Veridian Credit Union v. Eddie Bauer LLC

Filing 128

ORDER granting in part and denying in part Defendant's 115 Motion to Compel signed by Judge James L. Robart. (TH)

Download PDF
1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE 8 9 VERIDIAN CREDIT UNION, 10 ORDER ON MOTION TO COMPEL Plaintiff, 11 CASE NO. C17-0356JLR v. 12 EDDIE BAUER, LLC, 13 Defendant. 14 15 I. INTRODUCTION Before the court is Defendant Eddie Bauer, LLC’s motion to compel. (MTC (Dkt. 16 17 # 115).) Plaintiff Veridian Credit Union (“Veridian”) opposes the motion. (Resp. (Dkt. 18 # 120).) The court has considered the motion, the parties’ submissions in support of and 19 // 20 // 21 // 22 // ORDER - 1 1 in opposition to the motion, the relevant portions of the record, and the applicable law. 1 2 Being fully advised,2 the court GRANTS in part and DENIES in part Eddie Bauer’s 3 motion for the reasons set forth below. 4 II. BACKGROUND 5 This is a putative class action “on behalf of credit unions, banks, and other 6 financial institutions that suffered injury as a result of a security breach” involving Eddie 7 Bauer from about January 2, 2016, to July 17, 2016. (See SAC (Dkt. # 70) ¶ 1.) Veridian 8 alleges that the breach compromised the financial data of thousands of customers at all of 9 Eddie Bauer’s 370 retail stores in the United States and Canada. (Id.) Veridian further 10 alleges that the breach occurred because Eddie Bauer failed to “adequately secure its data 11 networks.” (Id. ¶ 2.) Specifically, Veridian states that Eddie Bauer “systematically failed 12 to maintain adequate data security measures, implement best practices, upgrade security 13 systems, and comply with industry standards.” (Id. ¶ 3.) Veridian contends that Eddie 14 Bauer failed to mitigate the damage the breach caused and exacerbated the damage by 15 failing to notify customers of the breach until about six weeks after it had occurred. (Id. 16 ¶¶ 4-5.) 17 // 18 19 20 21 22 Eddie Bauer’s supplemental brief does not comply with Local Civil Rule 10(e)(1), which requires “[t]he text of any typed . . . brief [to] be 12 point or larger.” (See generally EB Supp. (Dkt. # 122)); Local Rules W.D. Wash. LCR 10(e)(1). The court will not permit either party to violate its local rules and will consider appropriate sanctions for any future violations. 1 2 Neither party requests oral argument (MTC at 1; Resp. at 1), and the court determines that oral argument would not be helpful to its disposition of the motion, see Local Rules W.D. Wash. LCR 7(b)(4). ORDER - 2 1 As a result of the alleged breach and resulting harm to customers, Veridian 2 contends that the financial institutions in the class have incurred significant costs related 3 to: (1) notifying customers of the breach; (2) canceling or reissuing credit and debit cards 4 compromised by the breach; (3) closing, opening, and/or reopening any accounts affected 5 by the breach; (4) refunding or crediting cardholders for unauthorized transactions; (4) 6 responding to a greater number of customer inquiries; (5) increasing their fraud 7 monitoring; and (6) losing revenue. (Id. ¶ 8.) Veridian contends that Eddie Bauer has 8 not offered any of the affected financial institutions “any compensation for the fraud 9 losses or reissuance costs associated with [the compromised] credit and debit cards.” 10 (See id. ¶ 31.) Veridian brings claims for negligence; violation of RCW 19.255.020; and 11 violation of Washington’s Consumer Protection Act (“CPA”), RCW ch. 19.86, et seq. 12 (Id. ¶ 10.) It seeks damages and declaratory and injunctive relief. (Id.) 13 In detailing the alleged deficiencies with Eddie Bauer’s security, Veridian relies in 14 part on statements from two sources: (1) a former Information Security Manager (“IS 15 Manager”), and (2) an IT consultant (“IT Consultant”). (See, e.g., id. ¶¶ 41 (IS Manager), 16 65 (IT Consultant).) The IS Manager “described Eddie Bauer management’s approach 17 toward the security of its [point of sale (“POS”)] environment as minimalistic and low 18 priority.” (Id. ¶ 41; see also id. (describing Eddie