at all)[.]" Id. at 5.
During the telephonic hearing, the Court discussed the burden issue with the parties and ultimately permitted Facebook to submit a declaration explaining the burden to Facebook in producing this information. Facebook submitted the declaration of its Engineering Manager and declarant, Dale Harrison. See Harrison Decl., Dkt. No. 125-3.
Having considered the foregoing arguments and carefully reviewed the supportive documents, the Court finds Facebook must produce the requested discovery. First, the information requested goes not only to Plaintiff's affirmative claims, but also Facebook's defenses. As Facebook outlines in its portion of the Joint Case Management Statement, the legal issues in this case include: (1) "[W]hether Facebook unlawfully `redirected' the content of plaintiffs' private messages[;]" (2) "Whether any alleged `interception' occurred while the messages were `in transit`"[; and] (3) "Whether the `ordinary course of business' exemption bars Plaintiffs' Wiretap Act claim[.]" Jt. Case Management Statement at 7 (quoting Order re: Mot. to Dismiss, Dkt. No. 43 (some internal marks omitted)). Plaintiffs' Interrogatory No. 8 and related RFPs seek information about "how Facebook's message-scanning practices work," not only to support their own claims but also to respond to Facebook's defenses, including its ordinary course of business defense and representations about when the alleged interceptions occurred.
Second, while in some cases the production of certain discovery will negate the need for further unnecessary discovery on the same issue, the Court does not find these discovery requests redundant or superfluous. Facebook may be correct that the source code it has already produced may provide much of the discovery Plaintiffs seek. See Harrison Decl. at 6 ("[T]he comprehensive record of Facebook functions that used any given Object or Association type at any given time is Facebook's source code."). But as Plaintiffs note elsewhere, "[t]he source code at issue consists of over 10 million lines[,]" Dep. Ltr. at 3, and Facebook's own declarant explains that it "would be exceedingly burdensome to review the source code in its entirety—to develop a list of all possible uses of Objects and Associations." Harrison Decl. at 6-7. But seemingly this is what Facebook wishes Plaintiffs to do, instead of working together to more efficiently locate and uncover the information. Furthermore, Facebook's responses to Plaintiffs' Interrogatory No. 8 and RFP No. 41 can be used differently than information obtained from the source code. Among other things, in answering an interrogatory, a party makes that answer "in writing under oath." Fed. R. Civ. P. 33(b)(3). Rather than having experts duel over technical coding, Plaintiffs can use a sworn interrogatory response in conjunction with related documents to show Facebook's actions.
Finally, the Court is not persuaded by Facebook's burden argument. First, twenty-five hours of work over the course of two months does not constitute an undue burden. See, e.g., Thomas v. Cate, 715 F.Supp.2d 1012, 1033 (E.D. Cal. 2010) (collecting cases and finding 111 hours to conduct data review in response to interrogatory did not amount to undue burden); Pham v. Wal-Mart Stores, Inc., 2011 WL 5508832, at *5 (D. Nev. Nov. 9, 2011) (document request requiring 56 hours to review files did not constitute undue burden). Moreover, Facebook's declarant does not describe how those 25 hours were allocated. He does not state, for instance, how much time he spent writing new code versus conducting the searches and extractions or, for that matter, how much time he spent consulting with counsel.
Second, he does not explain how much time he realistically believes it will take him to acquire the rest of the information Plaintiffs requested. While Harrison indicates it could take hundreds of hours to find the information Plaintiffs seek because "there is no search function that returns all Objects for a given user," he also indicates there may be a very simple way of locating and extracting the information sought; specifically, he states that "if [he] were to learn of an Object type that may exist for these messages, [then] it may be that there is existing search functionality for locating and extracting that Object." Harrison Decl. at 6. Plaintiffs` Interrogatory No. 8 asks Facebook to tell them what "Objects that were created during the Processing of the Private Message" and what "Objects that were created specifically when the embedded URL was shared." Rog/RFP Ltr. at 1; Dkt. No. 113-1 at 9-10. By refusing to provide Plaintiffs with a list of Objects, Facebook puts Plaintiffs in a position where they cannot request specific Objects types to locate and extract—which, according to Harrison, may aid him in the locating and extracting those Objects. See Harrison Decl. at 6. Facebook has not said it does not know which Object types exist for its messages, and it seems unlikely Facebook would not possess this information as it created and controls the mechanisms for processing these messages. Thus, while Harrison's declaration may raise the question of whether he is the appropriate person to respond to Plaintiffs' requests, it does not show Facebook is unduly burdened. If other engineers, etc., know what Objects "can be generated as a result of their work at Facebook, and whether any of those Objects could be generated from sending a message," those individuals may be the more appropriate persons to address these discovery requests.
