Duty to Preserve Generally
Although preserving data when faced with a third-party subpoena may be new territory, most companies are aware of their duty to preserve data when they are a party to litigation. If a company is a party to litigation, the duty to preserve relevant data is triggered at the latest when the litigation commences, such as when the company receives service of process, and the duty can be triggered earlier if the company reasonably anticipates becoming a party to litigation. See Fed. R. Civ. P. 37(f) advisory committee’s note to 2006 amendment; Turner v. United States, 736 F.3d 274, 282 (4th Cir. 2013); Zubulake v. UBS-Warburg, LLC (Zubulake IV), 220 F.R.D. 212, 216 (S.D.N.Y. 2003); Sedona Conference, “Commentary on Legal Holds: The Trigger & The Process,” 2 Sedona Conf. J. 265, 271 (2010) [hereinafter Sedona Conference, “Commentary on Legal Holds”]; 8B Charles Alan Wright et al., Federal Practice and Procedure § 2284.2 (3d ed. 2017).
Determining whether a lawsuit has commenced is usually straightforward; however, prior to the commencement of a lawsuit, it is not always clear when a company should reasonably anticipate litigation, and determining whether a duty to preserve has been triggered requires analysis of all the circumstances on a case-by-case basis. See Micron Tech., Inc. v. Rambus, Inc., 645 F.3d 1311, 1320 (Fed. Cir. 2011); Kronisch v. United States, 150 F.3d 112, 126 (2d Cir. 1998); Sedona Conference, “Commentary on Legal Holds,” at 271–72. Companies in heavily regulated industries—such as the health insurance, pharmaceutical, and financial industries—may also be familiar with their duties to preserve data in response to administrative subpoenas as well as notices from state or federal regulators demanding preservation of data relevant to an ongoing investigation.
Once it is determined that the duty to preserve relevant data has been triggered, many companies have processes in place that enable them to satisfy that duty. Companies are encouraged to develop robust information governance and records management practices, including defensible data disposal policies, in order to reduce risks and costs associated with retaining unneeded data. See Sedona Conference, Commentary on Information Governance 7–12 (2d ed. 2018) (Oct. 2018 public comment version); Sedona Conference, Principles and Commentary on Defensible Disposition 10–11 (2018) (Aug. 2018 public comment version). They often do so by investing in and implementing largely automated systems to dispose of data on a regular basis as the data age. Once the duty to preserve is triggered, however, companies are required to issue a litigation hold, which is intended to interrupt the routine operations that otherwise might result in the disposal of discoverable information. See Zubulake IV, 220 F.R.D. at 218; Sedona Conference, “The Sedona Principles, Third Edition: Best Practices, Recommendations & Principles for Addressing Electronic Document Production,” 19 Sedona Conf. J. 1 cmt. 5.d (2018) [hereinafter “The Sedona Principles”].
Interrupting a company’s normal data disposal process can be costly and disruptive. It not only diminishes the value of the company’s investment in information-governance processes and infrastructure, but it also increases costs by devoting information-governance resources that are normally used elsewhere more profitably. For instance, in response to a preservation duty, companies must usually undertake the tasks of ascertaining the relevant data, identifying custodians of the relevant data, formulating a legal hold notice and supplemental notices, and ensuring employees’ compliance with the legal hold. See “The Sedona Principles,” cmts. 5.c–5.d. Each of these tasks can involve the commitment of substantial resources.
Although complying with a preservation duty can be costly and disruptive, it is necessary to do so to avoid the risks of even greater cost and disruption associated with litigating spoliation claims and sanctions. Fortunately, companies have a number of tools at their disposal to limit the costs of preserving data outside the normal course of business and to meet the preservation duties arising from litigation and other circumstances. These cost-saving tools include developing strategies to right-size the scope of preservation in litigation and in responding to investigative subpoenas, taking full advantage of the rules of discovery to reduce the burden of preservation at the earliest stages of litigation, and even shifting the costs of production in litigation to the party requesting production.
Although companies can take advantage of tools to manage the cost of complying with a preservation duty, it would be best for companies to avoid the costs and disruptions of preserving data they would normally dispose of. Companies usually do not have that option when they are parties to litigation or when they are responding to an investigatory subpoena. However, they might be able to avoid some of these additional costs and disruptions when confronted by a third-party subpoena arising from litigation in which they are not a party.
Duty to Preserve Pursuant to a Third-Party Subpoena
Does a third-party subpoena create a duty to preserve responsive data? The short answer is yes. However, depending on the circumstances, a company that receives a third-party subpoena might be able to avoid much of the cost and disruption associated with the preservation duty traditionally imposed on litigants. Generally, if a company is under a duty to preserve data because it is a party to litigation or because it reasonably anticipates becoming one, the duty terminates only when the litigation or the potential for it has ended. See Sedona Conference, “Commentary on Legal Holds,” at 287; Sedona Conference, The Sedona Guidelines: Best Practice Guidelines & Commentary for Managing Information & Records in the Electronic Age cmt. 5.i (2d ed. 2007). In that situation, litigation or the potential for litigation can last for a protracted period, and the costs and disruption occasioned by the preservation duty can be onerous. Conversely, if the company is not a party and reasonably does not anticipate becoming a party to litigation, its duty to preserve data pursuant to a third-party subpoena typically ends after it has taken reasonable measures to produce responsive data. See Sedona Conference, “Commentary on Non-Party Production & Rule 45 Subpoenas,” 9 Sedona Conf. J. 197, 199, 202–3 (2008) [hereinafter Sedona Conference, “Commentary on Non-Party Production”]. Thus, the period of a nonparty’s preservation duty is usually much shorter than that of a party’s, which can significantly decrease the relative cost and disruption incurred by the nonparty. A company’s assessment of the extent of its duty to preserve when confronted by a third-party subpoena proceeds along lines similar to an assessment of its duty to preserve that might arise in other contexts.
