Facts of the LabMD Case

LabMD, Inc. was a cancer diagnostic testing facility that used medical specimen samples and patient information to provide diagnostic information to health care providers. The company was subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and had a HIPAA compliance program in place that prohibited the downloading of peer-to-peer (P2P) file-sharing applications on company computers. LabMD v. FTC, Case No. 16-16270 (11^th Cir. June 6, 2018), at 2. Now defunct as an operating company, LabMD nonetheless exists as a company and continues to protect its information.

In violation of this prohibition, a company billing manager installed LimeWire on a company computer. This P2P software permits users to make computer documents accessible to the larger LimeWire community. The manager made a file containing the personal information of 9,300 consumers (the 1718 File) available to approximately two to five million LimeWire users. The 1718 File included names, dates of birth, Social Security numbers, laboratory diagnostic and testing codes, and for some patients health insurance information.

A data security firm, Triversa Holding Corporation (Triversa), downloaded the 1718 File and contacted LabMD to offer remediation services, which were refused. The LimeWire was deinstalled from the billing manager’s computer. Triversa sent the 1718 File to the FTC.

In its resulting complaint, the FTC alleged a variety of general security failures around LabMD’s policies and procedures that the FTC decided ultimately led to the posting of the 1718 File.

The Eleventh Circuit noted that there was no evidence that any of the 1718 File information was accessed by anyone other than Triversa or that it was otherwise improperly used.

FTC Consent Orders and Reasonable Information Security Programs

The FTC has filed enforcement actions against a variety of companies for security program failures, alleging that such failures constitute an “unfair act or practice” under Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a) (the FTC Act or Section 5(a)). The resulting consent orders generally require the defendant companies to implement and maintain information security policies and procedures designed to protect consumer information.

In this manner, the FTC has for years been building a “common law” body of orders intended to require companies to maintain reasonable information security programs. The FTC published in 2015 a guide for companies based on these consent orders, Start with Security, which it updated in 2017 with its “Stick with Security” blog series. These guides are crafted as “lessons-learned” guidance and focus on the following:

1. Security and privacy programs aligned with the following principles: purpose or minimization limitation on the collection of personal information; retention for only as long as necessary; appropriate employee training and education; and consumer choice.
2. Data access controls designed to restrict access to personal information and limit administrative access.
3. Operational access controls, such as passwords and authentication processes.
4. Protection of data in storage and in transit.
5. Network firewalls and monitoring.
6. Remote access controls.
7. Addressing security in the development of new products or services.
8. Vendor management of security risks posed by third-party service providers.
9. Ongoing monitoring and evaluation of security processes.
10. Physical security of storage media.

The enforcement actions tend to arise out of fairly egregious facts and are usually precipitated by a significant data breach. Accordingly, the specific “lessons learned” are often a list of “do-nots.” For example, a do-not of LabMD is “do not allow downloading of P2P (or noncompany) software on company systems.” The FTC has leveraged these specific do-nots into a larger concept of reasonable security. In LabMD, the FTC reasoned that a general laxity of information security policies and procedures led to the installation and failure to detect the presence of the P2P software on the billing manager’s computer.

In its press release regarding its 2017 Annual Privacy and Security Update (the Update), the FTC expressly stated that it “uses a variety of tools to protect consumers’ privacy and personal information including bringing enforcement actions to stop law violations and require companies to take affirmative steps to remediate the unlawful behavior.” The FTC regularly includes comprehensive information security program requirements in its consent orders, attributing identified security lapses or breaches as resulting from weak security generally.

The FTC consent order security programming requirements tend to be: (1) technology-neutral; (2) intended to be evaluated and updated on a regular basis; and (3) focused on the individual company’s risk-management efforts, taking into account the amount of practical risk, costs involved, industry standards, and sensitivity of information, among other factors.

Other Regulatory Approaches to “Reasonable Security”

The FTC’s concept of “reasonable security” is consistent with approaches taken by other laws and regulatory guidance regarding information security programs. The consensus seems to be that as technology and innovation is evolving faster than the law, the applicable laws should focus on security management standards and goals, rather than express prescriptive rules.

For example, the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity https://www.nist.gov/cyberframework/framework (RMF) offers a general set of standards, guidelines, and best practices to manage cybersecurity risk in critical infrastructure. The NIST RMF is neither prescriptive nor specific. Rather, it allows companies to evaluate their security programs in light of “their organizational requirements and objectives, risk appetite, and resources against” certain “core” cybersecurity principles.

Similarly, the Federal Financial Institutions Examination Council (FFIEC) Cyberscurity Assessment Tool (CAT) provides a “repeatable and measurable process for financial institutions to measure their cybersecurity preparedness over time.” Like the NIST RMF, the FFIEC CAT offers core principles and goals but relies on the company’s own risk-management assessment and strategies. The FFIEC CAT maturity domains include general statements like, “[d]edicated cybersecurity staff develops, or contributes to developing, integrated enterprise-level security and cyber defense strategies” or “[t]he institution benchmarks its cybersecurity staffing against peers to identify whether its recruitment, retention, and succession planning are commensurate.”