Bauer’s approach as “bare 19 minimum”).) According to that person, Eddie Bauer failed to timely implement security 20 patches and refused to implement recommended critical data security measures. (Id. 21 ¶ 41; see also id. ¶ 57 (stating that Eddie Bauer refused to “update vital software 22 programs to remove the ‘bugs’ and other vulnerabilities”).) The IS Manager further ORDER - 3 1 stated that Eddie Bauer did not “implement a multi-factor authentication process for its 2 POS environment.” (Id. ¶ 74.) Eddie Bauer allegedly failed to implement those 3 measures because it was unwilling to spend the money necessary to secure its payment 4 systems. (See id. ¶¶ 63-64; see also id. ¶ 70.) 5 In 2014 and 2015, Eddie Bauer retained a third-party IT consulting firm to 6 evaluate those systems. (Id. ¶ 64.) The firm identified “two primary security initiatives”: 7 (1) “point-to-point encryption,” and (2) “tokenization of the POS environment.” (Id.) 8 That firm’s IT Consultant recommended that Eddie Bauer encrypt and tokenize the POS 9 environment in all of its stores (see id. ¶¶ 65-66, 68), but Eddie Bauer allegedly did not 10 do so (see id. ¶ 81). 11 On August 2, 2018, Eddie Bauer moved to compel the production of documents 12 responsive to its requests for production (“RFPs”) No. 18 and 19. (See MTC.) RFPs No. 13 18 and 19 ask Veridian to produce the following: 14 REQUEST FOR PRODUCTION NO. 18: Documents memorializing all communications with the “former Information Security Manager (‘IS Manager’)” referred to in paragraph 41 of [Veridian’s] Amended Class Action Complaint. 15 16 REQUEST FOR PRODUCTION NO. 19: Documents memorializing all communications with the “IT Consultant” referred to in paragraph 65 of [Veridian’s] Amended Class Action Complaint.3 17 18 19 // 20 21 22 Eddie Bauer notes that its RFPs refer to Veridian’s first amended complaint but avers that the RFPs are nevertheless relevant because Veridian makes the same allegations in the second amended complaint. (See MTC at 3 n.2.) 3 ORDER - 4 1 (Id. at 3-4.) Veridian refused to produce responsive documents on the basis of attorney 2 client privilege and the work product privilege. (See Nelson Decl. (Dkt. # 116) ¶ 6, Ex. A 3 at 12-13; id. ¶ 7, Ex. B at 13-14.) The court now considers Eddie Bauer’s motion. 4 5 III. ANALYSIS Eddie Bauer argues that Veridian has waived the work product privilege by 6 making affirmative allegations regarding the IS Manager and the IT Consultant.4 (See 7 MTC at 8.) Thus, Veridian has made its communications with those people discoverable 8 by placing the communications in issue. (Id.) Although Veridian has since identified the 9 IS Manager and IT Consultant, Eddie Bauer claims that deposing them is insufficient 10 11 because “[m]emories fade.” (Id. at 9 n.6.) Veridian counters that the privilege protects the communications because they 12 “occurred solely because of the instant litigation.” (Resp. at 7.) Veridian states that 13 responsive documents include (1) “communications between Veridian and its counsel,” 14 (2) “communications among Veridian’s counsel reflecting mental impressions regarding 15 their investigation and litigation strategy,” and (3) “documents reflecting the mental 16 impressions of Veridian’s counsel in preparing the complaint.” (Id. at 8.) Veridian 17 argues that Eddie Bauer has not demonstrated a substantial need for those documents. 18 19 20 21 22 Despite Veridian’s objection to the RFPs on the basis of attorney client privilege, Eddie Bauer does not make any substantive argument on that point. (See generally MTC.) In addition, Veridian states that based on recent clarification from counsel for Eddie Bauer, Eddie Bauer does not seek communications between Veridian and its counsel, and therefore proposes to further amend its responses to RFPs No. 18 and 19 to withdraw the attorney client privilege objection. (See Veridian Supp. (Dkt. # 124) at 2.) For those reasons, the court GRANTS Veridian’s proposal to withdraw that objection, and Veridian must serve its amended responses by the same deadline set forth below. 