First, as in other contexts, the company should determine whether its receipt of a third-party subpoena, in light of the entirety of the circumstances, should cause it to reasonably anticipate becoming a party to any pending or potential litigation. Although service of, and compliance with, a third-party subpoena alone is usually not enough, some courts have found that receipt of a third-party subpoena, in light of other facts, can provide sufficient notice to a company that it may become a party to the underlying litigation or some future litigation and therefore can impose a duty to preserve relevant information. See Sedona Conference, “Commentary on Non-Party Production,” at 199 (citing In re Napster, Inc. Copyright Litig., 462 F. Supp. 2d 1060 (N.D. Cal. 2006)). If the company determines that it should reasonably anticipate becoming involved in litigation as a party due to its receipt of a third-party subpoena, then its preservation duty will extend to the conclusion of the litigation, and it will not be able to avoid the additional costs.
Second, the company should determine whether it has any independent duty to preserve the data at issue aside from any duty arising from pending or potential litigation or government investigation. Both federal and state statutes and regulations obligate companies—especially companies in already highly regulated industries—to retain certain types of data for specified periods. See generally Sedona Conference, Principles and Commentary on Defensible Disposition cmt. 1.d. In addition, it is not uncommon for companies to have contractual arrangements requiring them to handle data in specified ways and to preserve the data for specified periods. See id. at 10; Sedona Conference, “Commentary on Non-Party Production,” at 19. Further, state tort law, in limited circumstances, can sometimes impose on a company a duty to preserve data that a would-be party seeks to use in a lawsuit against another. For instance, a few jurisdictions have recognized an independent tort for spoliation of evidence by a third party. Among them are Florida (see Amerisure Ins. Co. v. Rodriguez, Nos. 3D18-1524 & 3D18-1058, 2018 WL 4608993 (Fla. Dist. Ct. App. Sept. 26, 2018); Jiminez v. Cmty. Asphalt Corp., 968 So. 2d 668 (Fla. Dist. Ct. App. 2007)), Indiana (see Shirey v. Flenar, 89 N.E.3d 1102 (Ind. Ct. App. 2017) (citing Thompson ex rel. Thompson v. Owensby, 704 N.E.2d 134 (Ind. Ct. App. 1998)), and West Virginia (see Hannah v. Heeter, 584 S.E.2d 560 (W. Va. 2003)). Most states either have never adopted such a tort or have outright rejected it. They include California (see Temple Cmty. Hosp. v. Superior Court, 976 P.2d 223 (Cal. 1999)), Georgia (see Phillips v. Owner Ins. Co., 802 S.E.2d 420 (Ga. Ct. App. 2017)), North Carolina (see Grant v. High Point Reg’l Health Sys., 645 S.E.2d 851 (N.C. Ct. App. 2007)), and South Carolina (see Cole Vision Corp. v Hobbs, 714 S.E.2d 537 (S.C. 2011)). If the company determines that it has an independent duty to preserve the data—whether pursuant to statute, regulation, contractual agreement, or tort law—then the company must preserve the data for as long as required to comply with the duty, regardless of whether it has already taken reasonable measures to produce the data in response to a third-party subpoena.
Third, assuming the company should not reasonably anticipate becoming a party to litigation and has no other independent preservation obligation, the company should then consider the extent of the preservation duty created by the third-party subpoena. Case law on the issue is underdeveloped and unclear. See “The Sedona Principles” cmt. 5.a. For example, a number of courts have implied or expressly stated that the duty exists, albeit with little analysis. See In re Broiler Chicken Grower Litig., No. 6:17-CV-00033-RJS, 2017 WL 3841912, at *4 (E.D. Okla. Sept. 1, 2017); Garcia v. Target Corp., 276 F. Supp. 3d 921, 925 (D. Minn. 2016); Charvat v. Nat’l Holdings Corp., No. 2:14-cv-2205, 2015 WL 4450657, at *1 (S.D. Ohio July 20, 2015); City of Lindsay v. Sociedad Quimica y Minera de Chile S.A., No. 1:11-CV-00046-LJO-SMS, 2012 WL 2798966, at *5 (E.D. Cal. July 9, 2012); Johnson v. U.S. Bank Nat’l Ass’n, No. 1:09-cv-492, 2009 WL 4682668, at *2 (S.D. Ohio Dec. 3, 2009); Appliance Zone, LLC v. Nextag, Inc., No. 4:09-cv-89-SEB-WGH, 2009 WL 2476566, at *2 (S.D. Ind. Aug. 12, 2009); In re Rosenthal, No. H-04-186, 2008 WL 983702, at *8 (S.D. Tex. Mar. 28, 2008); In re Napster, Inc. Copyright Litig., 462 F. Supp. 2d 1060, 1068 (N.D. Cal. 2006); Cobell v. Norton, 283 F. Supp. 2d 66, 160 (D.D.C. 2003), vacated in part on other grounds, 392 F.3d 461 (D.C. Cir. 2004).