State statutory and regulatory requirements around security programs are also general. For example, the New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies (the NY Cyber Reg) requires such companies to develop cybersecurity programs based on a risk inventory and assessment process, with the goal of developing a policy that addresses all of the following:

1. information security
2. data governance and classification
3. asset inventory and device management
4. access controls and identity management
5. business continuity and disaster recovery planning and resources
6. systems operations and availability concerns
7. systems and network security
8. systems and network monitoring
9. systems and application development and quality assurance
10. physical security and environmental controls
11. customer data privacy
12. vendor and third-party service provider management
13. risk assessment
14. incident response

Like the NIST RMF and the FFIEC CAT, which address the use of multifactor authentication and penetration testing, as appropriate, the NY Cyber Reg does not require the use of specific technology.

The more comprehensive Massachusetts cybersecurity regulation, Standards for the Protection of Personal Information of Residents of the Commonwealth (the MA Cyber Reg), requires companies to maintain cybersecurity programs that, at a minimum and to the extent technically feasible, should have the following elements:

1. Secure user authentication protocols including:
   (a) control of user IDs and other identifiers;
   (b) a reasonably secure method of assigning and selecting passwords, or use of unique identifier technologies, such as biometrics or token devices;
   (c) control of data security passwords to ensure that such passwords are kept in a location and/or format that does not compromise the security of the data they protect;
   (d) restricting access to active users and active user accounts only; and
   (e) blocking access to user identification after multiple unsuccessful attempts to gain access or the limitation placed on access for the particular system;
2. Secure access control measures that:
   (a) restrict access to records and files containing personal information to those who need such information to perform their job duties; and
   (b) assign unique identifications plus passwords, which are not vendor-supplied default passwords, to each person with computer access, that are reasonably designed to maintain the integrity of the security of the access controls;
3. Encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data containing personal information to be transmitted wirelessly;
4. Reasonable monitoring of systems for unauthorized use of or access to personal information;
5. Encryption of all personal information stored on laptops or other portable devices;
6. For files containing personal information on a system that is connected to the Internet, there must be reasonably up-to-date firewall protection and operating system security patches, reasonably designed to maintain the integrity of the personal information.
7. Reasonably up-to-date versions of system security agent software that must include malware protection and reasonably up-to-date patches and virus definitions, or a version of such software that can still be supported with up-to-date patches and virus definitions, and is set to receive the most current security updates on a regular basis.
8. Education and training of employees on the proper use of the computer security system and the importance of personal information security.

The MA Cyber Reg is technology-neutral, industry standards- and risk-based, and tied to a “reasonableness” concept.

Other state laws are even more broad. The recently enacted Alabama State Data Breach Notification Act (the AL Act) requires companies to maintain “reasonable security measures” to protect personal information. “Reasonable” means “practicable” in relation to a cost-benefit analysis, the type and volume of information involved, and the size of the entity, and with emphasis to be placed on “data security failures that are multiple or systemic” and taking into account consideration of all of the following measures:

1. designation of one or more managers of the security program;
2. risk inventory—both internal and external;
3. vendor management with contractual security obligations;
4. continuous monitoring and evaluation of threats and measures; and
5. board or management oversight.

LabMD Consent Order

The FTC’s consent order in this case, FTC Consent Order In the Matter of LabMD, Inc., Docket No. 9357, at 2–3, imposed security requirements that were commensurate with those imposed by previous consent orders, which required LabMD to:

establish and implement, and thereafter maintain, a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers by respondent or by any corporation, subsidiary, division, website, or other device or affiliate owned or controlled by respondent. Such program, the content and implementation of which must be fully documented in writing, shall contain administrative, technical, and physical safeguards appropriate to respondent’s size and complexity, the nature and scope of respondent’s activities, and the sensitivity of the personal information collected from or about consumers, including:

1. the designation of an employee or employees to coordinate and be accountable for the information security program;
2. the identification of material internal and external risks to the security, confidentiality, and integrity of personal information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and assessment of the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment should include consideration of risks in each area of relevant operation, including, but not limited to: (1) employee training and management; (2) information systems, including network and software design, information processing, storage, transmission, and disposal; and (3) prevention, detection, and response to attacks, intrusions, or other systems failures;
3. the design and implementation of reasonable safeguards to control the risks identified through risk assessment, and regular testing or monitoring of the effectiveness of the safeguards’ key controls, systems, and procedures;
4. the development and use of reasonable steps to select and retain service providers capable of appropriately safeguarding personal information they receive from respondent, and requiring service providers by contract to implement and maintain appropriate safeguards; and
5. the evaluation and adjustment of respondent’s information security program in light of the results of the testing and monitoring required by [the order], any material changes to respondent’s operations or business arrangements, or any other circumstances that respondent knows or has reason to know may have a material impact on the effectiveness of its information security program.

Eleventh Circuit Holding and Reasoning in LabMD

The Eleventh Circuit held that the LabMD consent order was void for lack of specificity:

In the case at hand, the cease and desist order contains no prohibitions. It does not instruct LabMD to stop committing a specific act or practice. Rather, it commands LabMD to overhaul and replace its data security program to meet an indeterminable standard of reasonableness. This command is unenforceable.

