“Privacy is not an option, and [losing] it shouldn’t be the price we accept for just getting on the internet.”[1]
**This article was initially published at 61 Advocate 19, 23 (2018). (The journal of the Idaho State Bar. It was authored by Zach Zollinger, a former associate of the firm, with editorial assistance of Kurt Holzer.)
The intersection of internet privacy and civil discovery is an active locus of judicial scrutiny across the country. The question at this point is not whether social media information[2] is discoverable, but the extent of its discoverability.[3] This judicial inquiry becomes even more important as people online increasingly share their personal data.[4] Its important to make sure clients understand their exposure in this realm. While some argue social media content opens a new discovery realm requiring special analysis, the reality is that courts across the country—and at least one in Idaho—regularly resolve these disputes by resorting to staid principles of discovery.[5]
The amount of personal data held by social media boggles the mind
To understand the importance of properly addressing social media discovery, one needs to understand how much data exists. Social media services, like Facebook, are becoming increasingly effective at collecting information. Not surprisingly, information about the quantity and quality of that data, in aggregate or per user, is not readily available. But, it suffices to say: “[d]on’t make the mistake of thinking you’re Facebook’s customer, you’re not – you’re the product.”[6]
To drive that point home (and to satisfy my own curiosity) I decided to be my own guinea pig. I am not a “heavy” user of social media. I do not use Twitter to follow the president, Instagram to memorialize lunch, or Snapchat to snap chats of cats. I don’t share much information on Facebook, but I was an early adopter, registering in 2005. I use it to keep up with friends and tell people about significant life events such as graduation, marriage, pregnancy, and funerals. Like many of us, I also use Google’s web browser, Chrome, G-mail, and YouTube regularly. I use Google Maps for navigation. I see myself as a fairly average user: so I downloaded my Facebook and Google data.[7]
Google has 42 gigabytes of data on me.
It knows, for any day between May 1, 2013 to present, where I went, whether by car, bike, or foot, and how long I stayed.[8] It knows all of my Google searches; every email I have ever sent or received on Gmail—with attachments; the contact information for everyone in my phone; and my passwords and usernames for numerous websites (including healthcare, retirement, and financial websites). It knows every video I have watched on YouTube.[9] Because I have used Android Pay it knows my credit card information. Because I use a cell phone made by Google, it can tell me what applications I used on a certain day, how many times I opened them, and what websites I visited. It even keeps the audio from every time I have ever said “OK Google” and asked a question.
Facebook has my basic biographical information such as age, gender, education, interests, and hometown, as well as a thorough picture of my “social network” from high school, college, and law school. It even keeps track of those “friends” who have been deleted. It knows who my wife, brother, and father are. It keeps every “chat” I have had since 2005. It knows the I.P. addresses I have logged in from in the last year and the devices they are associated with. It has the advertisements and stories I have clicked, every “like” I have given, each Facebook “event” I have attended or even been invited to since 2006. In addition, it has record of every search I have made on Facebook since 2012.[10] And of course, both Google and Facebook have a large number of photographs of me, my friends, and my family—not all of which are my own.
The upshot of this is counsel often have no idea about the quantity (or nature) of information they are requesting when seeking social media discovery. This is not a criticism of lawyers. Most users of social media likely do not appreciate the information social media collects. As a result, discovery requests that appear specific and definite on their face are often extraordinarily broad and burdensome in practice.
Courts Facing Social Media Discovery Have Developed Cogent Rules
Idaho Has Clearly Articulated Discovery Standards
The Idaho Rules of Civil Procedure do not have rules specifically addressing social media content, other than to the extent it may be subsumed in rules addressing other electronically stored information. Accordingly, social media information is subject to the same discovery rules as all other information and that are applicable in most courts across the country. “Parties may obtain discovery regarding any non-privileged matter relevant to any party’s claim or defense,” even if not itself admissible so long as what is sought is “reasonably calculated” to lead to the discovery of admissible evidence.[11] Relevant evidence is “evidence having any tendency to make the existence of any fact that is of consequence to the determination of the action more probable or less probable….”[12] That said, a court “must limit the frequency or extent of discovery otherwise allowed” if it determines the “burden or expense of the proposed discovery outweighs its likely benefit….”[13] Finally, a request to produce documents, any tangible thing, or entry onto land or other property “must describe with reasonable particularity each item or category of items to be inspected.”[14]
Social media information guidelines are developing from application of those standards
The better approach to social media discovery both recognizes the massive nature of social media and applies traditional discovery principles. At least one Idaho court, in the case of Jackson v. Crow, has wrestled with the issues and reached conclusions well within the mainstream of the national analysis.[15] Four general trends can be seen in the cases.
