JANUARY 2003 Vol. 70 • No. 1 • Pages 1-184 the Privacy Project

JANUARY 2003

Vol. 70 • No. 1 • Pages 1-184

The Privacy Project

Defending Protective Orders Privacy and the Human Genome Project Privilege for Internal E-mails Analyzing Self-critical Analyses Protecting Against Cybersmear Monitoring the Electronic Workplace Romantic Relationships at Work Privacy from the Judicial Perspective Personal Data Protection in the U.K. Personal Data Protection in Australia The HIPPA Privacy Rule

Fidelity and Surety Survey

President’s Page: Introducing the Privacy Project

Current Decisions Reviewing the Law Reviews

Issued Quarterly by International Association of Defense Counsel Just published from IADC . . . by IADC members . . .

Advocacyinthe 21stCentury

ESSAYSBYLEADINGDEFENSEPRACTITIONERS

EditedbyRichardB.Allen,DavidBrock, JanetH.GoreandJoanFullamIrick

PretrialIssues SpoliationofEvidence DirectExaminationofDefendant Cross-examinationofDaubertExperts ComputerizedExhibits JuryTrialInnovations LegalMalpractice TraumaticBrainInjuries LearnedIntermediaryDoctrine JointDefenseDoctrine DefendingPTSDClaims ForeignPartiesinU.S.Litigation Post-judgmentMotions RiskManagement

Loose-leaf bound for easy supplementation and updating $85.00 To order, write, fax (312-368-1854), e-mail ([email protected]) or order online at www.iadclaw.org/scriptcontent/books.cfm International Association of Defense Counsel Suite 2400 One North Franklin Chicago, IL 60606 Allow four to six weeks for delivery January 2003 Volume 70, No. 1 Pages 1-184 International Association of Defense Counsel Suite 2400 One North Franklin Chicago, Illinois 60606-3401 Telephone (312) 368-1494 Fax (312) 368-1854 E-mail: [email protected] Website: http://www.iadclaw.org In this issue... DEPARTMENTS

Officers and Executive Committee ...... 4 President’s Page, “Introducing The Privacy Project” ...... 5 By Joan Fullam Irick Calendar of Legal Organization Meetings ...... 6 31st Annual IADC Trial Academy ...... 7 Defense Counsel Journal ...... 8 2003 IADC Legal Writing Contest ...... 9 IADC Tenets of Professionalism ...... 10 Current Decisions ...... 168 Reviewing the Law Reviews ...... 174

FEATURE ARTICLES

THE PRIVACY PROJECT

INTRODUCTION ...... 11 THE EMPEROR HAS NO CLOTHES: HOW COURTS DENY ...... 12 PROTECTION FOR CONFIDENTIAL INFORMATION By Kathleen L. Blaner Legislatures, the plaintiffs bar and the media are assaulting protective orders THE BRAVE NEW WORLD IS HERE: PRIVACY ISSUES — ...... 22 AND THE HUMAN GENOME PROJECT By Robert A. Curley and Lisa M. Caperna Governments and courts must step in to provide protections and regulations DISCOVERY UNPLUGGED: SHOULD INTERNAL E-MAILS ...... 36 BE PRIVILEGED CONFIDENTIAL COMMUNICATIONS? By Ralph Streza To keep pace with technology, discovery should protect intra-company e-mails THE SELF-CRITICAL ANALYSIS PRIVILEGE ...... 40 IN THE PRODUCT LIABILITY CONTEXT By George S. Hodges, Karen A. Jockimo and Paul E. Svensson Self-analysis should be considered as a subsequent remedial measure Contents Page 3

