Campbell et al v. Facebook Inc.

Filing 95

Joint Discovery Letter Brief Regarding Plaintiffs Request for Production No. 30 filed by Matthew Campbell, Michael Hurley, David Shadpour. (Attachments: # 1 Exhibits A - B)(Sobol, Michael) (Filed on 7/6/2015)

Download PDF
1 UNITED STATES DISTRICT COURT 2 NORTHERN DISTRICT OF CALIFORNIA 3 OAKLAND DIVISION 4 5 MATTHEW CAMPBELL, MICHAEL HURLEY, and DAVID SHADPOUR, Plaintiffs, 8 ATTESTATION IN SUPPORT OF JOINT LETTER REGARDING PLAINTIFFS’ REQUEST FOR PRODUCTION NO. 30 Defendant. 6 7 Case No. C 13-05996 PJH (MEJ) Date: TBD Time: TBD Location: San Francisco Courthouse Courtroom B – 15th Floor 450 Golden Gate Avenue San Francisco, CA 94102 v. FACEBOOK, INC., 9 10 11 12 13 14 15 16 17 18 19 Pursuant to the Discovery Standing Order for Magistrate Judge Maria-Elena James, undersigned counsel hereby attest that they met and conferred in person in a good faith attempt to resolve their disputes prior to filing the below joint letter. Dated: July 6, 2015 Respectfully submitted, LIEFF CABRASER HEIMANN & BERNSTEIN, LLP By: /s/ MICHAEL W. SOBOL Attorneys for Plaintiffs 20 21 GIBSON, DUNN & CRUTCHER LLP 22 23 24 By: /s/ JOSHUA A. JESSEN Attorneys for Defendant Facebook, Inc. 25 26 27 28 1 ATTESTATION IN SUPPORT OF JOINT LETTER REGARDING PLAINTIFFS’ REQUEST FOR PRODUCTION NO. 30 - Case No. C 13-05996 PJH (MEJ) July 6, 2015 VIA ECF The Honorable Maria-Elena James, Chief Magistrate Judge United States District Court, Northern District of California San Francisco Courthouse, Courtroom B - 15th Floor 450 Golden Gate Avenue, San Francisco, CA 94102 Re: Campbell v. Facebook, Inc., N.D. Cal. Case No. 13-cv-05996-PJH (MEJ) To The Hon. Maria-Elena James: Plaintiffs and Defendant Facebook, Inc. jointly submit this letter brief pursuant to the Court’s Discovery Standing Order. I. Background This is a privacy case involving the alleged “scanning” of messages sent on Facebook’s social media website, which Plaintiffs contend violates the federal Wiretap Act and Cal. Penal Code § 631. Plaintiffs allege that Facebook scans the content of their and putative class members’ private messages for use in connection with its “social plugin” functionality—without consent. Specifically, Plaintiffs allege that Facebook scans the content of class members’ messages, and if a link to a web page is in a message, Facebook treats it as a “like” of the page, increasing the page’s “like” counter by one. Plaintiffs further allege that Facebook uses this data regarding “likes” to compile user profiles, which it then uses to deliver targeted advertising to users. A dispute has arisen over discovery propounded by Plaintiffs (Request for Production No. 30) seeking documents and ESI related to audits of Facebook’s foreign affiliate, Facebook Ireland Limited (“Facebook Ireland”), conducted by the Office of the Irish Data Protection Commissioner (“IDPC”). During the meet and confer process, in a letter dated April 7, 2015, Plaintiffs agreed to limit this Request to the context of private messages. Having conferred in person, the parties are now at an impasse and submit this joint letter pursuant to the Court’s Discovery Standing Order. By way of this letter brief, Plaintiffs request a responsive production to their narrowed Request for Production No. 30. II. Plaintiffs’ Position Facebook fails to provide a factual or legal basis for any of its objections, and thus should be compelled to provide all responsive, non-privileged documents. Facebook’s grounds for July 6, 2015 Page 2 refusing to produce documents distill to (1) relevance and (2) international comity.1 As this Court has observed, a relevant matter is “any matter that bears on, or that reasonably could lead to other matters that could bear on, any issue that is or may be in the case.” Baptiste v. Lids, 2013 U.S. Dist. LEXIS 150413 (N.D. Cal. Oct. 18, 2013) (quoting Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340, 351, 98 S. Ct. 2380, 57 L. Ed. 2d 253 (1978)). The Request at issue seeks highly relevant information related to regulatory investigations of Facebook’s scanning of users’ private messages, the precise issue at the heart of this case. As part of a 2012 audit by the