The Eleventh Circuit acknowledged that due to limitations on legislating “an extensive list of unfair acts or practices,” Congress authorized the FTC “to establish unfair acts or practices through case-by-case litigation.” Notably, the court did not squarely address the issue of whether the FTC has data security enforcement authority under section 5(a).

The court focused on the FTC’s own two-prong test to determine whether an act or practice is “unfair” under section 5(a):

1. whether there is a “consumer injury,” which is substantial, not outweighed by a countervailing benefit to the consumer, and not reasonably avoidable by the consumer; and
2. whether the act “offended public policy as established by statute, the common law, or otherwise.”

The court found that “the [FTC’s] complaint alleges no specific unfair acts or practices” by LabMD other than the installation of P2P software on a single LabMD computer. The FTC complaint did not state that the installation of the P2P software violated a specific company policy. The court assumes that LabMD had a policy against the download. The court’s focus appears to be on this single violation, which, according to the court’s reasoning below, would justify an express prohibition in the consent order against policies or procedures permitting such an installation. The court did not discuss the FTC’s more holistic approach in the context of whether the company could have exercised better practices generally in implementing controls to actually prevent the employee from downloading external programs on a company computer, and whether such failure would warrant the imposition of more comprehensive security requirements, as was done in the order.

The opinion, however, assumed arguendo “that LabMD’s negligent failure to design and maintain a reasonable data security program invaded consumers’ right of privacy and thus constituted an unfair act or practice” under section 5(a).

The Eleventh Circuit recognized that although “[n]othing in the FTC Act addresses what content must go into a cease and desist order,” the FTC’s own procedural rule requires that “a complaint must contain a “clear and concise factual statement sufficient to inform each respondent with reasonable definiteness of the type of acts or practices alleged to be in violation of the law.” The court concluded that (1) the complaint must state violations with “reasonable definiteness,” and (2) the remedy (in this case, the requirements of the consent order) “must comport with this requirement of reasonable definiteness.” Accordingly, the opinion states that “the order’s prohibitions must be stated with clarity and precision.”

The opinion further explains how enforcement of FTC consent orders occur procedurally, either with enforcement by the administrative law judge (ALJ) or the district court. These authorities are charged with enforcement of injunctions of specific prohibited conduct enumerated in the consent order. The court concludes that the effect of indefinite requirements would lead to micromanagement in the form of constant interpretation and modification of the order by the ALJ or court.

The opinion holds that the order is void for lack of enforceability in that the order contained no express prohibited acts or practices: “it commands LabMD to overhaul and replace its data security program to meet an indeterminable standard of reasonableness.”

Implications for FTC Cybersecurity Enforcement

The FTC’s consent order in this case included comprehensive but general information security program requirements, which is consistent with its approach in many previous cybersecurity consent orders. The intent of the FTC appears to have been to craft an evolving concept of “reasonable security” and to require companies to monitor and develop their security programs over time. The Eleventh Circuit, however, rejected this approach as lacking in specificity. The implications for the enforceability of existing FTC consent orders is significant. If courts follow the LabMD holding, a domino effect voiding a long line of consent orders may well follow. Moreover, going forward, the FTC must consider including very specific security requirements and prohibitions in its consent orders.

At a recent conference, an FTC attorney advisor, speaking in her “personal capacity” and not on behalf of the agency, indicated in an off-the-cuff remark that they were “considering [their] options” in light of the opinion. Hot Topics in Advertising Law 2018, “FTC Year in Review” Practising Law Institute webinar (Christine DeLorme, 6/26/18).

The Eleventh Circuit emphasized that:

1. the posting of the 1718 File was in direct violation of a specific LabMD policy against downloading P2P software on company systems; and
2. the FTC did not demonstrate that any alleged general laxity in security programming resulted in this specific company policy violation.

Does this mean that if the FTC concludes that a company’s failure to implement adequate cybersecurity programs caused a specific unfair act or practice, the FTC must:

1. limit the remedy in the consent order to the specific act or practice; and/or
2. expressly demonstrate that the specific violation was caused by a broader, but still definite, series of security lapses?

The FTC cybersecurity consent orders generally require a long-term information security program (20 years is typical) that encompasses all of the company’s activities related to consumer information. Does the LabMD decision mean that the order must focus on the specific violation as of a definite point in time?

Consider a company that does not honor consumer choices regarding information offered through its website. For example, the company may not give the opportunity to consent to or opt out of sharing of personal information with unrelated third parties for marketing purposes, or may offer that choice but not honor it. Must the consent order be limited to requiring that consumer choices regarding such sharing of personal information collected via the website for marketing purposes be offered and honored? In that event, would other types of sharing not violate the order, even if consumer choices are offered but not honored? Alternatively, would the same company be liable if it later offered a mobile application and failed to offer or honor the same consumer choices via the app? Would the FTC have to micromanage the company’s information security program through a series of enforcement actions over time?

Conversely, should the FTC focus its efforts on promulgating regulations to require companies to implement reasonable security programs, as has been done with the other laws and regulatory guidance discussed above?

The potential importance of this opinion cannot be overstated, both with respect to its impact on existing FTC consent orders and the FTC’s ability to continue developing a concept of “reasonable security” while prosecuting unfair privacy and security practices on an action-by-action basis.

