Campbell et al v. Facebook Inc.

Filing 95

Joint Discovery Letter Brief Regarding Plaintiffs Request for Production No. 30 filed by Matthew Campbell, Michael Hurley, David Shadpour. (Attachments: # 1 Exhibits A - B)(Sobol, Michael) (Filed on 7/6/2015)

1

UNITED STATES DISTRICT COURT

2

NORTHERN DISTRICT OF CALIFORNIA

3

OAKLAND DIVISION

4
5

MATTHEW CAMPBELL, MICHAEL
HURLEY, and DAVID SHADPOUR,
Plaintiffs,

8

ATTESTATION IN SUPPORT OF JOINT
LETTER REGARDING PLAINTIFFS’
REQUEST FOR PRODUCTION NO. 30

Defendant.

6
7

Case No. C 13-05996 PJH (MEJ)

Date:
TBD
Time:
TBD
Location: San Francisco Courthouse
Courtroom B – 15th Floor
450 Golden Gate Avenue
San Francisco, CA 94102

v.
FACEBOOK, INC.,

9
10
11
12
13
14
15
16
17
18
19

Pursuant to the Discovery Standing Order for Magistrate Judge Maria-Elena James,
undersigned counsel hereby attest that they met and conferred in person in a good faith attempt to
resolve their disputes prior to filing the below joint letter.

Dated: July 6, 2015

Respectfully submitted,
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
By:

/s/
MICHAEL W. SOBOL

Attorneys for Plaintiffs

20
21

GIBSON, DUNN & CRUTCHER LLP

22
23
24

By:

/s/
JOSHUA A. JESSEN

Attorneys for Defendant Facebook, Inc.

25
26
27
28
1
ATTESTATION IN SUPPORT OF JOINT LETTER REGARDING PLAINTIFFS’ REQUEST FOR PRODUCTION
NO. 30 - Case No. C 13-05996 PJH (MEJ)

July 6, 2015
VIA ECF
The Honorable Maria-Elena James, Chief Magistrate Judge
United States District Court, Northern District of California
San Francisco Courthouse, Courtroom B - 15th Floor
450 Golden Gate Avenue, San Francisco, CA 94102
Re:

Campbell v. Facebook, Inc., N.D. Cal. Case No. 13-cv-05996-PJH (MEJ)

To The Hon. Maria-Elena James:
Plaintiffs and Defendant Facebook, Inc. jointly submit this letter brief pursuant to the Court’s
Discovery Standing Order.
I.

Background

This is a privacy case involving the alleged “scanning” of messages sent on Facebook’s
social media website, which Plaintiffs contend violates the federal Wiretap Act and Cal.
Penal Code § 631. Plaintiffs allege that Facebook scans the content of their and putative
class members’ private messages for use in connection with its “social plugin”
functionality—without consent. Specifically, Plaintiffs allege that Facebook scans the
content of class members’ messages, and if a link to a web page is in a message, Facebook
treats it as a “like” of the page, increasing the page’s “like” counter by one. Plaintiffs further
allege that Facebook uses this data regarding “likes” to compile user profiles, which it then
uses to deliver targeted advertising to users.
A dispute has arisen over discovery propounded by Plaintiffs (Request for Production No.
30) seeking documents and ESI related to audits of Facebook’s foreign affiliate, Facebook
Ireland Limited (“Facebook Ireland”), conducted by the Office of the Irish Data Protection
Commissioner (“IDPC”). During the meet and confer process, in a letter dated April 7,
2015, Plaintiffs agreed to limit this Request to the context of private messages.
Having conferred in person, the parties are now at an impasse and submit this joint letter
pursuant to the Court’s Discovery Standing Order. By way of this letter brief, Plaintiffs
request a responsive production to their narrowed Request for Production No. 30.
II.