Decisions from other courts, and in some instances the same courts that have suggested the duty exists, have suggested that no preservation duty arises from receipt of a third-party subpoena. See Swetic Chiropractic & Rehab. Ctr., Inc. v. Foot Levelers, Inc., No. 2:16-cv-236, 2016 WL 1657922, at *3 (S.D. Ohio Apr. 27, 2016); Bright Sols. for Dyslexia, Inc. v. Doe 1, No. 15-cv-01618-JSC, 2015 WL 5159125, at *2 (N.D. Cal. Sept. 2, 2015); Gambino v. Payne, No. 12-CV-824, 2015 WL 1823754, at *5 (W.D.N.Y. Apr. 22, 2015); Novak v. Kasaks, No. 96 CIV. 3073 (AGS), 1996 WL 467534, at *2 (S.D.N.Y. Aug. 16, 1996). In a few idiosyncratic contexts—for instance, when lifting a stay pursuant to the Private Securities Litigation Reform Act to permit parties to issue subpoenas requiring nonparties to preserve evidence—courts have specified that a particular third-party subpoena imposes a preservation duty. See, e.g., Mori v. Saito, 802 F. Supp. 2d 520 (S.D.N.Y. 2011). Even in this context, however, it is unclear whether courts believe third-party subpoenas generally impose a preservation duty or, rather, that courts believe they must expressly impose this duty because it generally does not arise from the mere issuance of a third-party subpoena.
Many practitioners presume that a company that receives a third-party subpoena has a duty to preserve data it reasonably expects are responsive to the subpoena. See, e.g., Sedona Conference, “Commentary on Non-Party Production,” at 202. Of course, as previously explained, if a company’s preservation duty arises from a third-party subpoena, and it reasonably does not anticipate becoming a party to litigation and has no other independent preservation duty, its duty to preserve responsive data terminates when it has taken reasonable measures to produce the data. The upshot is that, because companies are usually able to produce responsive data long before the litigation concludes, the preservation duty in these circumstances often incurs substantially lower cost and disruption than the cost and disruption incurred under the preservation duty attendant to litigants.
In addition to the shortened preservation period, a company receiving a third-party subpoena can benefit in other ways from its capacity as a nonparty. Although a third-party subpoena does impose on the company a duty to preserve data, courts tend to view discovery duties, including the duty to preserve, as resting primarily on the parties. See Zubulake v. UBS-Warburg, LLC (Zubulake V), 229 F.R.D. 422, 436 (S.D.N.Y. 2004). Because nonparties lack an interest in the outcome of the case, courts are more apt to be lenient with nonparties. See Sedona Conference, “Commentary on Non-Party Production,” at 200. Thus, courts tend to be particularly sensitive to the burdens imposed on nonparties by overly broad third-party subpoenas (see Cusumano v. Microsoft Corp., 162 F.3d 708, 717 (1st Cir. 1998); Guy Chem. Co. v. Romaco AG, 243 F.R.D. 310, 313 (N.D. Ind. 2007); Fears v. Wilhelmina Model Agency, Inc., No. 02 Civ. 4911(HB)(HBP), 2004 WL 719185, at *1 (S.D.N.Y. Apr. 1, 2004)), including the burden of preserving data that a company would not otherwise preserve in the normal course of business. See Capricorn Power Co., Inc. v. Siemens Westinghouse Power Corp., 220 F.R.D. 429, 436 (W.D. Pa. 2004). In addition, when nonparties fail to preserve evidence, courts tend to focus on any potential culpability of the parties rather than on the culpability of nonparties. See GenOn Mid-Atl., LLC v. Stone & Webster, Inc., 282 F.R.D. 346, 355 (S.D.N.Y. 2012); Goodman v. Praxair Servs., Inc., 632 F. Supp. 2d 494, 515 (D. Md. 2009). The courts’ aversion to overburdening nonparties with the costs of discovery, including preservation of data, can be leveraged in negotiations with the party issuing the third-party subpoena to obtain limitations on the scope of the data sought, sources of data, the form of production, and even the duration of the preservation duty. See Sedona Conference, “Commentary on Non-Party Production,” at 5–6, 8.
Conclusion
A company generally has a duty to preserve data responsive to a third-party subpoena. The company should determine whether the third-party subpoena should cause it to reasonably anticipate becoming a party in litigation and whether there are any other independent obligations to preserve the data at issue. In the absence of those circumstances, the company will likely be able to limit the costs and disruptions to its normal data disposal processes due to the likely brevity of the preservation period and the leverage gained from being a nonparty negotiating with the party issuing the subpoena.