In principle, every case should be decided according to the facts and the law, no matter who is making the decision or in which forum. In practice, the forum making the decision can make a huge difference. In particular, the differences between litigation in court and arbitration before a private panel can be dispositive because of the differences in procedures, the nature of the forum, opportunities to seek fees and costs, and the opportunities for review after the proceeding is over. Those differences may also be critical regarding certain preliminary aspects of the dispute, such as requests for injunctive relief. Each stage of the process presents different kinds of strategic decisions.

The first question a litigator should ask herself when a dispute arises is where the dispute should be heard. Is there an arbitration clause that might be applicable? If there is, does it in fact apply? To a large extent, whether the clause applies will depend on the language of the clause and how it relates to the facts, although the Eleventh Circuit has cautioned that “‘[t]he case law yields no clear answer’ to the question of how broadly to construe an arbitration clause.” Hemispherx Biopharma, Inc. v. Johannesburg Consol. Invs., 553 F.3d 1351, 1366 (11th Cir. 2008) (quoting Telecom Italia, SpA v. Wholesale Telecom Corp., 248 F.3d 1109, 1114 (11th Cir. 2001)). For example, a clause that required arbitration of disputes that “arise out of or relate to” an agreement settling a dispute did not require arbitration of later conduct similar to what caused the settled dispute because that is a new dispute. Zetor N. Am., Inc. v. Rozeboom, 861 F.3d 807, 810 (8th Cir. 2017). A clause calling for arbitration of “[a]ny dispute arising from the [fundraising] Activity” covered by the contract did require arbitration of a minimum wage claim by a fundraiser. Leonard v. Delaware N. Am. Cos. Sports Serv., Inc., 861 F.3d 727, 729 (8th Cir. 2017). “‘[A]rising under’ language is narrower in scope than language, such as “relating to,” under which a claim may be arbitrable if it has a “significant relationship” to the contract, regardless of whether it arises under the contract itself.” Evans v. Building Materials Corp. of Am., 858 F.3d 1377, 1381 (Fed. Cir. 2017). An arbitration clause covering disputes that “arise out of or in any way relate to” the services provided covers antitrust claims by customers. In re Cox Enters., Inc. Set-top Television Box Antitrust Litig., 835 F.3d 1195, 1202 (10th Cir. 2016).

If the clause arguably does not apply, the attorney should ask herself whether it is worth trying to litigate the case in court. The other side may commence motion practice under section 3 of the Federal Arbitration Act to stay the action and have the dispute referred to arbitration. Even if that motion does not succeed, the exercise may take several months. Is the delay worth it? More to the point, what are the chances the case can stay in the court system? There is a strong policy in pretty much every court system in favor of arbitrating disputes. That means a party resisting arbitration needs a very strong argument as to why an arbitration clause does not apply. See, for example, Chassen v. Fidelity Nat’l Fin., Inc., 836 F.3d 291, 304 (3d Cir. 2016) (“[I]f the language of the contract is ambiguous, the presumption of arbitrability applies because we must resolve any doubts concerning the scope of arbitrable issues in favor of arbitration.” (internal quotations and alterations omitted)).

If there is no arbitration clause, should the parties consider whether to enter into a post-dispute arbitration submission agreement? Certain kinds of disputes might be well-suited for such a submission. For example, if the parties prefer not to have their dispute become a matter of public record, they might prefer to construct an appropriate arbitration procedure and panel for their dispute in order to avoid public scrutiny and press coverage. Alternatively, the nature of the dispute may require that it be heard in a court that is utterly unfamiliar with the type of case at issue; if the parties want a decision maker who has at least some clue about how to think about their dispute, they can agree to have their dispute arbitrated by a credentialed person.

There are limited opportunities to choose your judge if your case is in court. Most courts assign cases out of a wheel or similar random assignment system. It is easier to avoid a disfavored judge (by discontinuing under Rule 41(a)(1) and refiling) than to steer a case to a favored one. Arbitration affords greater opportunities for choosing the decision maker. The American Arbitration Association typically provides lists of proposed arbitrators and invites the parties to strike disfavored names. The arbitration agreement might provide procedures for selecting the arbitrator, set forth minimum qualifications, or name a specific person. In all events, the litigant should think hard about the characteristics of the person she wants deciding the case and plan the strikes and nominations with those goals in mind. One common procedure calls for each side to name one arbitrator and then the two named arbitrators pick the third. For this type procedure it is necessary to consider how persuasive your named arbitrator can be in order to keep the selection of the third arbitrator within acceptable bounds.

Choosing your decision maker should be part of your decision about what your overall approach to the dispute should be. In court the tools are well known: motions to dismiss to narrow the issues, discovery to learn the facts and lock the other side into their story, and motion for summary judgment to win the case or get as much of it decided in your favor as possible ahead of trial. Which tools you use and how, and which grounds you will raise at which stage of the proceeding, will vary from case to case, of course.

