Obtaining Electronic Evidence For Use in Litigation Presented by Brian Sniffen and Tara O’Hanlon Miller Nash Graham & Dunn LLP

Background/Experience Brian Sniffen – former litigator, and he’s OK with that. Data Privacy and Data Security Intellectual Property (trademarks and copyright work) General Business/Corporate Counsel Tara O’Hanlon – current litigator, she loves it. General commercial litigation Construction litigation and contract drafting Condemnation litigation Employment litigation

Discussion Topics Brian will provide an overview of things to consider from the perspective of a recipient of a subpoena or other information request. (Opportunity to reach out before it’s an issue.) Tara will discuss some of the nuts and bolts, along with some examples, of how to obtain and use electronic evidence in litigation.

The Recipient’s Perspective When your client receives a subpoena or other document request, do your litigation thing (read, analyze with client, respond/object, confer, seek protective order if necessary). Then ask: Do you and your client have a continuing obligation to make sure the data produced is protected (or redacted before production)? Does your client have a duty to notify the data owner (and if so, how soon)? What else might your client have said about how it would protect the data? Ideally, your client will know the answers to these already.

Continuing Obligation? Short answer: yes. Certain sensitive data is subject to administrative, technical, and physical safeguards. See, e.g., ORS 646A.622. There may be litigation exceptions. Turning over sensitive data can result in a “data incident.” See ABA and Bloomberg Law articles for discussion. Whether an “incident” is a “breach” requiring notification is subject to an “appropriate investigation” standard. See, e.g., ORS 646A.604(7); FRCP 5.2. Your client may have contractual obligations. Best practice is to consider these issues on the front end. You (the lawyer) may have ethical obligations. See, e.g., ORPC 1.6.

Duty to Notify? If there has been a “data breach,” yes. See, e.g., ORS 646A.604. You may have contractual obligations. Timing can vary. Obligations to investigate and remediate can vary.

What Else? What’s in your client’s privacy policy? What else is on your client’s website? What’s in your client’s contracts? See Oregon’s recent H.B. 2090.

Electronic Data and the Civil Rules FRCP 34 and state equivalents: Electronically stored information (“ESI”) discoverable FRCP 26: Required to identify categories and types of ESI Limitation on discovery for undue burden and cost Pre-discovery conferences (FRCP 26(f))

ESI Sources Email – standard Texts Social Media Facebook Twitter LinkedIn Reddit/YouTube Keeping up with the latest – WhatsApp/Vine/Snapchat Internet searches/browsing history

How to Request ESI Requests for Production Interrogatories Define ESI Specify format for collection Identify other devices Interrogatories Devices used Social Media/Data Platforms used

Third-party Subpoenas FRCP 45 and state equivalent Identifying the source of ESI Identifying the form of production of ESI Requesting access to devices Accessing devices during depositions Privacy/confidentiality issues Affidavit of deponent authenticating ESI

Collection Methods Third-party Vendor v. Attorney v. Client Forensically Sound – no change in metadata Case law disfavoring client collection Collection software: iMazing, AirDroid Data privacy issues Cost considerations Testimony/Authentication

Authentication Proposed changes to FRE 902: authentication by certification (13) Certified Records Generated by an Electronic Process or System. A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent must also meet the notice requirements of Rule 902(11). (14) Certified Data Copied from an Electronic Device, Storage Medium, or File. Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent also must meet the notice requirements of Rule 902(11).

Advancing your Case with ESI People are more careful with email, less so with texts/social media Hard to dispute witness/party’s own words Possibility for “smoking gun” evidence Thinking outside the box for sources of ESI

Thank You Brian Sniffen 111 S.W. Fifth Avenue Suite 3400 Portland, OR 97204 brian.sniffen@millernash.com 503.205.2443 Tara O’Hanlon Pier 70 2801 Alaskan Way, Suite 300 Seattle, WA 98121 tara.ohanlon@millernash.com 206.777.7442