Beware: Your Company's Duty to Preserve, Collect, and Produce Electronically Stored Information Held by Third Parties

By Ronald C. Wernette

The legal landscape is now littered with parties - and their attorneys - that have been sanctioned by courts for electronic data discovery failures. Most of the litigation dealing with the loss of digital information addresses the failure of a party to preserve and collect the data after it was under a legal obligation to do so. The scope of that legal obligation is still not fully understood by many organizations: it includes ESI held by third parties in many circumstances. Which circumstances? Read on.

An automotive manufacturer has significant CAE and CAD work done for a new vehicle program by a joint venture partner in India. The data and other software iterations used in the product development process reside with the joint venture partner in India.

A global chemical and cleaning products company has some products manufactured by third-party suppliers. Some data concerning product formulation, manufacturing processes and QC, testing, and compliance resides with those contractors.

A national trucking transportation company has some of its tractor and trailer mechanical maintenance requirements performed by a wholly-owned subsidiary that specializes in such activity. Some data concerning the DOT required inspections, repairs, and maintenance resides with the subsidiary.

An American consumer products company markets and distributes its products throughout the United States and Canada. Product manufacturing is performed in China by a number of suppliers, to the American company's specifications. Data concerning manufacturing/QC/inspection processes and second-tier suppliers and purchased components resides with the various Chinese suppliers.

These are real-world scenarios for our clients, and the variations are endless. It is a business reality that our client organizations utilize related legal entities (e.g., parent, sister, or subsidiary) and numerous other third-parties to help achieve their operational goals. As a result, there is likely to be relevant client business information in the possession of those other entities. These realities are obvious. What is not so obvious is that information in the hands of those third parties is likely to be deemed within the "possession, custody or control" of the client organization under applicable discovery law. If so, a host of legal obligations attach, which can be especially challenging where electronically stored information is involved and where independent third parties and cross-border relationships are involved.

How far does the duty to preserve ESI extend: what is deemed to be in a party's "possession, custody or control"?
Federal Rule 34 (and its state rule counterparts) governs the production of documents and electronically stored information in civil discovery. The Rule permits a party to serve on any other party a request for the production of documents and ESI within that party's "possession, custody or control." The scope of a party's obligation is clearly broader than information in its "possession" but the Rule itself begs the question: what is within a party's "control" for purposes of Rule 34? The answer to that question has profound implications because it also governs the scope of a party's duty to preserve (e.g., through litigation hold procedures), a party's duty to search for potentially responsive information, and a party's duty to collect and produce information.

Although the Rule itself does not define when a party has "control" of documents or ESI, the case law has filled in the gaps. Federal courts have consistently held that documents and ESI may be in the "control" of a party for purposes of Rule 34 even when they are in the physical possession of another entity that is not a party. In other words, "control" does not require that a party have actual physical possession or even legal ownership of the documents or ESI at issue. "Control" has been construed broadly by the courts as "the legal right, authority, or practical ability to obtain the materials sought on demand." See Columbia Pictures Ind. v. Bunnell, 2007 U.S. Dist. LEXIS 46364 (C.D. Cal. 2007); In re NTL Inc. Securities Litigation, 2007 U.S. Dist. LEXIS 6198 (S.D.N.Y. 2007); Cache La Poudre Feeds, LLC v. Land O' Lakes, Inc., 2007 U.S. Dist. LEXIS 15277 (D. Colo. 2007); Steele Software Systems v. Dataquick Information Systems, 2006 U.S. Dist. LEXIS 74987 (D. Md. 2006).

The standard is really "practical control," which is not susceptible to easy bright-line determinations by in-house or outside counsel trying to decide how far their obligations extend. The reality is that the "practical control" test is a fact-bound and context specific determination, and is not a simple bright-line rule. Thus, the issue tends to require case-by-case analysis by knowledgeable counsel familiar with the law in this area, the details of the relationship between the client and a third party, and the specific nature of the information held by a third party.

Frequent Third Party "Control" Situations to Consider
Based on experience and a review of the cases concerning the meaning of "control" for purposes of Rule 34, there are three frequent scenarios that your company is most apt to encounter:

1. Information in the possession of legally related third parties
2. Information in the possession of independent third parties
3. Information in the possession of former employees

1. Information in the possession of legally related third parties
Steele Software Systems v. Dataquick Information Systems concerned whether, and to what extent, the reach of Rule 34 extends to data in the physical possession of a party's non-party corporate affiliates. Steele argued that it was not obliged to produce documents not in its own possession, but that were in the physical possession of non-party corporate affiliates. Steele's argument was two-fold: (1) the related entities were not "parties" and so Rule 34 did not apply, and (2) the information in the possession of the non-parties was not within Steele's "control" under Rule 34.

The Steele court recognized that information in the possession of a non-party is not automatically subject to discovery simply because the non-party has a corporate relationship to a party in the litigation. However, the court rejected Steele's threshold "non-party" argument, relying on well established case law ordering production of information in the possession of related non-parties and holding that "[t]he specific form of the corporate relative involved does not matter, i.e., whether it is a parent, sister, or subsidiary corporation. Courts are able to disregard corporate form" where appropriate.