Arbitration presents a different set of challenges because you have fewer tools readily available. In most arbitrations, motions to dismiss are not contemplated. Discovery is more limited—typically there are no interrogatories or depositions. Specific types of arbitration might vary, such as FINRA arbitrations, and parties can always agree to additional procedures, but it is never advisable to rely on the other side’s agreeing to your preferred procedure.

In at least some federal courts, there is no third-party discovery in arbitration: third-party evidence either is before the arbitrators or not at all. See, for example, Life Receivables Tr. v. Syndicate 102 at Lloyd’s of London, 549 F.3d 210 (2d Cir. 2008); Hay Group, Inc. f. E.B.S. Acquisition Corp., 360 F.3d 404 (3d Cir. 2004). The Sixth and Eighth Circuits disagree. See In re Sec. Life Ins. Co. of Am., 228 F.3d 865, 870–71 (8th Cir. 2000); American. Fed’n. of Television and Radio Artists, AFL–CIO v. WJBK–TV (New World Commc’ns of Detroit, Inc.), 164 F.3d 1004, 1009 (6th Cir. 1999). This doesn’t necessarily mean the third party has to show up and testify; the arbitrator may and often will facilitate third-party discovery by directing that documents be produced before him or her at an interim hearing called for the sole purpose of having the third party produce documents. Often the adversary will see which way the wind is blowing and consent to having the production done without the arbitrator present. But a good litigator must bear in mind the relative ease of access to third-party proof.

The likelihood in arbitration is that you are going to trial. That means arbitration may provide you with tools that may not be available in court. Bear in mind the grounds on which arbitration awards can be vacated. They are set forth in section 10(a) of the Federal Arbitration Act:

1. where the award was procured by corruption, fraud, or undue means;
2. where there was evident partiality or corruption in the arbitrators, or either of them;
3. where the arbitrators were guilty of misconduct in refusing to postpone the hearing, upon sufficient cause shown, or in refusing to hear evidence pertinent and material to the controversy; or of any other misbehavior by which the rights of any party have been prejudiced; or
4. where the arbitrators exceeded their powers, or so imperfectly executed them that a mutual, final, and definite award upon the subject matter submitted was not made.

Although these grounds are narrow, they are real, and arbitrators don’t like being overturned any more than judges do. So they are likely to run the hearing in a way that will keep them far away from any of these. The ones that give parties the most scope for affecting the proceeding are subsection 3 and 4.

Defendants in particular can—and often do—use the prospect of a post-award vacatur proceeding under subsection 3 as a tool to obtain adjournments and to keep the record open for all kinds of evidence that in court might be viewed as cumulative or of limited probative force or questionable admissibility. Of course, it is possible to overdo it, and a good arbitrator will see through the more egregious misuses of this strategy.

Similarly, the parties may wrangle over the scope of the arbitrator’s power and how it is exercised because subsection 4 permits challenges on those grounds. These arguments will turn on the language of the contract that empowered the arbitrators in the first place (which may or may not be idiosyncratic, unclear, or debatable). In court, though, such issues typically are pitched in terms of jurisdiction, finality, or scope of discretion, and there is usually a wealth of case law to inform the parties’ arguments.

Courts, especially federal courts, have much more rigid guidelines for the procedures to be followed, well-defined evidentiary rules, and, in the main, a case-management ethic that expects judges to keep cases moving along smartly. Although the number of tools is greater (motions, discovery), the opportunities for delay in each part of the proceeding are far fewer. Unlike arbitrators, whose decisions are highly insulated from substantive review, judges can be reversed on appeal. Although appellate courts reverse trial courts in only a small percentage of cases, see, e.g., Just the Facts, (Dec. 20, 2016) (fewer than 9% of federal appeals resulted in reversals in 2015); National Center for State Courts, Caseload Highlights (March 2007) (of appeals prosecuted to decision, 70% were affirmed), the prospect of a reversal on appeal can occasionally be a useful tool for a litigant.

The bottom line: no matter which forum you are in, each stage of the proceeding requires that you keep in mind the rules of the forum so that you can construct your strategy to fit the forum and maximize your client’s chances.

Stuart Riback gratefully acknowledges the assistance and input of Judge Gail Andler (ret.), Peter Valori and Mian Wang.

Two recent decisions from the Delaware Court of Chancery offer new insight into the court’s application of an important exception to the attorney-client privilege in breach of fiduciary duty actions. The Garner exception to the attorney-client privilege, first articulated by the Fifth Circuit Court of Appeals in Garner v. Wolfinbarger, 430 F.2d 1093 (5th Cir. 1970), cert. denied, 401 U.S. 974 (1971), requires fiduciaries defending claims for breaches of fiduciary duty to produce otherwise privileged documents upon a showing of good cause by the party asserting the claims. The Supreme Court of Delaware has emphasized that the exception is “narrow, exacting, and intended to be very difficult to satisfy.” Wal-Mart Stores, Inc. v. Indiana Elec. Workers Pension Trust Fund IBEW, 95 A.3d 1264, 1278 (Del. 2014). Consistent with this view, in Buttonwood Tree Value Partners, L.P. v. R.L. Polk & Co., Inc., 2018 WL 346036 (Del. Ch. Jan. 10, 2018) and Morris v. Spectra Energy Partners (DE) GP, LP, 2018 WL 2095241 (Del. Ch. May 7, 2018), the Court of Chancery found the Garner exception inapplicable while providing new guidance on its limits.

