Veridian Credit Union v. Eddie Bauer LLC

Filing 128

ORDER granting in part and denying in part Defendant's 115 Motion to Compel signed by Judge James L. Robart. (TH)

1
2
3
4
5
6
7

UNITED STATES DISTRICT COURT
WESTERN DISTRICT OF WASHINGTON
AT SEATTLE

8
9

VERIDIAN CREDIT UNION,

10

ORDER ON MOTION TO
COMPEL

Plaintiff,

11

CASE NO. C17-0356JLR

v.
12
EDDIE BAUER, LLC,

13

Defendant.

14
15

I.

INTRODUCTION

Before the court is Defendant Eddie Bauer, LLC’s motion to compel. (MTC (Dkt.

16
17

# 115).) Plaintiff Veridian Credit Union (“Veridian”) opposes the motion. (Resp. (Dkt.

18

# 120).) The court has considered the motion, the parties’ submissions in support of and

19

//

20

//

21

//

22

//

ORDER - 1

1

in opposition to the motion, the relevant portions of the record, and the applicable law. 1

2

Being fully advised,2 the court GRANTS in part and DENIES in part Eddie Bauer’s

3

motion for the reasons set forth below.

4

II.

BACKGROUND

5

This is a putative class action “on behalf of credit unions, banks, and other

6

financial institutions that suffered injury as a result of a security breach” involving Eddie

7

Bauer from about January 2, 2016, to July 17, 2016. (See SAC (Dkt. # 70) ¶ 1.) Veridian

8

alleges that the breach compromised the financial data of thousands of customers at all of

9

Eddie Bauer’s 370 retail stores in the United States and Canada. (Id.) Veridian further

10

alleges that the breach occurred because Eddie Bauer failed to “adequately secure its data

11

networks.” (Id. ¶ 2.) Specifically, Veridian states that Eddie Bauer “systematically failed

12

to maintain adequate data security measures, implement best practices, upgrade security

13

systems, and comply with industry standards.” (Id. ¶ 3.) Veridian contends that Eddie

14

Bauer failed to mitigate the damage the breach caused and exacerbated the damage by

15

failing to notify customers of the breach until about six weeks after it had occurred. (Id.

16

¶¶ 4-5.)

17

//

18
19
20
21
22

Eddie Bauer’s supplemental brief does not comply with Local Civil Rule 10(e)(1),
which requires “[t]he text of any typed . . . brief [to] be 12 point or larger.” (See generally EB
Supp. (Dkt. # 122)); Local Rules W.D. Wash. LCR 10(e)(1). The court will not permit either
party to violate its local rules and will consider appropriate sanctions for any future violations.
1

2

Neither party requests oral argument (MTC at 1; Resp. at 1), and the court determines
that oral argument would not be helpful to its disposition of the motion, see Local Rules W.D.
Wash. LCR 7(b)(4).

ORDER - 2

1

As a result of the alleged breach and resulting harm to customers, Veridian

2

contends that the financial institutions in the class have incurred significant costs related

3

to: (1) notifying customers of the breach; (2) canceling or reissuing credit and debit cards

4

compromised by the breach; (3) closing, opening, and/or reopening any accounts affected

5

by the breach; (4) refunding or crediting cardholders for unauthorized transactions; (4)

6

responding to a greater number of customer inquiries; (5) increasing their fraud

7

monitoring; and (6) losing revenue. (Id. ¶ 8.) Veridian contends that Eddie Bauer has

8

not offered any of the affected financial institutions “any compensation for the fraud

9

losses or reissuance costs associated with [the compromised] credit and debit cards.”

10

(See id. ¶ 31.) Veridian brings claims for negligence; violation of RCW 19.255.020; and

11

violation of Washington’s Consumer Protection Act (“CPA”), RCW ch. 19.86, et seq.

12

(Id. ¶ 10.) It seeks damages and declaratory and injunctive relief. (Id.)

13

In detailing the alleged deficiencies with Eddie Bauer’s security, Veridian relies in

14

part on statements from two sources: (1) a former Information Security Manager (“IS

15

Manager”), and (2) an IT consultant (“IT Consultant”). (See, e.g., id. ¶¶ 41 (IS Manager),

16

65 (IT Consultant).) The IS Manager “described Eddie Bauer management’s approach

17

toward the security of its [point of sale (“POS”)] environment as minimalistic and low

18

priority.” (Id. ¶ 41; see also id. (describing Eddie Bauer’s approach as “bare

19

minimum”).) According to that person, Eddie Bauer failed to timely implement security

20

patches and refused to implement recommended critical data security measures. (Id.