First, while information from social media accounts is generally discoverable, this is because requesting without limitation the extraordinarily broad universe of social media information is not “reasonably calculated” to discover admissible information.[16] Courts do not condone or enforce such requests. The Idaho court in Jackson agrees: “Defendant’s request for ‘all photographs, videos, or writing posted or uploaded’ by Plaintiff on social networking websites from [the accident to present] is overbroad, and much of the information requested would not be relevant to the claims in this case.”[17]
Second, requests for “complete access” to a social media account (e.g., a username and password) cast “too wide a net” and would constitute “an inquiry into scores of quasi-personal information that would be irrelevant and non-discoverable.”[18] One court neatly denied a request for the username and passwords of social media accounts, reasoning that a “[d]efendant is no more entitled to such unfettered access to plaintiff’s personal email and social networking communications than it is to rummage through the desk drawers and closets in plaintiff’s home.”[19] Yet another explained:
The Court suspects that even a casual reader would view these requests as intrusive, particularly given the fact that the combination of requests for log-in and password information and an accompanying request for an authorization that Facebook turn over all the sought-after information would essentially render moot any exercise of discretion by [plaintiff] or his counsel for determining what, if any,information was actually discoverable.[20]
Again, the court in Jackson agrees. That court summarized similar holdings with approval: “request for access to all of plaintiff’s post-accident Facebook postings was overbroad….[and a] request for all of plaintiff’s…social networking accounts was overbroad and not narrowly tailored….”[21]
Third, “[c]ourts are wary about granting discovery of social media content where the requesting party has not identified some specific evidence tending to show that relevant information exists.”[22] Consequently, a plaintiff does not make the entirety of their social media information discoverable simply because they allege an injury resulting in “a host of physical and emotional injuries,” because “a party seeking discovery of social networking information must make a threshold showing that publicly-available information on those sites undermines the non-movant’s claims.”[23] Simply put, “a [d]efendant does not have a generalized right to rummage at will through information that plaintiff has limited from public view.”[24] This principle, as discussed further below, has also been adopted by the Idaho decision.[25]
Fourth, if a party[26] presents evidence that social media information may undermine claims or defenses in a case, requests for social media discovery must still be reasonably particular and narrowly tailored.[27] For example, requests have been limited by courts to posts or photographs that directly relate to a discrete issue in that case, from specific days and at specific times.[28] And if requests are properly tailored, counsel—just like with all other discovery in a case—is tasked with reviewing the material and making an appropriate production.[29] Again, this was the approach taken by the Jackson court.[30]
- Problematic discovery examples from local practice
Practitioners who have not looked to the jurisprudence surrounding social media discovery regularly submit overbroad “fishing expedition” requests for social media information. Two such requests for social media information recently received in ongoing litigation serve as good platforms to develop examples of what is (and, is not) a proper social media discovery request.
In the first instance, a woman was struck while riding a bicycle and suffered a mild traumatic brain injury. Defense counsel submitted a request that effectively sought an entire Facebook profile (and gave instructions on how to download the same) beginning a year prior to the accident. It reads:
Request for Production:Please produce any and all notes, diaries, logs, journals, letters, e-mail,text messages, instant messages, calendars, or social media messages, postings,status updates, or comments from one (1) year prior to the subject motor vehicle accident to the present that relate or refer to the accident, this litigation, your alleged injuries, your physical well-being, health conditions or health care, your employment, or any vacations or business trips you have taken. This request includes, but is not limited to:
1. All postings made by you, to you, or otherwise associated with or made part of your social media, whether private or public, including on a Facebook account,Twitter, Instagram, or any other social media site;
2. Photographs you have posted, are tagged in, and/or have shared;
3. All information you have shared including, but not limited to, activities, hobbies,interests, entertainment, education, and/or work.