In sum, it seems there are a number of simple steps Facebook can take to more easily find and extract the information Plaintiffs seek. And even if there are not, Facebook has not demonstrated that its burden outweighs the likely benefit of this information in resolving the issues at stake in this action, and which the parties will in all probability address in their summary judgment and class certification motions. Accordingly, Plaintiffs' Motion to Compel Facebook's responses to Interrogatory No. 8 and RFP No. 41 is
The second dispute concerns Plaintiffs' Third Set of Requests for Production of Documents, which seek the following:
Dkt. No. 112-1 at 8-9. In response, Facebook (1) agreed to produce responsive documents to RFP Nos. 55 and 57; (2) objected to but offered to meet and confer on RFP Nos. 53-54 and 59; and (3) objected to RFP Nos. 56, 58, and 60. RFP Ltr. at 1. Facebook later informed Plaintiffs that after a reasonable search and diligent inquiry, it was unable to locate any responsive documents to RFP Nos. 55 and 57 during the relevant time period. Id. Plaintiffs contend Facebook has not produced any responsive documents. Id. at 1-2.
Plaintiffs' RFP Nos. 53-60 seek "to discover how Facebook generates profits in order to analyze the role played by private messages, social plugins, and Likes, and, specifically, the interception of private messages, generation of passive Likes, and derivative activities, in Facebook's income stream." Id. at 2. With such information, "Plaintiffs could accurately model the profits attributable to the challenged conduct," which "is relevant to determine the proportion of Facebook's profits attributable to generating Passive Likes through the alleged ECPA violations." Id. at 2-3. Plaintiffs contest Facebook's representation that there are no documents that answer the RFPs, maintaining "[t]here is every reason to believe that responsive documents exist," due in part to Facebook Engineer Alex Himel's June 2015 declaration, which explains how Facebook altered some of its code to collect certain related information. Id. Plaintiffs insist "[a] good-faith search . . . would provide documents showing how Facebook categorizes" data related to their requests. Id. at 2. Moreover, Plaintiffs assert that "[e]ven if . . . Facebook never directly evaluated the independent worth of its users, Passive Likes, or private messages . . ., the information to ascertain Facebook's profits from scanning private messages, logging URLs within, and generating Likes[] can be determined with expert analysis." Id. at 3.
Facebook objects to Plaintiffs' requests on two grounds: first, Facebook contends Plaintiffs' requests go beyond the "District Court's clear instruction at the March 12, 2015 case management conference that the parties should focus their discovery efforts on issues relevant to class certification and the open issues from the Court's motion-to-dismiss order." Id. at 4. Second, Facebook asserts "Plaintiffs' stated purpose behind RFPs 53-60 . . . is fundamentally flawed and overbroad" because they "are not entitled to documents about how Facebook 2017generates profits,`" but only "documents . . . relevant to their specific claims and the permissible damages under those claims." Id. Facebook contends it has "already conducted a reasonable search and diligent inquiry" for what it views as responsive documents related to RFP Nos. 54, 55, and 57, but it states it was unable to locate any responsive documents. Id. at 4-5. It asserts, despite Plaintiffs' contention, that such documents exist is "speculation." Id. at 5. As to RFP Nos. 53, 56, 58-60, Facebook insists such requests are unrelated to Plaintiffs' claims or potential recoverable damages. Id. As noted, Facebook has not produced any documents in response to these RFPs. Id. at 1-2.
As an initial matter, to the extent Facebook argues such discovery is premature, the Court disagrees. The District Court's Case Management Conference Minute Entry provides that both class certification and summary judgment motions shall be filed contemporaneously and reiterated this in its latest Order altering the filing deadlines for these motions. See Dkt. Nos. 62, 117. Both motions have the potential to consider and test Plaintiffs' theories of relief, whether they have sufficient evidence to support the elements of their claims, and their methodology for determining class-wide relief. Consequently, this discovery is not premature.
Second, Facebook has not shown why Plaintiffs' requests are overbroad or irrelevant. As Plaintiffs point out, this suit arises under ECPA and CIPA, and Plaintiffs seek all available relief. RFP Ltr. at 2 and 4 n.5. CIPA provides for actual damages, or statutory damages of $5,000. Cal. Penal Code § 637.2. ECPA provides for "appropriate relief," including (1) "the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation"; (2) statutory damages of $10,000 or $100 per day of violation; and/or (3) other equitable relief "as may be appropriate." 18 U.S.C. § 2520(b)-(c). Thus, profits made as a result of the violation may be recoverable.
