Carroll v. Wells Fargo & Company et al

Filing 141

STIPULATION AND ORDER re 140 SETTING FORTH DATA SECURITY PROTOCOLS GOVERNING PRODUCTION AND HANDLING OF CONFIDENTIAL EMPLOYEE DATA filed by Wells Fargo Bank, N.A., Wells Fargo & Company. Signed by Judge Edward M. Chen on 11/22/16. (bpfS, COURT STAFF) (Filed on 11/22/2016)

1
2
3
4
5
6
7

SEYFARTH SHAW LLP
Andrew M. McNaught (SBN 209093)
560 Mission Street, 31st Floor
San Francisco, California 94105
Telephone:
[phone]
Facsimile:
[phone]
[e-mail]

PADILLA & RODRIGUEZ, LLP
John M. Padilla (SBN 279815)
[e-mail]
601 S. Figueroa St., Suite 4050
Los Angeles, California 90017
Telephone: [phone]
Facsimile: [phone]

Richard L. Alfred (SBN 015000) (pro hac vice)
Two Seaport Lane, Suite 300
Boston, Massachusetts 02210
Telephone: [phone]
Facsimile: [phone]
[e-mail]

WILLS LAW FIRM, PLLC
Rhonda H. Wills (pro hac vice)
[e-mail]
Genevieve Estrada (pro hac vice)
[e-mail]
1776 Yorktown, Suite 570
Houston, Texas 77056
Telephone: [phone]
Facsimile: [phone]

8
9
10
11

Timothy M. Watson (SBN 20963575)
(pro hac vice)
700 Milam Street, Suite 1400
Houston, Texas 77002-2812
Telephone: [phone]
Facsimile: [phone]
[e-mail]

Attorneys for Plaintiffs
KELLY CARROLL, CHRYSTIANE LAYOG, and
the Putative Class

12
13

Attorneys for Defendants
WELLS FARGO & COMPANY and WELLS
FARGO BANK, N.A.

14
15
16

UNITED STATES DISTRICT COURT

17

NORTHERN DISTRICT OF CALIFORNIA

18

SAN FRANCISCO DIVISION

19
20
21

KELLY CARROLL, CHRYSTIANE LAYOG,
Individually and On Behalf of All Others Similarly
Situated,

22
23
24

Case No. 3:15-CV-02321 EMC
STIPULATED PROTECTIVE ORDER
SETTING FORTH DATA SECURITY
PROTOCOLS GOVERNING THE
PRODUCTION AND HANDLING OF
CONFIDENTIAL EMPLOYEE DATA;
AND [PROPOSED] ORDER REGARDING
SAME

Plaintiffs,
v.
WELLS FARGO & COMPANY, and WELLS
FARGO BANK, N.A.,

25

Judge: Hon. Edward M. Chen
Defendants.

26
27
28

1
STIPULATED PROTECTIVE ORDER REGARDING THE PRODUCTION AND HANDLING OF CONFIDENTIAL
DATA AND [PROPOSED] ORDER REGARDING SAME - CASE NO. 3:15-CV-02321 EMC
35801800v.1

1

1.

2

PURPOSE
Disclosure and discovery activity in this action will involve the production of data for current

3

and former employees of Defendants, including time and pay records, and personal contact information.

4

Wells Fargo contends this data is protected by third party privacy rights, which Wells Fargo is not

5

authorized to waive. Accordingly, the parties hereby stipulate to and petition the Court to enter the

6

following Stipulated Protective Order Setting Forth Data Security Protocols Governing the Production

7

and Handling of Employee Data Designated as Confidential, which will be effective along with the prior

8

Stipulated Protective Order entered by this Court on July 6, 2016 (“Prior Order”). The Prior Order is

9

incorporated herein by reference and made part of this order.

10

To maintain the security of its private employee data, and as the custodian of such data, to

11

protect against potential data breaches, Wells Fargo must ensure that appropriate information security

12

protocols are observed in connection with the production and handling of such data. Because the data

13

already ordered produced includes employee time and pay records, personal contact information, and

14

Employee ID numbers for putative class members, Wells Fargo will be designating and treating this data

15

as “Confidential” under the terms of the prior Stipulated Protective Order that was entered by this Court

16

on July 6, 2016. This Stipulated Protective Order Setting Forth Data Security Protocols Governing the

17

Production and Handling of Confidential Employee Data is meant to supplement the prior Stipulated

18

Protective Order, which remains in effect.

19

2.