Plaintiffs’ Position

Facebook fails to provide a factual or legal basis for any of its objections, and thus should be
compelled to provide all responsive, non-privileged documents. Facebook’s grounds for

July 6, 2015
Page 2

refusing to produce documents distill to (1) relevance and (2) international comity.1 As this
Court has observed, a relevant matter is “any matter that bears on, or that reasonably could
lead to other matters that could bear on, any issue that is or may be in the case.” Baptiste v.
Lids, 2013 U.S. Dist. LEXIS 150413 (N.D. Cal. Oct. 18, 2013) (quoting Oppenheimer Fund,
Inc. v. Sanders, 437 U.S. 340, 351, 98 S. Ct. 2380, 57 L. Ed. 2d 253 (1978)). The Request at
issue seeks highly relevant information related to regulatory investigations of Facebook’s
scanning of users’ private messages, the precise issue at the heart of this case. As part of a
2012 audit by the IDPC, Facebook was specifically asked “to provide information about
what, if any scanning (aside from anti-virus and anti-spam scanning) is performed on user’s
private message content.” Office of the Irish Data Protection Commissioner, Report of ReAudit of Facebook Ireland Ltd., 21 Sept. 2012, at Annex 1, Section 2.4 “Private Message
Content.” (emphasis added).2 Accordingly, this Request is not simply relevant; it goes to the
core inquiry in the case.
Moreover, Facebook has argued that some of its users may have known of its practices
related to scanning private messages, and thus impliedly consented to same. It is therefore
incontrovertibly relevant that a sophisticated regulatory body, having no idea that Facebook
was engaging in this behavior, sought clarification about “any scanning [of] user’s private
message content” occurring outside of anti-virus and anti-spam scanning. Id. (emphasis
added). To the extent that Facebook attempts to distance its “foreign” affiliate and “foreign”
customers from the practice at issue, it has made no showing that its message scanning
practices in the EU is any different from those in the US. Further, if there is a difference in
scanning practices, such differences would be highly relevant, showing a concern on
Facebook’s part to respect one continent’s privacy regime over the other’s.
Facebook’s untimely3 objection on grounds of international comity is equally infirm.
Arguing that production of relevant documents “could” arouse the displeasure of the IDPC,
Facebook neglects this Court’s holding that “[t]he party relying on foreign law has the
burden of showing such law bars production [of documents]." BrightEdge Techs., Inc. v.
Searchmetrics, GmbH, 2014 U.S. Dist. LEXIS 112377, *6 (N.D. Cal. Aug. 13, 2014) (citing
In re Air Crash at Taipei, Taiwan on Oct. 31, 2000, 211 F.R.D. 374, 377 (C.D. Cal. 2002).
1

Facebook appears to abandon the majority of its objections set forth in its April 1, 2015 Responses—
vagueness, protection of trade secrets, overbreadth/burden, and the public availability of the information sought.
2
Available at
https://dataprotection.ie/documents/press/Facebook_Ireland_Audit_Review_Report_21_Sept_2012.pdf
3
Facebook made no reference to a comity objection, “a potential chilling effect,” or speculation about
violations of unidentified Irish laws in its April 1, 2015 Responses. Richmark Corp. v. Timber Falling
Consultants, 959 F.2d 1468, 1473 (9th Cir. 1992) (“It is well established that a failure to object to discovery
requests within the time required constitutes a waiver of any objection.”) (citing Davis v. Fendler, 650 F.2d
1154, 1160 (9th Cir. 1981)).