Facebook, however, represents it has found no documents showing how it directly profited from the alleged interceptions, indicating that no such information exists. RFP Ltr. at 4. Seemingly, because Facebook located no information it viewed as on point, Facebook now believes it should not have to produce any other information. But as Plaintiffs point out, even though Facebook itself may not have determined the independent value or profits it obtained from scanning private messages, expert analysis of the information Plaintiffs seek may assist them in making that determination, which in turn could assist in establishing a model or methodology for class-wide relief. Id. at 3. Although Facebook argues RFP Nos. 53, 56, 58, 59, and 60 are overbroad, they are connected to the conduct Plaintiffs challenge, namely the scanning of putative class members' private messages and the potential benefit Facebook receives as a result of obtaining information from those messages, including URL data that converts to "Likes" on corresponding webpages. Plaintiffs allege that Facebook then uses the data to enhance its targeted advertising efforts, among other things. CAC ¶¶ 30, 49-51. While in a footnote Facebook argues its advertising revenues are irrelevant, Ltr. at 5 n.8, as indicated, Plaintiffs have raised targeted advertising as one of the potential benefits Facebook receives as a result of scanning users' private messages.
Accordingly, Plaintiffs' Motion to Compel Facebook's responses to RFP Nos. 53-60 is
The last dispute between the parties involves Plaintiffs' Rule 30(b)(6)
Dep. Ltr. at 1.
Once again, Facebook falls back on the position that it has already produced the source code and therefore does not need to produce anything more. Id. at 4. Facebook also argues it provided the declaration from a senior Facebook Engineering Director, Alex Himel, which it asserts "explained the processes at issue and attached key technical documents explaining the relevant portions of the source code[,]" as well as detailed responses to Plaintiff's First Set of Interrogatories, "which provide a narrative description of how the challenged practice operated." Id. Facebook urges the Court to deny Plaintiff's 30(b)(6) deposition request, asserting "[t]he emerging pattern in this case is that Plaintiffs never will be satisfied. When Plaintiffs demanded Facebook's source code, Facebook explained the technology in lieu of producing it. Plaintiffs insisted that they have the source code itself, so Facebook ultimately produced it. But now, Plaintiffs demand a Rule 30(b)(6) witness to explain it." Id. at 5 (emphasis in original). Facebook asserts, without citations, that "[t]he law is clear: Plaintiffs cannot shift their burden of analyzing the source code they insisted they needed to Facebook or insist that Facebook prepare a witness on such burdensome, overbroad topics." Id. at 4.
Facebook's argument that Plaintiffs already have all they need—the source code—and that Facebook is not required to produce anything more is belied by two things. First, Facebook's own declarant has acknowledged that reviewing the entire source code is "exceedingly burdensome," see Harrison Decl. at 6-7, and if Facebook, as the code's developer, has so much difficulty analyzing this data, the burden on Plaintiffs to do the same is conceivably much greater. Thus, the Court does not currently find evidence that Plaintiffs are "manufacturing disputes" to increase the costs and burden of this litigation as Facebook asserts. See id. at 5.
Second, as the Court discussed above in relation to Facebook's objections to Plaintiffs` Interrogatory No. 8 and RFP 41, different types of discovery address different concerns. While Facebook may have provided detailed responses to Plaintiffs' interrogatories and submitted the declarations of Facebook employees describing how its private message processing works, Plaintiffs have a right to verify and explore the information Facebook provided through a 30(b)(6) deposition, which "permit[s] the examining party to discover the corporation's position via a witness designated by the corporation to testify on its behalf." Estate of Thompson v. Kawasaki Heavy Indus., Ltd., 291 F.R.D. 297, 303 (N.D. Iowa 2013) (quoting LDA v. Virgin Enters. Ltd., 511 F.3d 437, 440 n.2 (4th Cir. 2007)); accord Brazos River Auth. v. GE Ionics, Inc., 469 F.3d 416, 433 (5th Cir. 2006) ("a rule 30(b)(6) designee . . . presents the corporation's `position' on the topic." (citations omitted)); JSR Micro, Inc. v. QBE Ins. Corp., 2010 WL 1338152, at *11 (N.D. Cal. Apr. 5, 2010) (same); Memory Integrity, LLC v. Intel Corp., ___ F.R.D. ___, 2015 WL 4601177, at *3 (D. Or. July 29, 2015) (same). As Plaintiffs point out, Facebook's responses to Interrogatory Nos. 2-4 are simply narratives, and Plaintiffs should be "entitled to test their veracity and accuracy" by, for instance, obtaining evidence "that provides the foundation for any testimony characterizing the technical details of the private message process[.]" Dep. Ltr. at 2. Indeed, "[p]arties are entitled to test assertions in questioning witnesses during depositions, and it is fundamental that parties may simultaneously utilize any or all of the discovery mechanisms authorized by the rules." U.S., ex rel. Fry v. Health All. of Greater Cincinnati, 2009 WL 5227661, at *3 (S.D. Ohio Nov. 20, 2009) (citation and internal marks omitted); see also Kress v. Pricewaterhouse Coopers, LLP, 2013 WL 2421704, at *5 (E.D. Cal. June 3, 2013) (noting "there are strong reasons why a party strategically selects to proceed by oral deposition rather than alternate means, including the spontaneity of witness responses." (citation omitted)). Accordingly, such discovery is not "wasteful" as Facebook suggests but may help the parties and the Court better understand how Facebook's private message processing works.