CYBERSMEAR MAY BE COMING TO A WEBSITE ...... 51 NEAR YOU: A PRIMER FOR CORPORATE VICTIMS By Thomas G. Ciarlone Jr. and Eric W. Wiechmann How to respond presents both legal and non-legal problems BETWEEN THE DEVIL AND THE DEEP BLUE SEA: ...... 65 MONITORING THE ELECTRONIC WORKPLACE By William G. Porter II and Michael C. Griffaton Employers must have detailed, understandable and fair policies ROMANTIC RELATIONSHIPS AT WORK: DOES ...... 78 PRIVACY TRUMP THE DATING POLICE? By Rebecca J. Wilson, Christine Filosa and Alex Fennel Courts generally uphold policies that balance employees and employers’ rights PRIVACY ISSUES FROM THE JUDICIAL PERSPECTIVE: ...... 89 REQUIREMENTS FOR PROTECTIVE ORDERS By Mark D. Fox and Chris E, Forte Counsel must draft protective order applications with detailed statements PROTECTION OF PERSONAL DATA: ...... 99 THE UNITED KINGDOM PERSPECTIVE By Laurel J. Harbour, Ian D. MacDonald and Eleni Gill The U.K.’s new Data Protection Act sets up a comprehensive and detailed regime PROTECTION OF PERSONAL DATA: ...... 106 THE AUSTRALIAN PERSPECTIVE By Steven Klimt, Narelle Symthe, S. Stuart Clark and Jason Shailer Legislation has applied the information privacy principles of 1988 to the private sector THE HIPAA PRIVACY RULE: AN OVERVIEW ...... 127 OF COMPLIANCE INITIATIVES AND REQUIREMENTS By Nancy A. Lawson, Jennifer M. Orr and Doedy Sheehan Klar The U.S. Privacy Rule contains a maze and mandates and exceptions

ANNUAL SURVEY OF FIDELITY AND SURETY LAW, 2002, PART I ...... 150 By Bettina E. Brownstein, R. Earl Welbaum, Randall I. Marmor and Roger P. Sauer. Edited by Charles W. Linder Jr. A roundup of recent cases in the field of fidelity and surety law

Defense Counsel Journal (ISSN: 0895-0016) is published quarterly (January, April, July, October) by the International Association of Defense Counsel, Suite 2400, One North Franklin, Chicago, Illinois 60606, telephone (312) 368-1494, fax (312) 368-1854, e-mail: [email protected]. Periodical postage paid at Chi- cago, IL, and additional mailing offices. The subscription price of $65.00 annually is included in the dues of members of the IADC. POSTMAS- TER: Please send address changes to Defense Counsel Journal, Suite 2400, One North Franklin, Chicago, Illinois 60606. Cite as: 70 DEF. COUNS. J. — (2003). Copyright © 2003 by the International Association of Defense Counsel. All rights reserved. Defense Counsel Journal is a forum for the publication of topical and scholarly writings on the law, its development and reform, and on the practice of law, particularly from the viewpoint of the practitioner and litigator in the civil defense and insurance fields. The opinions and positions stated in signed material are those of the author and not by the fact of publication necessarily those of the International Association of Defense Counsel. Material accepted for publication becomes the property of the IADC and will be copy- righted as a work for hire. Contributing authors are requested and expected to disclose any financial, economic or professional interests or affiliations that may have influenced positions taken or advocated in the efforts. Submit manuscripts to the Managing Editor at the above address in hard copy or via e-mail. Defense Counsel Journal follows The Bluebook: A Uniform System of Citation (17th ed.), and footnotes should be placed at the end of the article’s text. Page 4