For Facebook, you may collect the requested data by the following method:
1. Log on your Facebook account;
2. Go to your Settings;
3. Click “Download a copy of your Facebook data.
Although this request contains some limiting language initially, its effect is undone when it clarifies that it seeks “all” postings, photographs, and information shared. This point is driven home when the request suggests that this information can be gathered by downloading an entire Facebook account. The client suffered a brain injury and in response was asked to produce every Facebook photo she had posted, shared, or been tagged in. Such a carte blanche approach of “rummage[ing] through the desk drawers and closets in plaintiff’s home” has been repeatedly rejected as overbroad and not properly tailored to the facts of a case. It certainly was not based in any discrepancies in public social media information and claims in the case. In short, it was not reasonably particular or narrowly tailored.
The second request comes from a case involving a significant injury to a motorcyclist who incurred a lifelong need for medication from injuries in the incident. It reads:
Request for Production: Please produce all online profiles, postings, messages (including, without limitation, tweets, replies, retweets, direct messages, status updates, wall comments, groups joined, activity streams, and blog entries), photographs,videos, and online communications that:
Refer or relate to the allegations set forth in your Complaint or in any way relate to the Accident which is the subject of your Complaint;
Reveal, refer, or relate to any physical condition, mental condition, mental state,emotion, or feeling, beginning six (6) months prior to the Accident which is the subject of your Complaint and continuing to the present; and
Refer or relate to your injuries, recovery from your injuries, your claims and your damages resulting from the Accident which is the subject of your Complaint.
Compared to the first example, this request is an improvement. On one hand, it does not plainly seek the production of the entire contents of an online account. By its terms the request for an “online profile” seeks a single page of an account not the whole account. On the other, the parenthetical defines “messages” very broadly.
It is an improvement over the prior request because it attempts to tie itself directly to discrete issues in the litigation by way of reference to the Complaint. It also attempted to limit itself to information that “refers or relates” to the plaintiff’s allegations, alleged injuries, and damages. However, it does not limit itself to specific dates, times, or keywords. And it does not indicate what publicly available information implicates private information.
- A cogently reasoned Idaho decision balances discoverability and privacy
As noted, the above requests are overbroad, not limited to specific dates, times, or keywords, and do not refer to publicly available social media information that “undermine” any claims. Consequently, as courts across the country have held, they are improper. Indeed, in the absence of facts suggesting that relevant information is to be found among a party’s social media information, discovery requests that seek it are fishing expeditions and not condoned. This reasoning was wholly adopted by Judge Timothy Hansen in the Jackson case.[31]
Judge Hansen explained that “courts in other jurisdictions that have addressed the issue have generally held that a party demanding access to social networking accounts must demonstrate that the request will lead to the disclosure of relevant evidence or is reasonably calculated to lead to the discovery of information bearing on the claims.”[32]
“Specifically, the party seeking the discovery must establish a factual predicate for the request by identifying information in the responding party’s social networking account that contradicts or conflicts with that party’s alleged restrictions, disabilities, losses, or other claims.”[33]
The court went on to explain that in other cases, the discovery had gone forth where, for example, a party claimed that due to an injury he could no longer play the piano, yet posted a picture of him playing the piano to Facebook. In Jackson, Judge Hansen allowed modified discovery to proceed because the plaintiff alleged a loss of enjoyment of life and ongoing permanent physical impairment, and the defendant provided screen shots of the Plaintiff’s Facebook account indicating he could ride a motorcycle and enjoyed painting, traveling and photography.
As a result, Judge Hansen ordered plaintiff’s counsel to review social media information “from the date of the accident to the present,” just as courts elsewhere have done,[34] and produce “information that is relevant to Plaintiff’s claims in this case and, specifically, any information that ‘contradicts or conflicts with [Plaintiff’s] alleged restrictions, disabilities, and losses, and other claims.”[35] Thus, as elsewhere, Idaho can apply traditional discovery principles to address these requests. Judge Hansen’s opinion strikes the appropriate balance and provides useful guidance.
It should go without saying that litigants, litigators, and courts all benefit from appropriate social media discovery. Still, discovery requests must be narrowly tailored. They are inappropriate if they seek the keys to a party’s house (a username and password); seek “all” information associated with a social media account; or do not identify facts suggesting relevant information is somewhere to be found within the ocean of social media content. The latter is a necessary predicate to social media discovery under traditional discovery standards.
Maybe it is true that “[p]rivacy is dead, and social media holds the smoking gun.”[36] But, courts have shown they are well equipped to balance individual privacy—or lack thereof—with the need for individual information to become part of a lawsuit. And they have done so with traditional discovery principles.