Facebook nevertheless contends that asking it to prepare a witness to identify the source code related to "each process," described in its interrogatory responses, which include 10 and 31 sub-parts, is an "impossible task." Dep. Ltr. at 5 (citations omitted). The Court does not find much merit in this argument. On one hand, Facebook (1) tells the Court that its source code provides "all of the data [Plaintiffs] need" to uncover the information they seek (id. at 4)
Finally, to the extent Facebook contends Plaintiffs' deposition notice should be quashed because it asks for testimony "not limited" to the listed topics, the Court does not find grounds for doing so at this time. Plaintiffs' deposition notice describes with "reasonable particularity the matters for examination." Fed. R. Civ. P. 30(b)(6). The mere fact that Plaintiffs generically added the phrase "not limited to" to the matters identified does not necessarily mean that it must be quashed. "The proper scope of the questioning of a Rule 30(b)(6) witness is not defined by the notice of deposition, but by Rule 26(b)(1) of the Federal Rules of Civil Procedure, unless a court otherwise directs." Crawford v. Franklin Credit Mgmt. Corp., 261 F.R.D. 34, 38 (S.D.N.Y. 2009) (citing Emps. Ins. Co. of Wausau v. Nationwide Mut. Fire Ins. Co., 2006 WL 1120632, at *1 (E.D.N.Y. Apr. 26, 2006)). "In fact, a notice of deposition . . . constitutes the minimum, not the maximum, about which a deponent must be prepared to speak." Id. (citing Wausau, 2006 WL 1120632, at *1 and Detoy v. City & Cty. of S.F., 196 F.R.D. 362, 366 (N.D. Cal. 2000)); see also Am. Gen. Life Ins. Co. v. Billard, 2010 WL 4367052, at *4 (N.D. Iowa Oct. 28, 2010) (adopting "the majority view" that "the questioning of a Rule 30(b)(6) deponent is not limited to those subjects identified in the Rule 30(b)(6) notice."); accord U.S. E.E.O.C. v. Caesars Entm't, Inc., 237 F.R.D. 428, 432 (D. Nev. 2006) ("Most courts have concluded that once the witness satisfies the minimum standard for serving as a designated witness, the scope of the deposition is determined solely by relevance under Rule 26, that is, that the evidence sought may lead to the discovery of admissible evidence." (citations and internal marks omitted)).
While this is certainly not an invitation for Plaintiffs to go on a fishing expedition for information unrelated to their listed matters for examination, nothing in the Federal Rules of Civil Procedure requires the Court quash Plaintiffs' deposition notice at this time. Cf. Reed v. Bennett, 193 F.R.D. 689, 692 (D. Kan. 2000) (quashing a deposition subpoena where "the defendant c[ould] not identify the outer limits of the areas of inquiry noticed, [as] compliant designation is not feasible"); see also Heartland Surgical Specialty Hosp., LLC v. Midwest Div., Inc., 2007 WL 1054279, at *4 (D. Kan. Apr. 9, 2007) (finding that where the examining party used the phrase "including but not limited to," but then followed it with an extensive example list of the records and reports for which information is sought, there can be no claim that the deposed party could not identify the "outer limits of the areas of inquiry." (quoting Reed, 193 F.R.D. at 692)).
Accordingly, Plaintiffs' Motion to Compel Facebook's 30(b)(6) Deposition for Topics 1 and 2, above, is
In light of the foregoing, the Court
Dkt. No. 43 at 6. The Order further notes the Wiretap Act's ordinary course of business "exception must cover more than just `necessary' activities, . . . there [also] must be `some nexus between the need to engage in the alleged interception and the subscriber's ultimate business, that is, the ability to provide the underlying service or good.`" Id. at 11-12 (citations omitted).
Interrogatory No. 3 states: "For each Process and/or piece of Architecture identified in Interrogatory No. 2, identify whether — and the manner in which — such Process and/or piece of Architecture scans, analyzes, or extracts Private Message Content." Interrogatory No. 4 requests "For each Process and/or piece of Architecture identified in Interrogatory No. 3, identify all uses to which the scanned/analyzed/extracted Private Message Content — as well as any additional data, metadata or other content generated therefrom — are put." See Dkt. No. 121-4.