Officers and Executive Committee

OFFICERS President, Joan Fullam Irick, Indianapolis, Indiana President-Elect, J. Walter Sinclair, Boise, Idaho Immediate Past President, William C. Cleveland III, Charleston, South Carolins Vice-President, Kirk G. Forrest, Tulsa, Oklahoma Vice-President, Lee L. Bennett, Baltimore, Maryland Secretary-Treasurer, John G. Maxa, New Bremen, Ohio Executive Director, Oliver P. Yandle, Chicago, Illinois EXECUTIVE COMMITTEE The President, the President-elect, the Vice-Presidents, the Secretary-Treasurer, and the following elected members: Terms ending July 2003 Terms ending July 2004 Terms ending July 2005 George S. Hodges S. Stuart Clark John S. Bradford White Plains, New York Sydney, New South Wales Lake Charles, Louisiana Christopher W. Tompkins Cathy Havener Greer Patrick Lysaught Seattle, Washington Denver, Colorado Kansas City, Missouri Walter E. Zink II Gregory M. Lederer Bruce R. Parker Lincoln Nebraksa Cedar Rapids, Iowa Baltimore, Maryland PAST PRESIDENTS *MYRON W. VAN AUKEN ...... 1920-1923 *EGBERT L. HAYWOOD ...... 1967-1968 *MARTIN P. CORNELIUS ...... 1923-1926 *GORDON R. CLOSE ...... 1968-1969 *EDWIN A. JONES ...... 1926-1932 *W. FORD REESE ...... 1969-1970 *GEORGE W. YANCEY ...... 1932-1934 *SAMUEL J. POWERS JR...... 1970-1971 *WALTER R. MAYNE ...... 1934-1935 *EDWARD J. KELLY ...... 1971-1972 *J. ROY DICKIE ...... 1935-1936 ALSTON JENNINGS ...... 1972-1973 *MARION N. CHRESTMAN ...... 1936-1937 WALTER A. STEELE ...... 1973-1974 *P. E. REEDER ...... 1937-1938 THEODORE P. SHIELD ...... 1974-1975 *MILO H. CRAWFORD ...... 1938-1939 JERRY V. WALKER ...... 1975-1976 *GERALD P. HAYES ...... 1939-1940 HENRY BURNETT ...... 1976-1977 *OSCAR J. BROWN ...... 1940-1941 *DARRELL L. HAVENER ...... 1977-1978 *WILLIS SMITH ...... 1941-1943 ROBERT E. LEAKE JR...... 1978-1979 *PAT H. EAGER JR...... 1943-1944 JOHN R. HOEHL ...... 1979-1980 *F. B. BAYLOR ...... 1944-1946 NEIL K. QUINN ...... 1980-1981 *PAUL J. MCGOUGH ...... 1946-1947 WILLIAM K. CHRISTOVICH ...... 1981-1982 *LOWELL WHITE ...... 1947-1948 ROBERT D. NORMAN ...... 1982-1983 *KENNETH P. GRUBB ...... 1948-1949 *GRANT P. DUBOIS ...... 1983-1984 *L. DUNCAN LLOYD ...... 1949-1950 *THOMAS H. SHARP JR...... 1984-1985 *WAYNE E. STICHTER ...... 1950-1951 *WILLIAM H. WALLACE ...... 1985-1986 *JOSEPH A. SPRAY ...... 1951-1952 HENRY B. ALSOBROOK JR...... 1986-1987 *ALVIN R. CHRISTOVICH ...... 1952-1953 W. RICHARD DAVIS ...... 1987-1988 *J. A. GOOCH ...... 1953-1954 GEORGE B. MCGUGIN ...... 1988-1989 *STANLEY C. MORRIS ...... 1954-1955 *MORRIS R. ZUCKER ...... 1989-1990 *LESTER P. DODD ...... 1955-1956 JAY H. TRESSLER ...... 1990-1991 *JOHN A. KLUWIN ...... 1956-1957 DAVID J. BECK ...... 1991-1992 *FORREST A. BETTS ...... 1957-1958 HENRY A. HENTEMANN ...... 1992-1993 *G. ARTHUR BLANCHET ...... 1958-1959 MICHAEL A. POPE ...... 1993-1994 *CHARLES E. PLEDGER JR...... 1959-1960 KEVIN J. DUNNE ...... 1994-1995 DENMAN MOODY ...... 1960-1961 EDWARD J. RICE, JR...... 1995-1996 PAYNE KARR ...... 1961-1962 GEORGE GORE ...... 1996-1997 *WILLIAM E. KNEPPER ...... 1962-1963 CHARLES F. PREUSS ...... 1997-1998 RICHARD W. GALIHER ...... 1963-1964 REX K. LINDER ...... 1998-1999 *KRAFT W. EIDMAN ...... 1964-1965 GEORGE H. MITCHELL ...... 1999-2000 *WALLACE E. SEDGWICK ...... 1965-1966 GREGORY C. READ ...... 2000-2001 *HARLEY J. MCNEAL ...... 1966-1967 WILLIAM C. CLEVELAND III ...... 2001-2002 ______*Deceased President’s Page