[1] Tracking the Trackers – Who Tracks You Online?, Kovacs, Gary (CEO of Mozilla Corporation), http://online-behavior.com/targeting/tracking-trackers, (last accessed Nov. 2, 2017).
[2] The term “social media” is under-inclusive given the breadth of conduct and interactions that take place on the internet.
[3] See, e.g., Tucker v. Momentive Performance Materials USA, Inc., 2016 WL 8252929, at *6 (S.D. W.V., Nov. 23, 2016).
[4] Good luck finding a client that is not on social media: in 2015, it was estimated that over 3 billion of the world’s 7 billion people are on the internet—and 2 billion of them are on Facebook. See http://time.com/money/3896219/internet-users-worldwide/ (noting that internet usage increased from 738 million in 2000 to 3.2 billion in 2015), (last accessed Nov. 2, 2017)); https://www.reuters.com/article/us-facebook-users/facebook-hits-2-billion-user-mark-doubling-in-size-since-2012-idUSKBN19I2GG, (last accessed Nov. 2, 2017).
[5] See Farley v. Callais & Sons LLC, No. 14-2550, 2015 U.S. Dist. LEXIS 104533, at *4 (E.D. La. Aug. 10, 2015) “[i]f this were a ‘traditional’ document request, that would certainly be the case. But these requests are for “social media”-based information, so the suggestion has been made that a new, perhaps yet-to-be-determined, set of discovery principles and rules should apply here. The Court disagrees.”)
[6] Information Age, Facebook is “deliberately killing privacy,” quoting Bruce Schneier (Oct. 13, 2010), available at http://www.information-age.com/facebook-is-deliberately-killing-privacy-says-schneier-1290603/ (last accessed Nov. 21, 2017).
[7] Obviously, the nature and amount of data for each person will be different. Strangely enough, I did not find a volunteer to let me download their Facebook or Google data. Instructions on how to download your data from Facebook and Google, if you are curious, are readily available online – just Google it.
[8] This information is not available for all users of Google’s services.
[9] In the words of Jonathan Goldstein, author and former producer of This American Life, “Our bookshelves are where we project our taste, where we announce to our dinner guests that, of course we enjoy Faulkner, the golden age of comics, and the essays of Montaigne. But if our bookshelves are where we telegraph a version of who we want to be, then our YouTube search histories, culled from late hours punching away at whisky soaked keyboards, are what we really are, the self that is led by desire rather than decorum.” Reply All, #16 Why is Mason Reese Crying?, available at https://gimletmedia.com/episode/16-why-is-mason-reese-crying/, (last accessed Nov. 16, 2017).
[10] Facebook keeps much more data than this on every user. A chart listing the data it maintains is available at https://www.facebook.com/help/405183566203254. It lists seventy different categories.
[11] I.R.C.P. 26(b)(1)(A).
[12] I.R.E. 401.
[13] I.R.C.P. 26(b)(1)(C).
[14] I.R.C.P. 34(b).
[15] See Jackson v. Crow, Order Re: Defendant’s Motion to Compel, at 5-7, Case No. CV-PI-1015546, Fourth Judicial District of the State of Idaho, Ada County (Dated Nov. 7, 2016) (Hansen, J.).
[16] Moore v. Wayne Smith Trucking Inc., No. 14-1919, 2015 U.S. Dist. LEXIS 143750, at *6-7 (E.D. La. Oct. 21, 2015)(collecting cases).
[17] Jackson v. Crow, Order Re: Defendnat’s Motion to Compel, Case No. CV-PI-1015546, Fourth Judicial District of State of Idaho, Ada County (Dated Nov. 7., 2016) (Hansen, J.), at p. 6.
[18] Ogden v. All-State Career Sch., 299 F.R.D. 446, 450 (W.D. Pa. 2014).
[19] See Tucker v. Momentive Performance Materials USA, Inc., Civil Action No. 2:13-cv-04480, 2016 U.S. Dist. LEXIS 187413, at *21 (S.D. W. Va. Nov. 23, 2016) (citation omitted); see also, Ogden.
[20] Farley v. Callais & Sons LLC, No. 14-2550, 2015 U.S. Dist. LEXIS 104533, at *4 (E.D. La. Aug. 10, 2015).
[21] Jackson v. Crow, at 6-7.