4 ORDER - 5 1 (See id. at 8-9.) Moreover, Veridian contends that it has not waived the privilege. (See 2 id. at 9-12.) 3 The work product doctrine is a qualified protection limiting discovery of 4 “documents and tangible things” prepared by a party or its attorney in anticipation of 5 litigation. See Admiral Ins. Co. v. U.S. Dist. Court for Dist. of Ariz., 881 F.2d 1486, 1494 6 (9th Cir. 1989); see also Fed. R. Civ. P. 26(b)(3)(A). “The doctrine seeks to preserve the 7 privacy of an attorney’s thought processes, encourage careful and thorough preparation 8 by the attorney without undue and needless interference, and prevent exploitation of a 9 party’s efforts in preparing for litigation.” E.E.O.C. v. Safeway Store, Inc., 10 No. C-00-3155 THE(EMC), 2002 WL 31947153, at *4 (N.D. Cal. Sept. 16, 2002) (citing 11 Hickman v. Taylor, 329 U.S. 495, 511-16 (1947)). 12 The party claiming work product protection bears the burden of establishing that 13 the work product doctrine applies. See Kintera, Inc. v. Convio, Inc., 219 F.R.D. 503, 507 14 (S.D. Cal. 2003). A party may obtain discovery of work product only by showing a 15 “substantial need” and an inability to obtain the same information elsewhere. See Fed. R. 16 Civ. P. 26(b)(3)(A)(ii). But even if a court orders disclosure of work product, “it must 17 protect against disclosure of the mental impressions, conclusions, opinions, or legal 18 theories of a party’s attorney . . . concerning the litigation.” See Fed. R. Civ. P. 19 26(b)(3)(B). Those materials—opinion work product—are the “core types of work 20 product” that the doctrine protects. See Republic of Ecuador v. Mackay, 742 F.3d 860, 21 869 n.3 (9th Cir. 2014); see also Safeway, 2002 WL 31947153, at *6. A party may 22 // ORDER - 6 1 nevertheless waive the privilege. See United States v. Richey, 632 F.3d 559, 567 (9th Cir. 2 2011). 3 Based on Veridian’s representations about the content of responsive documents 4 (see Resp. at 8; Guglielmo Decl. (Dkt. # 121) ¶ 27), the court concludes in the first 5 instance that the doctrine applies. The materials Veridian has withheld are documents 6 that its counsel prepared in anticipation of this case. (See Guglielmo Decl. ¶ 27); Admiral 7 Ins., 881 F.2d at 1494. Moreover, Eddie Bauer does not dispute that conclusion, arguing 8 only that Veridian has waived the privilege. Cf. In re Symbol Techs., Inc. Sec. Litig., 9 No. CV 05-3923 (DRH) (AKT), 2017 WL 1233842, at *14 (E.D.N.Y. Mar. 31, 2017) 10 (forgoing “an analysis as to whether [the requested documents] are eligible for protection 11 as work product” because the defendants conceded the issue). Thus, the court considers 12 whether Veridian waived the privilege through the allegations in its second amended 13 complaint.5 14 The proponent of the privilege—here, Veridian—bears the burden of proving it 15 has not waived the privilege. See United States v. Ruehle, 583 F.3d 600, 608 (9th Cir. 16 2009). A party waives the work product privilege when it “shows disregard for the 17 protection by making the information public.” Campagnolo S.R.L. v. Full Speed Ahead, 18 19 20 21 22 5 Because the court concludes that Veridian has waived the privilege as to factual work product, the court does not address whether Eddie Bauer demonstrates substantial need under Rule 26(b)(3)(A)(ii). (See Resp. at 8-9 (arguing that Eddie Bauer does not demonstrate substantial need for the information)); cf. Waymo LLC v. Uber Techs., Inc., No. 17-cv-00939-WHA (JSC), 2017 WL 2485382, at *13 (N.D. Cal. June 8, 2017) (analyzing substantial need only to the extent that the at-issue materials were “non-waived attorney work-product”). ORDER - 7 1 Inc., No. C08-1372RSM, 2010 WL 11527271, at *3 (W.D. Wash. Apr. 27, 2010). By 2 basing allegations in a complaint on work product, the party makes the information 3 public and waives the privilege. See Brown v. China Integrated Energy, Inc., 4 No. CV 11-2559-BRO (PLAx), 2014 WL 12577130, at *3 (C.D. Cal. June 19, 2014); 5 Sommer v. United States, No. 09cv2093 WQH (WMc), 2012 WL 28337, at *4 (S.D. Cal. 6 Jan. 5, 2012); Rackemann v. LISNR, Inc., No. 1:17-cv-00624-MJD-TWP, 2018 WL 7 3328140, at *3 (S.D. Ind. July 6, 2018) (“When work-product information is disclosed in 8 and underlies the allegations of a [c]omplaint, . . . the information must be disclosed to 9 allow [d]efendants to evaluate [a p]laintiff’s allegations”). That rule prohibits the party 10 asserting the privilege from using “the privilege both offensively and defensively in order 11 to gain a strategic advantage, i.e., as both a sword and a shield.” Symbol Techs., 2017 12 WL 1233842, at *16. 