Introducing The Privacy Project

By Joan Fullam Irick

HEN I was selected to serve as IADC President for the 2002-03 term, I Wdecided to make the issue of corporate and personal privacy a key theme for my administration. Recent articles in newspapers, magazines and other media have been filled with “horror stories” of attacks on privacy rights, including in recent months: • The county attorney of Buena Vista County, Iowa, subpoenaing the names of hundreds of women who had pregnancy tests at a local Planned Parenthood clinic as part of an investigation of the death of an unidentified baby. • The 10 active federal trial judges in South Carolina voting unanimously to ban “secret legal settlements” on products liability, medical malpractice and other complex litigation. • Administrators at an Ivy League college hacking into a rival university’s computer system to obtain information about applicants for admission. The issue of privacy is, of course, a touchy one. While we all have a strong desire to guard our own privacy and to protect ourselves from the undue curios- ity of hackers, employers and overzealous neighbors, at the same time we want to know everything we possibly can about the backgrounds, criminal records and personal problems of those who live or work around us. In July 2001, I presented to the IADC Executive Committee a written proposal for the creation of a Privacy Project to explore in depth recent changes in the privacy landscape, the current status of privacy on both the national and international scene, and the foreseeable future of privacy in the individual and corporate worlds. The Privacy Project was then submitted to the Institute of the IADC Foundation, which agreed to oversee and supervise the implementation of my proposal. Over the past several months, a series of scholarly white papers have been authored by a number of talented and committed IADC members and partners and associates. Those papers are included in this issue of Defense Counsel Jour- nal as the first stage of the Privacy Project. Privacy will also be a key issue and a major topic of discussion at the IADC midyear meeting in February 2003 and the Corporate Counsel College in April 2003 in Chicago. In the summer of 2003, a second and more expanded volume will be published by the IADC Foundation. In addition to the authors of the papers herein, the second volume will include many additional areas of study and discussion by a number of other IADC members. I thank the individual authors and the Defense Counsel Journal editors for their efforts on behalf of the Privacy Project. Page 6 Calendar of Legal Organization Meetings

2003 February 5-11, American Bar Association Midyear Meeting, Seattle, Washington February 15-20, IADC Midyear Meeting, The Inn at Spanish Bay, Pebble Beach, California February 23-March 2, Federation of Defense and Corporate Counsel Winter Meeting, Westin Mission Hills Resort, Rancho Mirage, California March 20-23, American College of Trial Lawyers Spring Meeting, Boca Raton Resort and Club, Boca Raton, Florida April 8-13, Association of Defense Trial Attorneys Annual Meeting, Silverado Resort, Napa, California April 22-25, IADC Corporate Counsel College, Ritz-Carlton Hotel, Chicago, Illi- nois June 28-July 3, IADC Annual Meeting, Grand Wailea Resort and Spa, Maui, Hawaii August 2-9, IADC Trial Academy, University of Colorado, Boulder August 7-13, American Bar Association Annual Meeting, HQ: San Francisco Hilton, San Francisco, California October 8-10, American Corporate Counsel Association Annual Meeting, San Francisco Marriott, San Francisco, California October 15-19, Defense Research Institute Annual Meeting, Washington Hilton and Towers, Washington, D.C. October, Product Liability Advisory Council Fall Meeting, TBA October 29-November 1, American College of Trial Lawyers Annual Meeting, Fairmont Hotel, Montréal, Québec, Canada

2004 February 4-10, American Bar Association Midyear Meeting, San Antonio, Texas February 7-12, IADC Midyear Meeting, The Cloister, Sea Island, Georgia July 3-9, IADC Annual Meeting, The Homestead, Hot Springs, Virginia August 5-11, American Bar Association Annual Meeting, Atlanta, Georgia Page 7 31st Annual IADC Trial Academy

August 2-9, 2003

University of Colorado, Boulder, Colorado

The Academy is a program designed by the International Association of Defense Counsel to enhance the trial advocacy skills of younger lawyers who have been in practice from two to six years and have had actual trial experience.

Instruction in the major segments of trial are featured, including a wide variety of evidentiary problems. A seven-to-one student-faculty ratio enables faculty to critique each student’s work.

Faculty demonstrations by leading defense trial lawyers and extensive use of videotape expose participants to different approaches and ideas in solving common trial problems. A physician will familiarize the students with the medical issues, and a segment on the testimony of an economist will also be featured.

Emphasis is placed on the learning-by-doing method of instruction. Indi- vidual students will cross-examine physicians and economists acting as expert witnesses and will be videotaped while participating in all aspects of trial. Stu- dents are given videotapes containing their presentations at the conclusion of the Academy.