[22] Tucker, at * 21; see also Potts v. Dollar Tree Stores, Inc., No. 3:11-cv-01180, 2013 U.S. Dist. LEXIS 38795, at *7 (M.D. Tenn. Mar. 20, 2013) (refusing to compel social media information where “Defendant lacks any evidentiary showing that Plaintiff’s public Facebook profile contains information that will reasonably lead to the discovery of admissible evidence.”).
[23] Keller v. Nat’l Farmers Union Prop. & Cas., No. CV 12-72-M-DLC-JCL, 2013 U.S. Dist. LEXIS 452, at *11 (D. Mont. Jan. 2, 2013) (agreeing with “this circumspect approach to the discovery of social networking site content” and noting is use in “guard[ing] against the ‘proverbial fishing expedition”), citing Romano v. Steelcase, Inc., 30 Misc. 3d 426, 907 N.Y.S.2d 650, 653-57 (N.Y. Sup. Ct. 2010); Thompson v. Autolly ASP, Inc., 2012 U.S. Dist Lexis 85143, 2012 WL 234928 *4 (D. Nev. June 20, 2012) Tompkins v. Detroit Metropolitan Airport, 278 F.R.D. 387, 388-89 (E.D. Mich. 2012); McMillen v. Hummingbird Speedway, Inc., 2010 Pa. Dist. & Cnty. Dec. LEXIS 270, 2010 WL 4403285 (Pa. Com. Pl. Sept. 9, 2010); Zimmerman v. Weis Markets, Inc., 2011 Pa. Dist. & Cnty. Dec. LEXIS 187, 2011 WL 2065410 (Pa. Com. Pl. May 19, 2011).
[24] Keller, at *11-12 (citation omitted).
[25] See Jackson at 5-7.
[26] Although much of the case law, and thus the excerpts contained in this article, focus on discovery promulgated from a defendant to a plaintiff, the principles here go both ways. If a plaintiff in a complex business dispute seeks social media discovery from a company, or managerial level employees of the company, the same questions of relevance and particularity should apply.
[27] I.R.C.P. 34(b). For a thorough discussion of the problems with overly broad social media discovery and a proper narrowing of those requests, see, e.g., Farley v. Callais & Sons LLC, No. 14-2550, 2015 U.S. Dist. LEXIS 104533, at *6-14 (E.D. La. Aug. 10, 2015).
[28] Id., at *11-12; see also Baxter v. Anderson, 2016 WL 443178 (M.D. La., Aug. 19, 2016) (only Westlaw citation available); Blake v. Batmasian, 2016 WL 7442832 (S.D. Fla. July 22, 2016) (only Westlaw citation available).
[29] Farley, at *13 (E.D. La. Aug. 10, 2015); See Jackson v. Crow, Order Re: Defendant’s Motion to Compel, at 7, Case No. CV-PI-1015546, Fourth Judicial District of the State of Idaho, Ada County (Dated Nov. 7, 2016) (Hansen, J.).
[30] Jackson v. Crow, Order Re: Defendant’s Motion to Compel, at 5-7, Case No. CV-PI-1015546, Fourth Judicial District of the State of Idaho, Ada County (Dated Nov. 7, 2016) (Hansen, J.).
[31] See Order Re: Defendant’s Motion to Compel (Dated Nov. 7, 2016).
[32] Id., at 5-6, citing A.D. v. C.A., 16 N.Y.S. 3d 126, 128 (Sup. Ct. Westchester County 2015); Mailhoit v. Home Depot U.S.A., Inc., 285 F.R.D. 566, 570 (C.D. Cal. 2012).
[33] Id., at 5-6, citing Melissa “G” v. North Babylon Union Free Sch. Dist., 6 N.Y.S. 3d 445, 448 (Sup. Ct., Suffolk County 2015); Spearing v. Linmar, L.P., 11 N.Y.S. 3d 156 (N.Y. App. Div. 2015).
[34] Farley, at *13 (E.D. La. Aug. 10, 2015).
[35] Jackson v. Crow, at 7.
[36] Privacy is dead, and social media hold smoking gun,” Cashmore, Pete (CEO of Mashable.com), Oct. 28, 2009, available at http://edition.cnn.com/2009/OPINION/10/28/cashmore.online.privacy/,(last accessed Nov. 2, 2017).
Pingback: Social Media And Personal Injury: 7 Things To Know - Hepworth Holzer