Buttonwood Tree Value Partners, L.P. v. R.L. Polk & Co., Inc.

In this case, former minority stockholders of R.L. Polk & Co., Inc. (Polk) asserted direct breach of fiduciary duty claims against the Polk family, which collectively held approximately 90 percent of Polk common stock, and against directors affiliated with the Polk family. Plaintiffs alleged that these defendants breached their duties of loyalty and care in connection with a self-tender transaction orchestrated by the Polk family. According to plaintiffs, the transaction enriched the Polk family, who afterwards received dividends amounting to one-third of the self-tender price and sold the company for three times the self-tender valuation.

Invoking the Garner exception, plaintiffs moved to compel the production of privileged documents withheld by defendants that related to the sale of the company, the self-tender, and various restructuring options under consideration at the time of the self-tender. The court explained that in evaluating whether a stockholder has established sufficient “good cause” to warrant application of the Garner exception, Delaware courts focus on three of the factors identified by the Fifth Circuit in Garner: “(1) the colorability of the claim; (2) the extent to which the communication is identified versus the extent to which the shareholders are blindly fishing; and (3) the apparent necessity or desirability of shareholders having the information and availability of it from other sources.” In its view, the first and second of these factors act as “gatekeepers” that “strain out frivolous attempts to vitiate the privilege.” The third factor, applicable only when the first two are satisfied, reflects “a balancing test to see whether the interest in discovery, or that of maintaining the privilege, is paramount.” The court noted that Garner “balances the [attorney-client] privilege’s purpose of encouraging open communication between counsel and client against the right of a stockholder to understand what advice was given to fiduciaries who are charged with breaching their duties.” (Quotations and citations omitted.)

The court found that the first factor weighed in favor of disclosure of the privileged documents at issue because the court previously held that the complaint stated claims against the Polk family and its affiliated directors for breaches of fiduciary duty, and therefore the claims were colorable. The court found that the second factor also weighed in favor of disclosure because the documents at issue, although “relatively large” in number (1,200), were tailored to plaintiffs’ allegations, and there was no indication that production of the documents would be overly burdensome.

Having found that plaintiffs “cleared the initial hurdle” imposed by the first two factors, the court turned to the third factor and found that it weighed against disclosure because the plaintiffs had not demonstrated that the information sought was unavailable from other nonprivileged sources. In so finding, the court noted that plaintiffs had yet to depose any witnesses, and there was no reason to believe that depositions would fail to reveal information about the sale of the company, the self-tender, and the restructuring options considered at the time of the self-tender. The court rejected plaintiffs’ argument that the documents at issue were necessary to prepare for the forthcoming depositions or to test the witnesses’ credibility. The court reasoned that such concerns are always present, and if the court were to adopt them as a basis to apply the Garner exception, the scope of the exception “would expand significantly, an outcome contrary to our Supreme Court’s admonition that the exception is ‘narrow, exacting, and intended to be very difficult to satisfy.’” (quoting Wal-Mart, 95 A.3d at 1278). The court emphasized that a stockholder invoking Garner must establish that they “have exhausted every available method of obtaining the information they seek.” Given that plaintiffs did not do so, the court concluded that the balancing test under the third factor “tip[ped] against disclosure of the privileged documents,” and held that the Garner exception did not apply.

Having held that plaintiffs failed to demonstrate that their motion to compel should be granted, the court found it unnecessary to decide whether Garner could apply to the direct, as opposed to derivative, claims in issue. Defendants argued that Garner applies only to derivative claims “where [the] defendant corporate actors assert the privilege on behalf of the very entity that the plaintiffs purport to represent derivatively, in which case the assertion of the privilege on behalf of the corporation and its principals may be inimical to the corporate interest.” Without deciding the issue, the court noted that the Garner exception logically applied in the context of direct claims for breach of fiduciary duty, “but that the nature of the action must be accounted for in the balance of interests that Garner requires.”

Morris v. Spectra Energy Partners (DE) GP, LP

The discovery dispute at issue in this decision arose in the context of a challenge to a transfer of certain assets of Spectra Energy Partners, LP (Spectra LP) to a principal of Spectra LP’s general partner, Spectra Energy Partners (DE) GP, LP (Spectra GP). Spectra LP’s limited partnership agreement (the LPA) eliminated common-law fiduciary duties, but required Spectra GP to act in good faith with respect to such transfers. The plaintiff, a common unitholder of Spectra LP, claimed that Spectra GP breached its duty to act in good faith by knowingly approving a transfer of assets for approximately $500 million less than the assets were purportedly worth.

The plaintiff moved to compel the production of two documents in unredacted form under the Garner exception. In a matter of first impression, the court considered whether the Garner exception applies in circumstances where a limited partnership has eliminated common-law fiduciary duties. Relying on precedent holding that the Garner exception is limited to circumstances where there is a fiduciary relationship between the party challenging the privilege and the party asserting it, the court concluded that the Garner exception does not apply when fiduciary duties are expressly disclaimed.