20
21
22
23
24

DATA PROTECTION PROTOCOLS
Wells Fargo will observe the following protocols in connection with the provision of private

data, pursuant to modern generally accepted information security standards:
1.

Three copies of the production will be produced on three hard drives that feature hardware

level encryption to protect the data in transit;
2.

Beyond the hardware level encryption, the production data itself will be contained within a

25

VeraCrypt container that is protected by both a complex password and a keyfile. VeraCrypt is an open-

26

source cryptography software that has been extensively audited by information security experts to be a

27

secure method of data protection;

28

1
STIPULATED PROTECTIVE ORDER REGARDING THE PRODUCTION AND HANDLING OF CONFIDENTIAL
DATA AND [PROPOSED] ORDER REGARDING SAME - CASE NO. 3:15-CV-02321 EMC
35801800v.1

1

3.

Upon confirmation of delivery of the package to Plaintiffs’ counsel, Wells Fargo will

2

provide the following information via three separate communication methods in order to facilitate

3

Plaintiffs’ access to the data:

4

a.

The six digit hardware decryption PIN code;

5

b.

The VeraCrypt password;

6

c.

The VeraCrypt key file.

7

4.

Wells Fargo will also provide Plaintiffs’ counsel a very short guide on how to operate

8

VeraCrypt. Following the guide, accessing this data will take no more than five minutes.

9

5.

Everything Plaintiffs’ counsel needs to access the underlying data will be provided to

10

them by Wells Fargo. Plaintiffs’ counsel will not need to purchase any third party software to access the

11

data, or incur any expense whatsoever. By executing this document, Plaintiffs’ counsel confirms that in

12

accordance with the confidential and sensitive nature of the private data to be produced, that they and

13

their employees, and any experts they retain, will ensure this data remains encrypted while it is at rest

14

and not being used.

15

6.

Further, by executing this document, Plaintiffs’ counsel confirms that in addition to the

16

safeguards in paragraph 5, they will lock up the hard-drives in a secure location when not using the data.

17

As noted, the private data to be produced will fall within the bounds of the Stipulated Protective Order

18

filed July 6, 2016, and all of the provisions of that Order remain in effect and apply to the production of

19

private employee data. Plaintiffs’ counsel’s execution of this document further confirms their

20

willingness and ability, and that of any expert(s) they retain, to adhere to the protocols described herein

21

while this data is in the possession, custody, and control of Plaintiffs’ counsel and any experts they

22

retain.

23
24
25
26
27
28

2
STIPULATED PROTECTIVE ORDER REGARDING THE PRODUCTION AND HANDLING OF CONFIDENTIAL
DATA AND [PROPOSED] ORDER REGARDING SAME - CASE NO. 3:15-CV-02321 EMC
35801800v.1

1
2

Pursuant to Local Rule 5-1(i)(3), I certify that all other signatories listed, on whose behalf the
filing is submitted, concur in the filing’s content and have authorized the filing.

3
4

Dated: November 21, 2016

/s/ Andrew M. McNaught
Andrew M. McNaught

Dated: November 21, 2016

/s/ John M. Padilla
John M. Padilla
Counsel for Plaintiff

5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

3
STIPULATED PROTECTIVE ORDER REGARDING THE PRODUCTION AND HANDLING OF CONFIDENTIAL
DATA AND [PROPOSED] ORDER REGARDING SAME - CASE NO. 3:15-CV-02321 EMC
35801800v.1

GOOD CAUSE APPEARING, it is hereby ORDERED that Plaintiffs’ counsel and any experts
they retain comply with the provisions of this Order.
IT IS SO ORDERED.
Dated:

11/22/2016

RED

Hon. Edward IS SO ORDE
M. Chen

7

IT

UNITED STATES DISTRICT JUDGE
en
d M. Ch
e Edwar
Judg

8

RT

ER

H

10

FO

NO

9

LI

6

RT
U
O

5

S DISTRICT
TE
C
TA

11

A

4

R NIA

3

S

2

[PROPOSED] ORDER FOR STIPULATED PROTECTIVE ORDER REGARDING THE
PRODUCTION AND HANDLING OF CONFIDENTIAL DATA

UNIT
ED

1

N

F
D IS T IC T O
R

C

12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

4
STIPULATED PROTECTIVE ORDER REGARDING THE PRODUCTION AND HANDLING OF CONFIDENTIAL
DATA AND [PROPOSED] ORDER REGARDING SAME - CASE NO. 3:15-CV-02321 EMC
35801800v.1