IDPC, Facebook was specifically asked “to provide information about what, if any scanning (aside from anti-virus and anti-spam scanning) is performed on user’s private message content.” Office of the Irish Data Protection Commissioner, Report of ReAudit of Facebook Ireland Ltd., 21 Sept. 2012, at Annex 1, Section 2.4 “Private Message Content.” (emphasis added).2 Accordingly, this Request is not simply relevant; it goes to the core inquiry in the case. Moreover, Facebook has argued that some of its users may have known of its practices related to scanning private messages, and thus impliedly consented to same. It is therefore incontrovertibly relevant that a sophisticated regulatory body, having no idea that Facebook was engaging in this behavior, sought clarification about “any scanning [of] user’s private message content” occurring outside of anti-virus and anti-spam scanning. Id. (emphasis added). To the extent that Facebook attempts to distance its “foreign” affiliate and “foreign” customers from the practice at issue, it has made no showing that its message scanning practices in the EU is any different from those in the US. Further, if there is a difference in scanning practices, such differences would be highly relevant, showing a concern on Facebook’s part to respect one continent’s privacy regime over the other’s. Facebook’s untimely3 objection on grounds of international comity is equally infirm. Arguing that production of relevant documents “could” arouse the displeasure of the IDPC, Facebook neglects this Court’s holding that “[t]he party relying on foreign law has the burden of showing such law bars production [of documents]." BrightEdge Techs., Inc. v. Searchmetrics, GmbH, 2014 U.S. Dist. LEXIS 112377, *6 (N.D. Cal. Aug. 13, 2014) (citing In re Air Crash at Taipei, Taiwan on Oct. 31, 2000, 211 F.R.D. 374, 377 (C.D. Cal. 2002). 1 Facebook appears to abandon the majority of its objections set forth in its April 1, 2015 Responses— vagueness, protection of trade secrets, overbreadth/burden, and the public availability of the information sought. 2 Available at 3 Facebook made no reference to a comity objection, “a potential chilling effect,” or speculation about violations of unidentified Irish laws in its April 1, 2015 Responses. Richmark Corp. v. Timber Falling Consultants, 959 F.2d 1468, 1473 (9th Cir. 1992) (“It is well established that a failure to object to discovery requests within the time required constitutes a waiver of any objection.”) (citing Davis v. Fendler, 650 F.2d 1154, 1160 (9th Cir. 1981)). July 6, 2015 Page 3 Facebook obliquely references, in a footnote, Paragraph 10 of Schedule 2 of Irish Data Protection Acts of 1998 and 2003 without quoting it or contending that it actually applies. The referenced language prohibits the Irish Data Commissioner from disclosing “any information that is obtained by him or her in his capacity as Commissioner…that could reasonably be regarded as confidential without the consent of the person to whom it relates.”4 This law prohibits disclosures on the part of the IDPC, and simply does not apply to Facebook. The information sought by Request 30 relates to Facebook’s operations and business practices, not to personally identifiable information of individuals that was obtained by the IDPC. Accordingly, Facebook cites no authority precluding discovery on this issue and thus fails to meet its burden, ending the inquiry.5 Regardless, even in instances where parties cite a specific, applicable foreign law “it is well settled that such [foreign] statutes do not deprive an American court of the power to order a party subject to its jurisdiction to produce evidence even though the act of production may violate that statute.’” BrightEdge, 2014 U.S. Dist. LEXIS 112377, at *6 (quoting Societe Nationale Industrielle Aerospatiale v. U. S. District Court, 482 U.S. 522, 544 fn 29, 107 S. Ct. 2542, 96 L. Ed. 2d 461 (1987)). BrightEdge is particularly instructive. Under circumstances almost identical to those of the instant litigation, this Court engaged in the multi-factor balancing test set forth in the Restatement (Third) of Foreign Relations Law § 442—the precise test Facebook urges