STIPULATED PROTECTIVE ORDER SETTING FORTH DATA SECURITY PROTOCOLS GOVERNING THE PRODUCTION AND HANDLING OF CONFIDENTIAL EMPLOYEE DATA; AND [PROPOSED] ORDER REGARDING SAME

EDWARD M. CHEN, District Judge.

1. PURPOSE

Disclosure and discovery activity in this action will involve the production of data for current and former employees of Defendants, including time and pay records, and personal contact information. Wells Fargo contends this data is protected by third party privacy rights, which Wells Fargo is not authorized to waive. Accordingly, the parties hereby stipulate to and petition the Court to enter the following Stipulated Protective Order Setting Forth Data Security Protocols Governing the Production and Handling of Employee Data Designated as Confidential, which will be effective along with the prior Stipulated Protective Order entered by this Court on July 6, 2016 ("Prior Order"). The Prior Order is incorporated herein by reference and made part of this order.

To maintain the security of its private employee data, and as the custodian of such data, to protect against potential data breaches, Wells Fargo must ensure that appropriate information security protocols are observed in connection with the production and handling of such data. Because the data already ordered produced includes employee time and pay records, personal contact information, and Employee ID numbers for putative class members, Wells Fargo will be designating and treating this data as "Confidential" under the terms of the prior Stipulated Protective Order that was entered by this Court on July 6, 2016. This Stipulated Protective Order Setting Forth Data Security Protocols Governing the Production and Handling of Confidential Employee Data is meant to supplement the prior Stipulated Protective Order, which remains in effect.

2. DATA PROTECTION PROTOCOLS

Wells Fargo will observe the following protocols in connection with the provision of private data, pursuant to modern generally accepted information security standards:

1. Three copies of the production will be produced on three hard drives that feature hardware level encryption to protect the data in transit;

2. Beyond the hardware level encryption, the production data itself will be contained within a VeraCrypt container that is protected by both a complex password and a keyfile. VeraCrypt is an open-source cryptography software that has been extensively audited by information security experts to be a secure method of data protection;

3. Upon confirmation of delivery of the package to Plaintiffs' counsel, Wells Fargo will provide the following information via three separate communication methods in order to facilitate Plaintiffs' access to the data:

4. Wells Fargo will also provide Plaintiffs' counsel a very short guide on how to operate VeraCrypt. Following the guide, accessing this data will take no more than five minutes.

5. Everything Plaintiffs' counsel needs to access the underlying data will be provided to them by Wells Fargo. Plaintiffs' counsel will not need to purchase any third party software to access the data, or incur any expense whatsoever. By executing this document, Plaintiffs' counsel confirms that in accordance with the confidential and sensitive nature of the private data to be produced, that they and their employees, and any experts they retain, will ensure this data remains encrypted while it is at rest and not being used.

6. Further, by executing this document, Plaintiffs' counsel confirms that in addition to the safeguards in paragraph 5, they will lock up the hard-drives in a secure location when not using the data. As noted, the private data to be produced will fall within the bounds of the Stipulated Protective Order filed July 6, 2016, and all of the provisions of that Order remain in effect and apply to the production of private employee data. Plaintiffs' counsel's execution of this document further confirms their willingness and ability, and that of any expert(s) they retain, to adhere to the protocols described herein while this data is in the possession, custody, and control of Plaintiffs' counsel and any experts they retain.

Pursuant to Local Rule 5-1(i)(3), I certify that all other signatories listed, on whose behalf the filing is submitted, concur in the filing's content and have authorized the filing.

[PROPOSED] ORDER FOR STIPULATED PROTECTIVE ORDER REGARDING THE PRODUCTION AND HANDLING OF CONFIDENTIAL DATA

GOOD CAUSE APPEARING, it is hereby ORDERED that Plaintiffs' counsel and any experts they retain comply with the provisions of this Order.

IT IS SO ORDERED.