13 Veridian’s claims rest upon its allegations that Eddie Bauer failed to adequately 14 guard against the data breach. (See, e.g., SAC ¶ 3 (“The data breach was the inevitable 15 result of Eddie Bauer’s inadequate data security measures and approach to data 16 security.”); see also id. ¶¶ 7-8, 39.) Several of those allegations specifically reference 17 communications with the IS Manager and the IT Consultant. (See, e.g., id. ¶¶ 41, 63-66, 18 68, 70, 74.) For example, the IS Manager “described” Eddie Bauer’s “approach” to 19 security as “minimalistic and low priority” and detailed several security measures that 20 Eddie Bauer opted not to implement. (See id. ¶¶ 41, 63-64, 66, 68, 70, 74.) In addition, 21 the IT Consultant “confirmed” that he or she made specific recommendations to Eddie 22 Bauer about the security of its payment systems. (See id. ¶¶ 64-66, 68, 70.) ORDER - 8 1 Based on the allegations in the complaint, the court concludes that Veridian has 2 placed its communications with the IS Manager and IT Consultant in issue. (See SAC 3 ¶¶ 41, 63-66, 68, 70, 74); Brown, 2014 WL 12577130, at *3. Even though Veridian also 4 relies on other sources (see Resp. at 10; Guglielmo Decl. ¶ 29; SAC ¶¶ 43, 45, 48-49, 53, 5 61-62, 75, 80, 85, 90-91), the fact remains that Veridian explicitly relies on the 6 communications to state its claims.6 Specifically, Veridian alleges that Eddie Bauer 7 knew its security measures were substandard and nonetheless chose not to implement 8 necessary improvements. (See, e.g., SAC ¶¶ 120-24, 128, 132-33, 138-41.) The 9 allegations involving the IS Manager and the IT Consultant are directed squarely at 10 proving that contention. Although Eddie Bauer knows those individuals’ identities and 11 therefore may depose them (see Resp. at 5), “documentary evidence is often necessary” 12 even if “a deposition may be useful and informative,” see Tennison v. City & Cty. of S.F., 13 226 F.R.D. 615, 622 (N.D. Cal. 2005).7 14 Veridian’s reliance on Hausman v. Holland America Line-U.S.A., 15 No. C11-1308BJR, 2015 WL 8327934 (W.D. Wash. Dec. 9, 2015), is unavailing. (See 16 Resp. at 11.) In that case, the plaintiff moved to compel the defendant to provide a 17 paralegal’s notes from a witness interview. See Hausman, 2015 WL 8327934, at *1. The 18 19 20 21 22 In this regard, Eddie Bauer is incorrect that Veridian “appears to rely exclusively on statements allegedly made by the IS Manager and IT Consultant to support its assertion that Eddie Bauer’s security processes were deficient.” (See MTC at 8.) 6 In addition, Veridian’s argument regarding the need to protect confidential witnesses’ identities is beside the point. (See Resp. at 7.) Veridian has already disclosed the IS Manager’s and the IT Consultant’s identities. (See id. at 5.) 7 ORDER - 9 1 Honorable Barbara J. Rothstein concluded that the defendant had not waived the work 2 product privilege because whether the witness lied during her pretrial interview—what 3 the plaintiff hoped to discover from the notes—was “not germane” to the motion to 4 vacate. Id. at *2-3. Unlike in Hausman, the content of the IS Manager’s and the IT 5 Consultant’s communications are in issue based on Veridian’s complaint. 