the Court to apply in the event it some day manages to identify an applicable Irish law precluding discovery. Id. at *6-7. Applying that test, this Court ordered the production of documents withheld on the basis of international privacy protection laws of Germany and the EU. Id. at *16. See also Stella Sys., LLC v. Medeanalytics, Inc., 2015 U.S. Dist. LEXIS 23534 (N.D. Cal. Feb. 25, 2015) (adopting “BrightEdge's statement of the governing legal standard” and compelling production of documents originally withheld pursuant to Ukrainian privacy law). Accordingly, Facebook should be compelled to produce all non-privileged documents responsive to Plaintiffs’ Request for Production No. 30. III. Facebook’s Position Plaintiffs’ request for documents responsive to Request No. 30 should be denied. The request seeks the production of communications between Facebook’s foreign affiliate (Facebook Ireland) and the Irish Data Protection Commissioner (IDPC). These confidential communications between a foreign company and a foreign regulator relate to a service 4 Available at Further, to the extent that Facebook fears “public disclosure” of the documents at issue, such concern is obviated by the fact Facebook may designate its production “confidential” pursuant to the protective order in place in this litigation. 5 July 6, 2015 Page 4 directed to and used by foreign individuals who are not part of the putative class. Such communications have no relevance to Plaintiffs’ claims for violations of U.S. and California law. Moreover, compelled production of these irrelevant, confidential communications would implicate concerns raised by the IDPC regarding the potential chilling effect that public disclosure of confidential communications with the entities it regulates would have on those entities’ candid engagement with the IDPC. First, the requested documents are outside the scope of permissible discovery. Plaintiffs have “the initial burden of establishing that [their] request satisfies the relevancy requirements of Rule 26(b)(1).” Ellis v. J.P. Morgan Chase & Co., Case No. 12-cv-03897, 2014 WL 1510884, at *3 (N.D. Cal. Apr. 1, 2014). They have not done so. Plaintiffs’ claims in this case are limited to challenging specific functionality alleged to have been operative on the U.S. Facebook website on behalf of “Facebook users located within the United States” in purported violation of U.S. and California law. (CAC, Dkt. 25, ¶ 59; see also id. ¶ 1.) Confidential communications between Facebook Ireland and the IDPC regarding services used by European and other non-U.S. users are irrelevant to Plaintiffs’ U.S. claims. Indeed, “to the extent that Plaintiffs seek discovery with respect to persons or entities that are not members of the putative class that Plaintiffs have alleged, they are going beyond the scope of the complaint in this action, and that is beyond the scope of permissible discovery.” Hughes v. LaSalle Bank, N.A., 2004 WL 414828, at *1-2 (S.D.N.Y. Mar. 4, 2004); see also Flores v. Bank of America, 2012 WL 6725842, at *2-4 (S.D. Cal. Dec. 27, 2012) (denying motion to compel discovery that fell outside the class definition). Plaintiffs previously have made three arguments to justify the purported relevance of these confidential foreign regulatory communications. Each fails. (1) Plaintiffs contended that this information is necessary to understand how the Facebook messages product “works,” but Facebook has agreed to make the relevant source code in the U.S. available for Plaintiffs’ inspection (Dkt. Nos. 90, 92); thus, by their own admission, Plaintiffs now have access to the “black box” that shows them how the challenged conduct operated; (2) Plaintiffs argued that the communications may contain “misrepresentations” regarding the functionality at issue, but Plaintiffs have no fraud or misrepresentation claim of any kind, and Judge Hamilton dismissed their Unfair Competition Law Claim (see Dkt. 43); (3) Plaintiffs contended that Facebook Ireland’s statements may bear on the issue of “implied consent,” but the argument makes no sense—the communications at issue were confidential and thus could not have informed the expectations of any users (much less users in the United States). Second, disclosure may obstruct effective regulation by the IDPC. As recently as a few days ago, the IDPC reiterated that the confidentiality of its communications with the entities it regulates is critical to the success of its regulatory objectives: “In common with many regulators around the world, it is not possible to publicly disclose details of our engagement with these organisations, as this could negatively impact on the frankness of those July 6, 2015 Page 5 conversations and therefore make effective regulation more difficult.” 