21

¶ 41; see also id. ¶ 57 (stating that Eddie Bauer refused to “update vital software

22

programs to remove the ‘bugs’ and other vulnerabilities”).) The IS Manager further

ORDER - 3

1

stated that Eddie Bauer did not “implement a multi-factor authentication process for its

2

POS environment.” (Id. ¶ 74.) Eddie Bauer allegedly failed to implement those

3

measures because it was unwilling to spend the money necessary to secure its payment

4

systems. (See id. ¶¶ 63-64; see also id. ¶ 70.)

5

In 2014 and 2015, Eddie Bauer retained a third-party IT consulting firm to

6

evaluate those systems. (Id. ¶ 64.) The firm identified “two primary security initiatives”:

7

(1) “point-to-point encryption,” and (2) “tokenization of the POS environment.” (Id.)

8

That firm’s IT Consultant recommended that Eddie Bauer encrypt and tokenize the POS

9

environment in all of its stores (see id. ¶¶ 65-66, 68), but Eddie Bauer allegedly did not

10

do so (see id. ¶ 81).

11

On August 2, 2018, Eddie Bauer moved to compel the production of documents

12

responsive to its requests for production (“RFPs”) No. 18 and 19. (See MTC.) RFPs No.

13

18 and 19 ask Veridian to produce the following:

14

REQUEST FOR PRODUCTION NO. 18:
Documents memorializing all communications with the “former Information
Security Manager (‘IS Manager’)” referred to in paragraph 41 of [Veridian’s]
Amended Class Action Complaint.

15
16

REQUEST FOR PRODUCTION NO. 19:
Documents memorializing all communications with the “IT Consultant”
referred to in paragraph 65 of [Veridian’s] Amended Class Action
Complaint.3

17
18
19

//

20
21
22

Eddie Bauer notes that its RFPs refer to Veridian’s first amended complaint but avers
that the RFPs are nevertheless relevant because Veridian makes the same allegations in the
second amended complaint. (See MTC at 3 n.2.)
3

ORDER - 4

1

(Id. at 3-4.) Veridian refused to produce responsive documents on the basis of attorney

2

client privilege and the work product privilege. (See Nelson Decl. (Dkt. # 116) ¶ 6, Ex. A

3

at 12-13; id. ¶ 7, Ex. B at 13-14.) The court now considers Eddie Bauer’s motion.

4
5

III.

ANALYSIS

Eddie Bauer argues that Veridian has waived the work product privilege by

6

making affirmative allegations regarding the IS Manager and the IT Consultant.4 (See

7

MTC at 8.) Thus, Veridian has made its communications with those people discoverable

8

by placing the communications in issue. (Id.) Although Veridian has since identified the

9

IS Manager and IT Consultant, Eddie Bauer claims that deposing them is insufficient

10
11

because “[m]emories fade.” (Id. at 9 n.6.)
Veridian counters that the privilege protects the communications because they

12

“occurred solely because of the instant litigation.” (Resp. at 7.) Veridian states that

13

responsive documents include (1) “communications between Veridian and its counsel,”

14

(2) “communications among Veridian’s counsel reflecting mental impressions regarding

15

their investigation and litigation strategy,” and (3) “documents reflecting the mental

16

impressions of Veridian’s counsel in preparing the complaint.” (Id. at 8.) Veridian

17

argues that Eddie Bauer has not demonstrated a substantial need for those documents.

18
19
20
21
22

Despite Veridian’s objection to the RFPs on the basis of attorney client privilege, Eddie
Bauer does not make any substantive argument on that point. (See generally MTC.) In addition,
Veridian states that based on recent clarification from counsel for Eddie Bauer, Eddie Bauer does
not seek communications between Veridian and its counsel, and therefore proposes to further
amend its responses to RFPs No. 18 and 19 to withdraw the attorney client privilege objection.
(See Veridian Supp. (Dkt. # 124) at 2.) For those reasons, the court GRANTS Veridian’s
proposal to withdraw that objection, and Veridian must serve its amended responses by the same
deadline set forth below.
4

ORDER - 5

1

(See id. at 8-9.) Moreover, Veridian contends that it has not waived the privilege. (See

2

id. at 9-12.)

