Civil Litigation and Privacy

Question 1

Define:

protective orders for personal information

Answer 1

judge determines what information should not be made public and what conditions apply to those who may access the protected information

Question 2

FRCP 26(c) for protective orders

Answer 2

a party may seek a protective order providing that confidential information may not be revealed or must be revealed in a particular way during litigation by demonstrating good cause, and a court will apply a three-part test in deciding whether to grant the request
1. resisting party must show the info to be confidential
2. requesting party must show that the info is relevant and necessary to the case
3. court must weigh the harm of disclosure against the need for information

Question 3

Define:

qualified protected order (HIPAA)

Answer 3

applies in state courts and prohibits parties from using or disclosing PHI for any purpose other than the litigation or proceeding for which such information was requested
* requires return to the covered entity or destruction of the PHI (including copies) at the end of the litigation

Question 4

Define:

redaction

Answer 4

practice of identifying and removing or blocking information from documents being produced pursuant to a discovery request or as evidence in a court proceeding

Question 5

Define:

FRCP Rule 5.2 “Privacy Protection for FIlings Made with the Court” redation rule

Answer 5

attorneys required to redact documents so that no more than the following info is included in court filings:
* last 4 digits of SS # and taxpayer ID #
* year of individual’s birth
* if individual is a minor, only the minor’s initials
* last four digits of financial account number

Question 6

Define:

electronically stored information (ESI)

Answer 6

includes not just email or word processing documents, but databases, web pages, server logs, IM transcripts, voicemail systems, virtual meetings, social networking records, thumb drives or even micro SD cards found in smartphones

Question 7

Define:

Sedona Conference

Answer 7

contains best practices for managing e-discovery compliance through data retention polices with four key guidelines:
* email retention policies should be administered by interdisciplinary teams composed of participants across a diverse array of business units
* such teams should continually develop their understanding of the policies and practices in place and identify the gaps between policy and practice
* interdisciplinary teams should reach consensus as to policies while looking to industry standards
* technical solutions should meet and parallel the functional requirements of the org

Question 8

What kind of business data falls outside the duty of preservation for discovery?

Answer 8

when in good faith, data that is “transitory in nature, not routinely created or maintained by Ds for their business purposes, and requiring of additional steps to retrieve and store” may be considered outside the duty of preservation

Question 9

What is the three-factor test courts apply where discovery obligations in direct conflict with business practices?

Answer 9

1. retention policy should be reasonable considering the facts of the situation
2. courts may consider similar complaints against the org
3. courts may evaluate whether the org instituted the policy in bad faith

Question 10

What is the HIPAA policy on PHI disclosure during discovery?

Answer 10

1. if subject authorizes release of records
2. subject to court order
3. subject to discovery request if satisfactory assurances are provided
   - “satisfactory assurance”: if party seeking request for info has agreed to a qualified protective order and has submitted it to the court, or if have requested a qualified protective order
   - qualified protective order requires that both parties are prohibited from using or disclosing PHI for any purpose other than the litigation and that the PHI will be returned or destroyed at end of litigation

Question 11

What is the policy on disclosure of protected information under GLBA?

Answer 11

financial institution may disclose otherwise protected information to:
* comply with laws
* comply with properly authorized investigation or subpoena or summons by authorities
* to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for purposes authorized by law

Question 12

Define:

Hague Convention on the Taking of Evidence

Answer 12

under the treaty, party seeking to displace the FRCP bears the burden of demonstrating that it is more appropriate to use the Hague Convention and must establish that the foreign law prohibits the discovery sought

Question 13

What are the factors to take into consideration under the Hague Convention on the Taking of Evidence?

Answer 13

factors to consider:
* important of documents or data to litigation at hand
* specificity of the request
* whether the info originated in the US
availability of alternative means of securing the info
extent to which the important interests of the United States and the foreign state would be undermined by an adverse ruling (most important)

Question 14

How should data be protected in transfer?

Answer 14

• for transfer, data should be encrypted, and the key transferred by a secure second method of transport
• if shipped as physical media, should preserve an audit trail
• can transfer by secure connection