2014 Annual Report of the Data Protection Commissioner of Ireland (published June 23, 2015).6 The discussions referenced by the IDPC are precisely the same type of communications sought by Request No. 30—candid communications between the IDPC and Facebook Ireland. There can be little doubt that foreign companies will be less forthcoming with the IDPC in the future if they know that their communications may be judged and dissected for entirely unrelated purposes in a United States court. Moreover, as Plaintiffs acknowledge, the results of the IDPC’s audit of Facebook Ireland are publicly available. Plaintiffs have no need for the confidential communications between the IDPC and Facebook Ireland relating to the audit. Indeed, Facebook Ireland could be subject to equitable proceedings by the IDPC if it were to produce these documents.7 Therefore, if this Court were to find that the materials sought by Plaintiffs are relevant to their claims, Facebook will seek permission from the IDPC for production, and, in the event that permission is denied, bring a motion for protective order on grounds that the production may violate Irish Law, and that this Court should defer to that law pursuant to the balancing test embodied in the Restatement (Third) on Foreign Relations Law § 442 (1987). See, e.g., In re Rubber Chem. Antitrust Litig., 486 F. Supp. 2d 1078, 1082 (N.D. Cal. 2007) (denying production of documents between foreign affiliate and European Commission).8 Respectfully, however, the Court should simply deny Plaintiffs’ request as irrelevant and beyond the scope of permissible discovery. Facebook requests a hearing if the Court is inclined to order the production of these documents. 6 Available at The IDPC is under an explicit statutory confidentiality obligation per Paragraph 10 of Schedule 2 of the Irish Data Protection Acts 1988 and 2003, and may not disclose confidential information received from Facebook Ireland. Additionally, the emails from the IDPC to Facebook Ireland include a footer prohibiting dissemination on grounds of confidentiality. Thus, the nature of the communications, the relationship between the parties, and the express prohibition on dissemination by the IDCP likely created an equitable duty of confidence under Irish law that would be breached by Facebook’s disclosure in the context of this litigation. See House of Spring Gardens v. Point Blank [1984] IR 611, 613, 663-64 (available on LEXIS). (For the Court’s convenience, Facebook proposed attaching a copy of this Irish case to this joint letter. Plaintiffs objected, however, on the basis that doing so would violate the Court’s Discovery Standing Order. Facebook therefore did not attach a copy of the case. If the Court has difficulty locating a copy of this case, however, Facebook remains willing to supply the Court with a copy.) 8 BrightEdge Tech., Inc. v. Searchmetrics GmbH, 2014 U.S. Dist. LEXIS 112377, at *8, 13 (N.D. Cal. Aug. 13, 2014), is inapposite—there, the Court found that the discovery “as to damages, royalty and willfulness” was “relevant to prosecution of a patent infringement case,” and the information could not “be obtained from another source.” Likewise, in Stella Sys., LLC v. Medeanalytics, 2015 U.S. Dist. LEXIS 23534, at *1-2 (N.D. Cal. Feb. 25, 2015), “the requested information [was] relevant to several issues in this case[.]” Here, in contrast, Plaintiffs have not explained how the requested communications are relevant to any element of their claims, and they are already being given access to relevant source code. 7

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?