July 6, 2015
Page 3

Facebook obliquely references, in a footnote, Paragraph 10 of Schedule 2 of Irish Data
Protection Acts of 1998 and 2003 without quoting it or contending that it actually applies.
The referenced language prohibits the Irish Data Commissioner from disclosing “any
information that is obtained by him or her in his capacity as Commissioner…that could
reasonably be regarded as confidential without the consent of the person to whom it relates.”4
This law prohibits disclosures on the part of the IDPC, and simply does not apply to
Facebook. The information sought by Request 30 relates to Facebook’s operations and
business practices, not to personally identifiable information of individuals that was obtained
by the IDPC. Accordingly, Facebook cites no authority precluding discovery on this issue
and thus fails to meet its burden, ending the inquiry.5
Regardless, even in instances where parties cite a specific, applicable foreign law “it is well
settled that such [foreign] statutes do not deprive an American court of the power to order a
party subject to its jurisdiction to produce evidence even though the act of production may
violate that statute.’” BrightEdge, 2014 U.S. Dist. LEXIS 112377, at *6 (quoting Societe
Nationale Industrielle Aerospatiale v. U. S. District Court, 482 U.S. 522, 544 fn 29, 107 S.
Ct. 2542, 96 L. Ed. 2d 461 (1987)). BrightEdge is particularly instructive. Under
circumstances almost identical to those of the instant litigation, this Court engaged in the
multi-factor balancing test set forth in the Restatement (Third) of Foreign Relations Law §
442—the precise test Facebook urges the Court to apply in the event it some day manages to
identify an applicable Irish law precluding discovery. Id. at *6-7. Applying that test, this
Court ordered the production of documents withheld on the basis of international privacy
protection laws of Germany and the EU. Id. at *16. See also Stella Sys., LLC v.
Medeanalytics, Inc., 2015 U.S. Dist. LEXIS 23534 (N.D. Cal. Feb. 25, 2015) (adopting
“BrightEdge's statement of the governing legal standard” and compelling production of
documents originally withheld pursuant to Ukrainian privacy law).
Accordingly, Facebook should be compelled to produce all non-privileged documents
responsive to Plaintiffs’ Request for Production No. 30.
III.

Facebook’s Position

Plaintiffs’ request for documents responsive to Request No. 30 should be denied. The
request seeks the production of communications between Facebook’s foreign affiliate
(Facebook Ireland) and the Irish Data Protection Commissioner (IDPC). These confidential
communications between a foreign company and a foreign regulator relate to a service
4

Available at http://www.dataprotection.ie/documents/legal/DPAConsolMay09.pdf
Further, to the extent that Facebook fears “public disclosure” of the documents at issue, such concern is
obviated by the fact Facebook may designate its production “confidential” pursuant to the protective order in
place in this litigation.

5

July 6, 2015
Page 4

directed to and used by foreign individuals who are not part of the putative class. Such
communications have no relevance to Plaintiffs’ claims for violations of U.S. and California
law. Moreover, compelled production of these irrelevant, confidential communications
would implicate concerns raised by the IDPC regarding the potential chilling effect that
public disclosure of confidential communications with the entities it regulates would have on
those entities’ candid engagement with the IDPC.
First, the requested documents are outside the scope of permissible discovery. Plaintiffs
have “the initial burden of establishing that [their] request satisfies the relevancy
requirements of Rule 26(b)(1).” Ellis v. J.P. Morgan Chase & Co., Case No. 12-cv-03897,
2014 WL 1510884, at *3 (N.D. Cal. Apr. 1, 2014). They have not done so. Plaintiffs’
claims in this case are limited to challenging specific functionality alleged to have been
operative on the U.S. Facebook website on behalf of “Facebook users located within the
United States” in purported violation of U.S. and California law. (CAC, Dkt. 25, ¶ 59; see
also id. ¶ 1.) Confidential communications between Facebook Ireland and the IDPC
regarding services used by European and other non-U.S. users are irrelevant to Plaintiffs’
U.S. claims. Indeed, “to the extent that Plaintiffs seek discovery with respect to persons or
entities that are not members of the putative class that Plaintiffs have alleged, they are going
beyond the scope of the complaint in this action, and that is beyond the scope of permissible
discovery.” Hughes v. LaSalle Bank, N.A., 2004 WL 414828, at *1-2 (S.D.N.Y. Mar. 4,
2004); see also Flores v. Bank of America, 2012 WL 6725842, at *2-4 (S.D. Cal. Dec. 27,
2012) (denying motion to compel discovery that fell outside the class definition).
Plaintiffs previously have made three arguments to justify the purported relevance of these
confidential foreign regulatory communications. Each fails. (1) Plaintiffs contended that
this information is necessary to understand how the Facebook messages product “works,” but
Facebook has agreed to make the relevant source code in the U.S. available for Plaintiffs’
inspection (Dkt. Nos. 90, 92); thus, by their own admission, Plaintiffs now have access to the
“black box” that shows them how the challenged conduct operated; (2) Plaintiffs argued that
the communications may contain “misrepresentations” regarding the functionality at issue,
but Plaintiffs have no fraud or misrepresentation claim of any kind, and Judge Hamilton
dismissed their Unfair Competition Law Claim (see Dkt. 43); (3) Plaintiffs contended that
Facebook Ireland’s statements may bear on the issue of “implied consent,” but the argument
makes no sense—the communications at issue were confidential and thus could not have
informed the expectations of any users (much less users in the United States).
Second, disclosure may obstruct effective regulation by the IDPC. As recently as a few days
ago, the IDPC reiterated that the confidentiality of its communications with the entities it
regulates is critical to the success of its regulatory objectives: “In common with many
regulators around the world, it is not possible to publicly disclose details of our engagement
with these organisations, as this could negatively impact on the frankness of those