3

The work product doctrine is a qualified protection limiting discovery of

4

“documents and tangible things” prepared by a party or its attorney in anticipation of

5

litigation. See Admiral Ins. Co. v. U.S. Dist. Court for Dist. of Ariz., 881 F.2d 1486, 1494

6

(9th Cir. 1989); see also Fed. R. Civ. P. 26(b)(3)(A). “The doctrine seeks to preserve the

7

privacy of an attorney’s thought processes, encourage careful and thorough preparation

8

by the attorney without undue and needless interference, and prevent exploitation of a

9

party’s efforts in preparing for litigation.” E.E.O.C. v. Safeway Store, Inc.,

10

No. C-00-3155 THE(EMC), 2002 WL 31947153, at *4 (N.D. Cal. Sept. 16, 2002) (citing

11

Hickman v. Taylor, 329 U.S. 495, 511-16 (1947)).

12

The party claiming work product protection bears the burden of establishing that

13

the work product doctrine applies. See Kintera, Inc. v. Convio, Inc., 219 F.R.D. 503, 507

14

(S.D. Cal. 2003). A party may obtain discovery of work product only by showing a

15

“substantial need” and an inability to obtain the same information elsewhere. See Fed. R.

16

Civ. P. 26(b)(3)(A)(ii). But even if a court orders disclosure of work product, “it must

17

protect against disclosure of the mental impressions, conclusions, opinions, or legal

18

theories of a party’s attorney . . . concerning the litigation.” See Fed. R. Civ. P.

19

26(b)(3)(B). Those materials—opinion work product—are the “core types of work

20

product” that the doctrine protects. See Republic of Ecuador v. Mackay, 742 F.3d 860,

21

869 n.3 (9th Cir. 2014); see also Safeway, 2002 WL 31947153, at *6. A party may

22

//

ORDER - 6

1

nevertheless waive the privilege. See United States v. Richey, 632 F.3d 559, 567 (9th Cir.

2

2011).

3

Based on Veridian’s representations about the content of responsive documents

4

(see Resp. at 8; Guglielmo Decl. (Dkt. # 121) ¶ 27), the court concludes in the first

5

instance that the doctrine applies. The materials Veridian has withheld are documents

6

that its counsel prepared in anticipation of this case. (See Guglielmo Decl. ¶ 27); Admiral

7

Ins., 881 F.2d at 1494. Moreover, Eddie Bauer does not dispute that conclusion, arguing

8

only that Veridian has waived the privilege. Cf. In re Symbol Techs., Inc. Sec. Litig.,

9

No. CV 05-3923 (DRH) (AKT), 2017 WL 1233842, at *14 (E.D.N.Y. Mar. 31, 2017)

10

(forgoing “an analysis as to whether [the requested documents] are eligible for protection

11

as work product” because the defendants conceded the issue). Thus, the court considers

12

whether Veridian waived the privilege through the allegations in its second amended

13

complaint.5

14

The proponent of the privilege—here, Veridian—bears the burden of proving it

15

has not waived the privilege. See United States v. Ruehle, 583 F.3d 600, 608 (9th Cir.

16

2009). A party waives the work product privilege when it “shows disregard for the

17

protection by making the information public.” Campagnolo S.R.L. v. Full Speed Ahead,

18
19
20
21
22

5

Because the court concludes that Veridian has waived the privilege as to factual work
product, the court does not address whether Eddie Bauer demonstrates substantial need under
Rule 26(b)(3)(A)(ii). (See Resp. at 8-9 (arguing that Eddie Bauer does not demonstrate
substantial need for the information)); cf. Waymo LLC v. Uber Techs., Inc.,
No. 17-cv-00939-WHA (JSC), 2017 WL 2485382, at *13 (N.D. Cal. June 8, 2017) (analyzing
substantial need only to the extent that the at-issue materials were “non-waived attorney
work-product”).

ORDER - 7

1

Inc., No. C08-1372RSM, 2010 WL 11527271, at *3 (W.D. Wash. Apr. 27, 2010). By

2

basing allegations in a complaint on work product, the party makes the information

3

public and waives the privilege. See Brown v. China Integrated Energy, Inc.,

4

No. CV 11-2559-BRO (PLAx), 2014 WL 12577130, at *3 (C.D. Cal. June 19, 2014);

5

Sommer v. United States, No. 09cv2093 WQH (WMc), 2012 WL 28337, at *4 (S.D. Cal.