In so finding, the court emphasized the policy underlying the Garner exception, which rests on the “mutuality of interest” between a stockholder and a fiduciary when the fiduciary seeks legal advice in connection with actions taken or contemplated in his role as a fiduciary. In such circumstances, the court reasoned, the stockholder is “the ultimate beneficiary of legal advice sought by fiduciaries qua fiduciaries,” making it appropriate for the stockholder to view the communications reflecting the advice in certain circumstances. The court recognized that the Garner exception has been applied in situations far removed from stockholder derivative suits (i.e., actions by trust beneficiaries against the trust and trustee, and actions by creditors against a bankruptcy creditor’s committee), but a fiduciary relationship existed in these cases, establishing the requisite mutuality of interest between the parties.

Given that there was no fiduciary relationship between the plaintiff and Spectra GP under the express terms of the LPA, the court concluded that the mutuality of interest underpinning the Garner exception did not exist, and the Garner exception therefore did not apply.

Key Takeaways

Although application of the Garner exception is necessarily a fact-specific inquiry, these recent decisions offer certain key insights for litigants prosecuting or defending breach of fiduciary duty claims in the Delaware Court of Chancery:

• Fiduciary relationship required, and contractual duties are not enough. The court’s decision in Morris makes clear that the Garner exception is unavailable where common-law fiduciary duties are disclaimed by contract and therefore no fiduciary relationship exists. The LPA in Morris replaced common-law fiduciary duties with contractual duties, and although not expressly addressed, the court’s decision appears to render Garner inapplicable to actions involving breaches of contractual duties. Therefore, even if a plaintiff asserting breaches of contractual duties could otherwise satisfy the high burden required for Garner’s application, it is unavailable in that setting.
• Garner likely applies to direct fiduciary breach claims, but the burden of establishing good cause may be higher in that context. Although the court in Buttonwood did not decide the issue, it surmised in dicta that the Garner exception would apply to direct fiduciary duty claims as well as derivative claims. In Garner, where the claims were both direct and derivative, the Fifth Circuit noted that its decision was not dependent on whether the derivative claim was “in the case or out.” Garner, 430 F.2d at 1097 n.11. In Buttonwood, however, the court cautioned that the nature of the claim should be considered when balancing the interests inherent in the attorney-client privilege against the interests of a stockholder seeking to review privileged communications. This suggests that stockholders invoking the Garner exception in the context of direct fiduciary duty claims may face a higher burden of establishing the requisite “good cause” necessary to invoke the exception.
• Garner does not apply if information sought is potentially available through depositions. When evaluating “the apparent necessity or desirability of shareholders having the information and availability of it from other sources,” the court will not likely find sufficient good cause to invoke Garner if the moving stockholder can obtain the information sought through depositions. Similarly, the potential usefulness of otherwise privileged documents to deposition preparation is not enough under Garner. Rather, a stockholder must exhaust other available options, consistent with the Delaware Supreme Court’s expectation that the Garner exception should “be very difficult to satisfy.”

The information universe is expanding in truly mind-numbing ways. There is a new exabyte of data created every few hours across the globe. (One exabyte of data is the equivalent of 50,000 years of continuous movies.) That Mount-Everest-sized pile of information is replicated many times every day and continues to grow faster and faster. Big companies typically have millions or billions of files stored in multiple locations, including third-party-owned Clouds. For many companies, that means they can’t keep all their information forever because they are collapsing under its weight. So why are companies hard-pressed to clean house of unneeded information?

Companies historically had records-management programs so that they could manage records and properly dispose of them in accordance with the company retention policy at some future date. At the time, making retention rules work meant that employees had to apply the rules to their records. That was simple when each employee boxed their paper records annually and applied a retention rule to each box. However, having employees apply business rules to millions or billions of files from various systems is like drinking from a firehose through a straw. In other words, cleaning house according to the retention schedule applied to each record one by one for most businesses is no longer doable.

The current business environment is like information’s “perfect storm”—more data in more formats and systems with less visibility into what information assets exist, more laws directing how it must be managed, more consequences for mismanagement, and more challenges in managing it according to old company rules with much of it floating in a Cloud.

Why Does Information Just Pile Up?

Companies relied for years on paper and electronic information, sometimes duplicating each other over and over. Although electronic information legally is on par with its paper counterparts for almost all purposes, lawyers fallaciously believed paper was the “best evidence,” and thus the two piles grew even though paper printouts of electronic records could be legally destroyed.

Today, much of the growth in information volumes comes from communications, social media, and collaboration technologies the output of which may not rise to the level of a company record. Thus, the pile grows further with information that may be “nonrecord,” which need not be retained to satisfy legal or business needs.

While litigants began to focus on electronic information for discovery purposes, sometimes company lawyers over-preserved information so as not to worry about its destruction during the pendency of a matter. What that set in motion was everything, even information ready for destruction pursuant to the retention rules, continuing to be preserved. Wide-sweeping legal holds that took precedence over retention rules stopped the proper destruction of records in the ordinary course of business according to company policy. Thus, the pile grew larger still because employees couldn’t classify and/or manage the growing amount of information, given that the sheer volume of files, documents, and e-mail became overwhelming.