July 6, 2015
Page 5

conversations and therefore make effective regulation more difficult.” 2014 Annual Report
of the Data Protection Commissioner of Ireland (published June 23, 2015).6 The discussions
referenced by the IDPC are precisely the same type of communications sought by Request
No. 30—candid communications between the IDPC and Facebook Ireland. There can be
little doubt that foreign companies will be less forthcoming with the IDPC in the future if
they know that their communications may be judged and dissected for entirely unrelated
purposes in a United States court. Moreover, as Plaintiffs acknowledge, the results of the
IDPC’s audit of Facebook Ireland are publicly available. Plaintiffs have no need for the
confidential communications between the IDPC and Facebook Ireland relating to the audit.
Indeed, Facebook Ireland could be subject to equitable proceedings by the IDPC if it were to
produce these documents.7 Therefore, if this Court were to find that the materials sought by
Plaintiffs are relevant to their claims, Facebook will seek permission from the IDPC for
production, and, in the event that permission is denied, bring a motion for protective order on
grounds that the production may violate Irish Law, and that this Court should defer to that
law pursuant to the balancing test embodied in the Restatement (Third) on Foreign Relations
Law § 442 (1987). See, e.g., In re Rubber Chem. Antitrust Litig., 486 F. Supp. 2d 1078, 1082
(N.D. Cal. 2007) (denying production of documents between foreign affiliate and European
Commission).8 Respectfully, however, the Court should simply deny Plaintiffs’ request as
irrelevant and beyond the scope of permissible discovery. Facebook requests a hearing if the
Court is inclined to order the production of these documents.

6

Available at https://www.dataprotection.ie/docimages/documents/Annual%20Report%202014.pdf.
The IDPC is under an explicit statutory confidentiality obligation per Paragraph 10 of Schedule 2 of the Irish
Data Protection Acts 1988 and 2003, and may not disclose confidential information received from Facebook
Ireland. Additionally, the emails from the IDPC to Facebook Ireland include a footer prohibiting dissemination
on grounds of confidentiality. Thus, the nature of the communications, the relationship between the parties, and
the express prohibition on dissemination by the IDCP likely created an equitable duty of confidence under Irish
law that would be breached by Facebook’s disclosure in the context of this litigation. See House of Spring
Gardens v. Point Blank [1984] IR 611, 613, 663-64 (available on LEXIS). (For the Court’s convenience,
Facebook proposed attaching a copy of this Irish case to this joint letter. Plaintiffs objected, however, on the
basis that doing so would violate the Court’s Discovery Standing Order. Facebook therefore did not attach a
copy of the case. If the Court has difficulty locating a copy of this case, however, Facebook remains willing to
supply the Court with a copy.)
8
BrightEdge Tech., Inc. v. Searchmetrics GmbH, 2014 U.S. Dist. LEXIS 112377, at *8, 13 (N.D. Cal. Aug. 13,
2014), is inapposite—there, the Court found that the discovery “as to damages, royalty and willfulness” was
“relevant to prosecution of a patent infringement case,” and the information could not “be obtained from
another source.” Likewise, in Stella Sys., LLC v. Medeanalytics, 2015 U.S. Dist. LEXIS 23534, at *1-2 (N.D.
Cal. Feb. 25, 2015), “the requested information [was] relevant to several issues in this case[.]” Here, in
contrast, Plaintiffs have not explained how the requested communications are relevant to any element of their
claims, and they are already being given access to relevant source code.
7