6

Jan. 5, 2012); Rackemann v. LISNR, Inc., No. 1:17-cv-00624-MJD-TWP, 2018 WL

7

3328140, at *3 (S.D. Ind. July 6, 2018) (“When work-product information is disclosed in

8

and underlies the allegations of a [c]omplaint, . . . the information must be disclosed to

9

allow [d]efendants to evaluate [a p]laintiff’s allegations”). That rule prohibits the party

10

asserting the privilege from using “the privilege both offensively and defensively in order

11

to gain a strategic advantage, i.e., as both a sword and a shield.” Symbol Techs., 2017

12

WL 1233842, at *16.

13

Veridian’s claims rest upon its allegations that Eddie Bauer failed to adequately

14

guard against the data breach. (See, e.g., SAC ¶ 3 (“The data breach was the inevitable

15

result of Eddie Bauer’s inadequate data security measures and approach to data

16

security.”); see also id. ¶¶ 7-8, 39.) Several of those allegations specifically reference

17

communications with the IS Manager and the IT Consultant. (See, e.g., id. ¶¶ 41, 63-66,

18

68, 70, 74.) For example, the IS Manager “described” Eddie Bauer’s “approach” to

19

security as “minimalistic and low priority” and detailed several security measures that

20

Eddie Bauer opted not to implement. (See id. ¶¶ 41, 63-64, 66, 68, 70, 74.) In addition,

21

the IT Consultant “confirmed” that he or she made specific recommendations to Eddie

22

Bauer about the security of its payment systems. (See id. ¶¶ 64-66, 68, 70.)

ORDER - 8

1

Based on the allegations in the complaint, the court concludes that Veridian has

2

placed its communications with the IS Manager and IT Consultant in issue. (See SAC

3

¶¶ 41, 63-66, 68, 70, 74); Brown, 2014 WL 12577130, at *3. Even though Veridian also

4

relies on other sources (see Resp. at 10; Guglielmo Decl. ¶ 29; SAC ¶¶ 43, 45, 48-49, 53,

5

61-62, 75, 80, 85, 90-91), the fact remains that Veridian explicitly relies on the

6

communications to state its claims.6 Specifically, Veridian alleges that Eddie Bauer

7

knew its security measures were substandard and nonetheless chose not to implement

8

necessary improvements. (See, e.g., SAC ¶¶ 120-24, 128, 132-33, 138-41.) The

9

allegations involving the IS Manager and the IT Consultant are directed squarely at

10

proving that contention. Although Eddie Bauer knows those individuals’ identities and

11

therefore may depose them (see Resp. at 5), “documentary evidence is often necessary”

12

even if “a deposition may be useful and informative,” see Tennison v. City & Cty. of S.F.,

13

226 F.R.D. 615, 622 (N.D. Cal. 2005).7

14

Veridian’s reliance on Hausman v. Holland America Line-U.S.A.,

15

No. C11-1308BJR, 2015 WL 8327934 (W.D. Wash. Dec. 9, 2015), is unavailing. (See

16

Resp. at 11.) In that case, the plaintiff moved to compel the defendant to provide a

17

paralegal’s notes from a witness interview. See Hausman, 2015 WL 8327934, at *1. The

18
19
20
21
22

In this regard, Eddie Bauer is incorrect that Veridian “appears to rely exclusively on
statements allegedly made by the IS Manager and IT Consultant to support its assertion that
Eddie Bauer’s security processes were deficient.” (See MTC at 8.)
6

In addition, Veridian’s argument regarding the need to protect confidential witnesses’
identities is beside the point. (See Resp. at 7.) Veridian has already disclosed the IS Manager’s
and the IT Consultant’s identities. (See id. at 5.)
7

ORDER - 9

1

Honorable Barbara J. Rothstein concluded that the defendant had not waived the work

2

product privilege because whether the witness lied during her pretrial interview—what

3

the plaintiff hoped to discover from the notes—was “not germane” to the motion to

4

vacate. Id. at *2-3. Unlike in Hausman, the content of the IS Manager’s and the IT

5

Consultant’s communications are in issue based on Veridian’s complaint.