Only a limited number of applicants can be accepted because of the trial concepts utilized. To request an application, contact the International Association of Defense Counsel, One North Franklin, Suite 2400, Chicago, Illinois 60606, at (312) 368-1494 and ask for Nancy Chase, Conference Coordinator. Fax: 312-368- 1854. E-mail: [email protected].

The Trial Academy qualifies for CLE credits in states with CLE accreditation. Last year, most students received approximately fifty-six hours of state CLE credit. Costs incurred for attending legal seminars which maintain and improve professional skills required for employment are tax deductible. See Treas. Reg. 1.162-5; IRS Letter Ruling 7746068 (9-1-77); Coughlin v. Comm’r, 203 F.2d 307. Page 8

Defense Counsel Journal

EDITOR AND CHAIR OF THE BOARD OF EDITORS Richard L. Neumeier, Suite 1000, 11 Beacon Street, Boston, Massachusetts 02108 MANAGING EDITOR Richard B. Allen, One North Franklin, Suite 2400, Chicago, Illinois 60606-3401

BOARD OF EDITORS RICHARD L. ANTOGNINI LAWRENCE B. FINN JOHN CHARLES PIERCE MICHAEL F. AYLWARD DONALD H. FLANARY JR. G. EDWARD RUDLOFF JR. WILLIAM T. BARKER PHYLLIS M. HIX ELIZABETH HAECKER RYAN DAVID G. BROCK MITCHELL LEE LATHROP PHILIP A. SECHLER CHARLES W. BROWNING CHARLES W. LINDER JR. THOMAS F. SEGALLA PETER M. CALLAHAN CARL A. MAIO ROBERT T. VEON D. JEFFREY CAMPBELL MICHAEL L. MCALLISTER DENNIS J. WALL MICHAEL M. CHRISTOVICH NICHOLAS C. NIZAMOFF REBECCA J. WILSON JAMES B. DOLAN MARK S. OLSON LEONARD F. ZANDROW, JR. MICHAEL J. FARRELL

COMMITTEE VICE-CHAIRS OF ARTICLES Advocacy, Practice Drug, Device and Biotech Multi-National Litigation and Procedure Mary Nold Larimore Mark Leonard Tyler Jack T. Bangert Employment Law Product Liability Alternate Dispute Jay Barry Harris John B. Connarton Jr. Resolution Timothy M. O’Brien Fidelity and Surety Professional Errors Charles W. Linder Jr. and Omissions Aviation and Space Law D. Ferguson McNiel James M. Campbell Intellectual Property John B. Lunseth Property Insurance Business Litigation G. Edward Rudloff Jr. William J. Perry Legal Malpractice Thomas B. Quinn Reinsurance Excess Casualty Insurance and Surplus Lines Richard L. Antognini Legislative, Judicial and Carl A. Maio Governmental Affairs Class Actions and Lee L. Bennett Technology Multi-Party Litigation Mitchell Lee Lathrop James A. O’Neal Maritime and Energy Law Alex B. Marconi Toxic and Hazardous Construction Law Substances Litigation and Litigation Medical Defense John C. Childs John B. Connarton Jr. Daniel F. Beasley

Back issues of Defense Counsel Journal are available from William S. Hein & Co., 1285 Main St., Buffalo, N.Y. 14209 ● Defense Counsel Journal is indexed in Index to Legal Periodicals, published by H.W. Wilson Co., 950 University Ave., Bronx, N.Y. 10452 and in Current Law Index, sponsored by American Association of Law Libraries and published by Information Access Co., 362 Lakeside Drive, Foster City, Calif. 94404 ● Defense Counsel Journal is available in microform from University Microfilms Inc., 300 Zeeb Road, Ann Arbor, Mich., and in CD-ROM form from ABI/Inform, also a service of University of Microfilms Inc. ● Defense Counsel Journal is included in the online and CD-ROM services of Westlaw, West Group, 610 Opperman Drive, Eagan, Minn. 55123, and in the database of Lexis, a service of Mead Data Central, 9393 Springboro Pike, Dayton, Ohio 45401 ● Defense Counsel Journal is listed in Ulrich’s International Periodicals Directory, published by R.R. Bowker, 121 Chanlon Road, New Providence, N.J. 07974; in Insurance Almanac, published by Insurance Printing & Underwriting Co., 50 E. Palisade Ave., Englewood, N.J. 07631; in Serials Directory: An International Reference Book, published by EBSCO Indus- tries Inc., Box 1943, Birmingham, Ala. 35201; in INSURLAW/Insurance Periodicals Index Thesaurus & User’s Guide, published by NILS Publishing Co., P.O. Box 2507, Chatsworth, Calif. 91311; and in INFOSERV, an online service of Faxon Co., 15 Southwest Park, Westwood, Mass. 02090. Page 9 Announcing the 2003 International Association of Defense Counsel Legal Writing Contest