6 For those reasons, the court grants Eddie Bauer’s motion in part.8 Veridian must 7 produce any factual work product responsive to RFPs No. 18 and 19. See Brown, 2014 8 WL 12577130, at *3; Symbol Techs., 2017 WL 1233842, at *19 (describing factual work 9 product as “memoranda consist[ing] of basic factual summaries prepared from 10 information relayed directly to [an] investigator during [an] interview”); Koumoulis v. 11 Indep. Fin. Mktg. Grp., Inc., 295 F.R.D. 28, 39 (E.D.N.Y. 2013) (stating that such work 12 product includes “factual investigation results”). However, Veridian need not produce 13 responsive documents constituting opinion work product—Veridian’s counsel’s mental 14 impressions, conclusions, opinions, or legal theories.9 See Fed. R. Civ. P. 26(b)(3)(B); 15 Tennison, 226 F.R.D. at 623 (finding that waiver extended only to factual work product, 16 not opinion work product); U.S. Sec. Exch. Comm’n v. Talbot, No. CV 044556 MMM 17 8 18 19 20 21 22 Pursuant to Federal Rule of Civil Procedure 37, if the court grants in part and denies in part a motion to compel, the court may “apportion reasonable expenses” after giving the parties “an opportunity to be heard.” See Fed. R. Civ. P. 37(a)(5)(C). Because Veridian’s privilege objection was reasonable insofar as Veridian’s opinion work product is not discoverable, the court declines to apportion any fees to Eddie Bauer. In its supplemental brief, Eddie Bauer acknowledges that it does not seek Veridian’s counsel’s “mental impressions.” (EB Supp. at 3.) And Veridian’s counsel represents that counsel for Eddie Bauer recently clarified that Eddie Bauer does not seek “communications between Veridian and its counsel, such as emails transmitting the draft complaint or otherwise discussing the complaint.” (Veridian Supp. at 2 (citing Baxter-Kauf Decl. (Dkt. # 125) ¶ 6).) 9 ORDER - 10 1 (PLAx), 2005 WL 8154566, at *6 n.24 (C.D. Cal. June 27, 2005) (describing the 2 distinction between opinion and factual work product in an attorney’s interview notes). 3 By way of example, Veridian is not required to produce documents falling within the 4 three categories Veridian identifies: (1) “communications between Veridian and its 5 counsel,” (2) Veridian’s counsel’s “mental impressions regarding their investigation and 6 litigation strategy,” and (3) Veridian’s counsel’s “mental impressions . . . in preparing the 7 complaint.” (See Resp. at 8.) However, to the extent that Veridian also possesses factual 8 work product related to the communications, it must produce that material to Eddie Bauer 9 within 14 days of the date of this order.10 If any material contains both factual and 10 opinion work product, Veridian may appropriately redact the opinion work product 11 before production. By the same date, Veridian must also produce a privilege log 12 detailing any material withheld as opinion work product. The privilege log must 13 “describe the nature of the documents, communications, or tangible things not produced 14 or disclosed—and do so in a manner that, without revealing information itself privileged 15 or protected, will enable [Eddie Bauer] to assess the claim” of privilege. See Fed. R. Civ. 16 P. 26(b)(5)(A)(ii); see also Safeway, 2002 WL 31947153, at *1 (describing the 17 appropriate contents of a privilege log). 18 // 19 // 20 21 22 10 Eddie Bauer requests production by August 17, 2018 (see MTC at 10), but the motion was first ripe for the court’s consideration on that date, see Local Rules W.D. Wash. LCR 7(b)(1). Accordingly, more time is necessary to complete the production. ORDER - 11 1 IV. 2 CONCLUSION For the foregoing reasons, the court GRANTS in part and DENIES in part Eddie 3 Bauer’s motion to compel (Dkt. # 115). In response to RFPs No. 18 and 19, Veridian 4 must produce responsive documents comprising factual work product no later than 5 fourteen (14) days of the date of this order. If any material contains both factual and 6 opinion work product, Veridian may appropriately redact the opinion work product 7 before production. By the same deadline, Veridian must also produce a privilege log as 8 detailed above and supplement its responses to Eddie Bauer’s RFPs No. 18 and 19. See 9 n.4. 10 Dated this 23rd day of August, 2018. 11 12 A 13 JAMES L. ROBART United States District Judge 14 15 16 17 18 19 20 21 22 ORDER - 12

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.


Why Is My Information Online?