Compounding matters, there was a need to manage information according to other information-related policy regimes, like information security, privacy, attorney-client privilege, etc., which often impacted the same information. Further compounding the problem was that information classification couldn’t be easily accomplished given limited functionality in most technology unless information was being purposefully stored in document and records-management applications. In other words, if employees were so inclined (and they generally weren’t), most technology in use didn’t allow for such compliance rules to be easily applied or applied at all. Thus, the pile grew.

The fallacious belief that storage is cheap further impacted storage growth. Although storage costs per terabyte are decreasing a few percentage points, any cost savings are dwarfed by company information footprints doubling every year or two, and with storage costs between $5–$10 million per year, per petabyte, storage costs are now huge for companies with big information footprints. Thus, the pile grew larger.

Then Big Data happened. Big Data is not about large piles of information. It’s about using analytics or artificial intelligence (AI) software to crawl through large piles of information to answer a business question. Suddenly there was even less pressure to clean house. Business folks want more information for longer periods of time to run queries and see what they learn from a business perspective.

In 2018 the tide seems to be turning in that less information may be retained given significant compliance events. First, with endless information security and privacy failures, companies realize their risk profile declines with smaller information footprints, which can be accomplished by keeping less and for a shorter period. As Jeff Stone, et. al put it in a May 29, 2018 article in the Wall Street Journal:

Cybersecurity threats are relentless, they’re getting stronger and they are coming from more directions than ever . . . more, the consequences of a breach can be disastrous, with staggering losses of customer data and corporate secrets—followed by huge costs to strengthen security, as well as the threat of regulatory scrutiny and lawsuits.

Further, the EU’s General Data Protection Regulation (GDPR) became law and is forcing companies to rethink what information they keep and for how long because GDPR requires it.

What Is Defensible Disposition and How Will It Help?

A solution to the unmitigated data sprawl is to “defensibly dispose” the business content that no longer has business or legal value to the organization. Defensible disposition is a way to take on piles of information without employees classifying .

To apply a retention rule to large chunks of information to make a business decision to dispose of it requires different diligence depending upon the content; thus, there is no one-size-fits-all approach to defensible disposition. In some cases, a software analytics tool may need to crawl the contents looking for specific terms, and in others, knowing the age of the information pile, the business unit that created it, the lack of active litigation, and so on might be enough to purge the entire contents without looking at each file. Having worked with so many companies cleaning up stored information, determining the amount of diligence needed in analyzing information piles to make a company comfortable to purge is rather variable.

In any event, lawyers’ input will be essential to help define a reasonable diligence process to assess the legal requirements for continued information retention and/or preservation, based on the information at issue. Thereafter, lawyers can also help select a practical information assessment and/or classification approach, given information volumes, available resources, and risk profile.

Does Litigation Profile Matter?

A good time to clean up outdated information is when there are fewer legal or compliance issues that require continued preservation of information. Disposing of information when no litigation or government investigations or audits exist is less risky. Otherwise, before information can be purged, the company must conduct sufficient diligence to ensure that nothing is destroyed that will give rise to a spoliation claim. That, of course, begs the questions of how diligence will be performed when it’s impractical to review millions or billions of files or documents.

Can Technology Help?

There are all kinds of analytics and classification technologies that can help analyze information and may help with defensible disposition; however, having used these technologies for years to help companies deal with dead data, the expense and/or complexity should not be underestimated. Putting aside cost, these technologies are better and faster than employees at classifying information. As Maura R Grossman, JD, Ph.D., et. al described in the Richmond Journal of Law and Technology, “[t]his work presents evidence supporting the contrary position: that a technology-assisted process, in which only a small fraction of the document collection is ever examined by humans, can yield higher recall and/or precision than an exhaustive manual review process, in which the entire document collection is examined and coded by humans.”

Studies and courts make clear that when appropriate, companies should not fear using technologies to help manage information. For example, in Moore v. Publicis Groupe, Judge Andrew Peck made clear in the discovery context that “[c]omputer-assisted review appears to be better than the available alternatives, and thus should be used in appropriate cases . . ounsel no longer have to worry about being the “first” or “guinea pig” for judicial acceptance of computer assisted review.”

Can I Clean House with Methodology Alone?

If information has piled up and you don’t think it makes sense to crawl it for records or preservation obligations, then there are other ways to get rid of content.

For example, if your company has 100,000 back-up tapes from 20 years ago, minimal review might be required before the whole lot of tapes can be comfortably disposed. On the other hand, if you have an active shared drive with records and information that is needed for ongoing litigation, there must be deeper analysis with analytics and/or classification technologies. In other words, the facts surrounding the information will help inform whether the information can be properly disposed with minimal analysis or whether it requires deep diligence.

Conclusion

Defensible disposition is needed like never before, given that information is growing unfettered for most businesses and impacting their ability to function. In addition, a bloated information footprint further increases a business’s privacy and information security risk profile. Although there are many reasons why retention is no longer happening as it used to, what is clear is that keeping everything forever is not without great costs or risks that must be addressed. In the end, lawyers must find a way to get rid of information without creating greater business and legal issues for their clients. Without their guidance, no one will destroy data, and it will continue to overwhelm.