The IADC’s annual legal Writing Contest is open to law students who at the time of the submission of their articles are enrolled in law schools approved by the American Bar Associa- tion or Canadian law schools listed in the Association of American Law Schools Directory. In order to inform members of this important activity and enlist their support in publicizing the contest, the rules of the competition are listed below.

IADC LEGAL WRITING CONTEST 2003 RULES 1. Eligibility. The International Associa- clarity of expression, brevity, and literary con- tion of Defense Counsel 2003 Legal Writing struction. Entrants also should consider the Contest is open to students who, at the time of points made in the contest guidelines. submission of their entries, are enrolled in law 6. Monetary Awards. Monetary awards schools accredited by the American Bar Asso- will be made as follows: US$2,000 to first ciation or in Canadian law schools listed in the place, US$1,000 to second place, and US$500 Association of American Law Schools Direc- to third place. tory. 7. Plaques and Publication. Authors of 2. Subject Matter. Entries must be sub- monetary award articles and of those awarded mitted in the English language on a subject of honorable mention will receive commemora- practical concern to lawyers engaged in the tive plaques, and their articles will be made defense or management of the defense of civil available for publication in Defense Counsel litigation, such as, for examples, relevant as- Journal, IADC’s quarterly law review. At the pects of tort law, insurance law, civil proce- time of submission, entrants must execute the dure, evidence, damages, alternative dispute assignment of copyright in the entry certifi- resolution procedures, and professional ethics. cate. IADC will copyright articles published in 3. Authorship and Publication. Entries Defense Counsel Journal, but will release the must be certified by the entrant on the IADC copyright assignment back to entrants whose entry form to be the original and sole work of works are not published. Acceptance for publi- the entrant. At the time of submission, the en- cation in any publication other than Defense try must not have been published or accepted Counsel Journal prior to notice to the author for publication, and the author must be free to of an award in this contest will disqualify the execute the assignment of copyright to IADC entry. Entrants are expected to notify IADC referred to in Rule 7. promptly of such prior acceptance by another 4. Judging. The contest will be judged by publication. a committee of the IADC, whose decisions 8. Subscription. A year’s subscription to will be final. In addition to the monetary Defense Counsel Journal will be given to all award winners, the judges may designate en- contestants who meet the qualifications for entries worthy of honorable mention, but which try in this contest. will receive no monetary award. 9. Deadline for 2003 Entries. If transmit- 5. Judging Standards. Articles will be ted by mail, entries must be postmarked on or judged on the following factors: (1) the choice before April 16, 2003. If transmitted other of subject matter, as measured by its signifi- than by mail, they must be received on or be- cance, international or national relevance, and fore that date. timeliness; (2) the amount of work and effort, 10. Directions for Transmission. Entries, as measured by the entry’s comprehensiveness together with the completed entry form, must and analysis; (3) the quality of the legal analy- be transmitted to the International Association sis, as measured by its objectivity and balance; of Defense Counsel, One North Franklin, Suite and (4) the writing quality, as measured by 2400, Chicago, IL 60606-3401.