6

For those reasons, the court grants Eddie Bauer’s motion in part.8 Veridian must

7

produce any factual work product responsive to RFPs No. 18 and 19. See Brown, 2014

8

WL 12577130, at *3; Symbol Techs., 2017 WL 1233842, at *19 (describing factual work

9

product as “memoranda consist[ing] of basic factual summaries prepared from

10

information relayed directly to [an] investigator during [an] interview”); Koumoulis v.

11

Indep. Fin. Mktg. Grp., Inc., 295 F.R.D. 28, 39 (E.D.N.Y. 2013) (stating that such work

12

product includes “factual investigation results”). However, Veridian need not produce

13

responsive documents constituting opinion work product—Veridian’s counsel’s mental

14

impressions, conclusions, opinions, or legal theories.9 See Fed. R. Civ. P. 26(b)(3)(B);

15

Tennison, 226 F.R.D. at 623 (finding that waiver extended only to factual work product,

16

not opinion work product); U.S. Sec. Exch. Comm’n v. Talbot, No. CV 044556 MMM

17
8

18
19
20
21
22

Pursuant to Federal Rule of Civil Procedure 37, if the court grants in part and denies in
part a motion to compel, the court may “apportion reasonable expenses” after giving the parties
“an opportunity to be heard.” See Fed. R. Civ. P. 37(a)(5)(C). Because Veridian’s privilege
objection was reasonable insofar as Veridian’s opinion work product is not discoverable, the
court declines to apportion any fees to Eddie Bauer.
In its supplemental brief, Eddie Bauer acknowledges that it does not seek Veridian’s
counsel’s “mental impressions.” (EB Supp. at 3.) And Veridian’s counsel represents that
counsel for Eddie Bauer recently clarified that Eddie Bauer does not seek “communications
between Veridian and its counsel, such as emails transmitting the draft complaint or otherwise
discussing the complaint.” (Veridian Supp. at 2 (citing Baxter-Kauf Decl. (Dkt. # 125) ¶ 6).)
9

ORDER - 10

1

(PLAx), 2005 WL 8154566, at *6 n.24 (C.D. Cal. June 27, 2005) (describing the

2

distinction between opinion and factual work product in an attorney’s interview notes).

3

By way of example, Veridian is not required to produce documents falling within the

4

three categories Veridian identifies: (1) “communications between Veridian and its

5

counsel,” (2) Veridian’s counsel’s “mental impressions regarding their investigation and

6

litigation strategy,” and (3) Veridian’s counsel’s “mental impressions . . . in preparing the

7

complaint.” (See Resp. at 8.) However, to the extent that Veridian also possesses factual

8

work product related to the communications, it must produce that material to Eddie Bauer

9

within 14 days of the date of this order.10 If any material contains both factual and

10

opinion work product, Veridian may appropriately redact the opinion work product

11

before production. By the same date, Veridian must also produce a privilege log

12

detailing any material withheld as opinion work product. The privilege log must

13

“describe the nature of the documents, communications, or tangible things not produced

14

or disclosed—and do so in a manner that, without revealing information itself privileged

15

or protected, will enable [Eddie Bauer] to assess the claim” of privilege. See Fed. R. Civ.

16

P. 26(b)(5)(A)(ii); see also Safeway, 2002 WL 31947153, at *1 (describing the

17

appropriate contents of a privilege log).

18

//

19

//

20
21
22

10

Eddie Bauer requests production by August 17, 2018 (see MTC at 10), but the motion
was first ripe for the court’s consideration on that date, see Local Rules W.D. Wash. LCR
7(b)(1). Accordingly, more time is necessary to complete the production.

ORDER - 11

1

IV.

2

CONCLUSION

For the foregoing reasons, the court GRANTS in part and DENIES in part Eddie

3

Bauer’s motion to compel (Dkt. # 115). In response to RFPs No. 18 and 19, Veridian

4

must produce responsive documents comprising factual work product no later than

5

fourteen (14) days of the date of this order. If any material contains both factual and

6

opinion work product, Veridian may appropriately redact the opinion work product

7

before production. By the same deadline, Veridian must also produce a privilege log as

8

detailed above and supplement its responses to Eddie Bauer’s RFPs No. 18 and 19. See

9

n.4.

10

Dated this 23rd day of August, 2018.

11
12

A

13

JAMES L. ROBART
United States District Judge

14
15
16
17
18
19
20
21
22

ORDER - 12