The Steele court next turned to the "control" issue, observing that case law provides for several relevant factors in making the determination whether a party is deemed to have "control" over information in the possession of related non-parties: (1) the corporate structure of the party/non-party, (2) the non-party's connection to the transaction at issue in the litigation, (3) whether the related party/non-party entities exchange information in the ordinary course of business, (4) the degree to which the non-party will benefit from the outcome of the litigation, and (5) whether the non-party has participated in the litigation. Concerning the first factor, the focus is on common relationships between a party and its related non-party entity. Critical factors include the ownership of the non-party, overlap of directors, officers, and employees, shared management, and the financial relationship between the two entities. The Steele court applied the aforementioned test and found that the requested information was deemed to be under the practical "control" of Steele, and ordered the information to be produced. See also Evenflo Co., Inc. v. Hantec Agents Unlimited, 2006 U.S. Dist. LEXIS 36342 (S.D. Ohio 2006).

What does this mean? Given the current legal test being applied, it is likely that responsive ESI in the possession of a party's non-party corporate affiliates (e.g., parent, sister, subsidiary) will be found to be under the "control" of the client party in many situations. To the extent that your company does not include non-party corporate affiliates in its ESI preservation, search, and collection process, it does so at its peril.

2. Information in the possession of independent third parties
Columbia Pictures Ind. v. Bunnell concerned whether the reach of Rule 34 extends to data in the possession of an independent third party under the "control" prong of the Rule. In that case the data at issue was routed to a third party entity under contract to the defendant, and stored by the third party. The court found that the data was within the defendant's "control" by virtue of the defendants' choice about where the data resided (i.e., the ability to manipulate at will how the data was routed) and by virtue of defendant's contractual relationship with the third party entity. The court observed that courts have long held that one aspect of "control" is "the legal right to obtain documents on demand" and a contractual relationship with the third-party obliged the defendant to, at a minimum, make reasonable inquiry of the third party entity for the data at issue. See also A. Farber and Partners, Inc. v Garber, 234 F.R.D. 186 (C.D. Cal. 2006).

What does this mean? Given the current legal test being applied, it is likely that responsive ESI in the possession of an independent third party with whom there is a contractual business relationship (e.g., joint venturer, supplier, contractor, dealer) will be found to be under the "control" of the client party in many situations. To the extent that your company does not include such third parties in its ESI preservation, search, and collection process, it does so at its peril.

3. Information in the possession of former employees
Cache La Poudre Feeds, LLC v. Land O' Lakes, Inc. raised the issue of whether, and to what extent, a party may be obliged to contact former employees who the party had reason to believe possessed responsive information, under the "control" prong of Rule 34. The court recognized that "[u]nder some circumstances, a court could determine that an employer has control over documents maintained by a former employee." For example, suggesting that an employer may have "control" over information in the possession of a former employee if that individual is still receiving economic benefits from the employer.

Other courts have required an employer to contact former employees to determine whether they took responsive documents under certain circumstances. See, e.g., Export-Import Bank of the United States v. Asia Pulp & Paper Co., Ltd., 233 F.R.D. 338 (S.D.N.Y. 2005) (holding that a corporation must exhaust the practical means at its disposal to obtain relevant documents in the possession of former employees); McCoy v. Whirlpool Corp., 214 F.R.D. 637 (D. Kan. 2003) (requiring defendant to contact former employees to determine whether they were in possession of responsive documents); Lintz v. Am. Gen. Fin., Inc., 1999 Dist. LEXIS 12572 (D. Kan. 1999) (suggesting that the defendants' obligation to undertake a reasonable investigation for relevant documents included contacting former knowledgeable employees).

What does this mean? You should give consideration to whether a particular claim at issue leads you to believe that one or more former employees (e.g., a specific manager or engineer) would be considered to be a "key player" who may have had, and may still have, information relevant to the claim. The current legal test may be applied to hold that your company has "control" over relevant information in the possession of such former employees in some situations. To the extent that your company does not include consideration of former employees in its ESI preservation, search, and collection process, it does so at its peril.

Conclusion: Expand Your Scope to Recognize Third Parties
The scope of a party's legal obligation to preserve, search for, and produce electronically stored information is broader than what a party has in its own "possession" or "custody." But that too narrow scope - confined to an inward look at the client organization itself - is typically assumed by most in-house and outside counsel, who are obliged to ensure that all ESI within the "control" of a party is preserved, searched, and produced.

Your organization's ESI preservation, retention, collection, and production policies and procedures must be developed - or modified if necessary - to ensure the inclusion of all ESI deemed to be within the organization's "control" even where in the actual possession of third parties. As the discovery sanctions decisions of the past several years teach, failing that means significant legal risk and sanctions exposure, for both the client organization as well as the in-house and outside attorneys charged with satisfying the organization's discovery obligations.

Bowman and Brooke can help. If you need help, or would like a copy of any of the cases cited above, feel free to contact the author.

--------------------------------------------------------------------------------

Ronald C. Wernette, author, is a partner with the law firm of Bowman and Brooke LLP, where he concentrates on commercial, tort and product liability litigation, and advises clients on electronic discovery, electronic information management, compliance and retention/destruction policies and protocols. Ron can be reached at 248.687.5319 or at ron.wernette@bowmanandbrooke.com.

Bowman and Brooke's E-Discovery newsletter is designed to provide quick, current and newsworthy information to today's legal and discovery professional. This newsletter does not provide legal advice.

© 2008 Bowman and Brooke LLP. All rights reserved.