Contest announcement, rules, writing guidelines, and entry forms are available at http://www.iadclaw.org Page 10

International Association of Defense Counsel Tenets of Professionalism

1. We will conduct ourselves before the court in a manner which demonstrates respect for the law and preserves the decorum and integrity of the judicial process. 2. We recognize that professional courtesy is consistent with zealous advocacy. We will be civil and courteous to all with whom we come in contact and will endeavor to maintain a collegial relationship with our adversaries. 3. We will cooperate with opposing counsel when scheduling conflicts arise and calendar changes become necessary. We will also agree to opposing counsel’s request for reasonable extensions of time when the legitimate interests of our clients will not be adversely affected. 4. We will keep our clients well informed and involved in making the decisions that affect their interests, while, at the same time, avoiding emotional attachment to our clients and their activities which might impair our ability to render objective and independent advice. 5. We will counsel our clients, in appropriate cases, that initiating or engaging in settlement discussions is consistent with zealous and effective representation. 6. We will attempt to resolve matters as expeditiously and economically as possible. 7. We will honor all promises or commitments, whether oral or in writing, and strive to build a reputation for dignity, honesty and integrity. 8. We will not make groundless accusations of impropriety or attribute bad motives to other attorneys without good cause. 9. We will not engage in discovery practices or any other course of conduct designed to harass the opposing party or cause needless delay. 10. We will seek sanctions against another attorney only when fully justified by the circumstances and necessary to protect a client’s lawful interests, and never for mere tactical advantage. 11. We will not permit business concerns to undermine or corrupt our professional obligations. 12. We will strive to expand our knowledge of the law and to achieve and maintain proficiency in our areas of practice. 13. We are aware of the need to preserve the image of the legal profession in the eyes of the public and will support programs and activities that educate the public about the law and the legal system. The Privacy Project

In 2001, Joan Irick submitted a proposal for consideration to the IADC Execu- tive Committee concerning a new project for the Institute of the IADC Founda- tion. The proposal was accepted immediately by the Executive Committee as an important emerging area of law that warranted further inquiry. The IADC Foun- dation Board agreed, and the idea grew into the Privacy Project. The IADC Foundation turned to Board Member George S. Hodges, who agreed to chair an editorial team that would bring the Privacy Project from concept into a form that would benefit the IADC membership and legal community. Joining him were Joseph W. Ryan Jr. and Jerome A. Galante. A plan was implemented to research and organize every conceivable legal topic dealing with privacy. Once the list was complete, a plan developed to create a series of scholarly white papers on each privacy topic. Authors from within the IADC ranks were chosen. Each agreed to submit a paper on a specified area of privacy within a very strict timetable. Commitment to a specific topic, submission of initial outlines, drafts and final drafts were carefully coordinated during count- less telephone conferences and e-mails among the editorial board, authors and IADC staff. The goal was to have publishable material in the hands of Richard B. Allen, Managing Editor of Defense Counsel Journal, for publication in the January 2003 issue. Holding to this tight time table would allow the IADC membership an opportunity to read the scholarly papers before the February 2003 IADC midyear meeting in Pebble Beach, which has privacy as its theme. The Privacy Project editorial team thanks the authors for their commitment and dedication to this project. In particular, Kathy Blaner, Bob Curley, Ralph Streza, George Hodges, Eric Wiechmann, Bill Porter, Becky Wilson, Mark Fox, Laurel Harbour, Stu Clark and Nancy Lawson. The talent and dedication of these individuals form the cornerstone of this project. The editorial team also thanks Pam Miczuga of the IADC staff, who assisted with scheduling numerous telephone conferences, then quickly and efficiently published and distributed the minutes of the meetings, and IADC Executive Di- rector Oliver Yandle for his thoughtful suggestions and input. Finally, the editorial team thanks IADC President Joan Irick, who brought her idea to the Execu- tive Committee, which in turn provided the IADC Foundation an opportunity to sponsor a project that will improve the legal community’s understanding of privacy issues. The Privacy Project The Emperor Has No Clothes: How Courts Deny Protection for Confidential Information

Litigants’ rights to protection of information not used in judicial proceedings should trump any public right to access

By Kathleen L. Blaner IADC member Kathleen L. Blaner is chair of the IADC Legislative, Judicial HROUGHOUT the centuries, fairy and Governmental Affairs Committee, co- T tales have provided valuable lessons chair of the State Law Subcommittee of the about human nature and have given us sur- American Bar Association Litigation Sec- tion Class Action and Derivative Suits prising insights into complex adult transac- Committee, serves on the Executive Com- tions. One story, about the emperor’s new mittee of Lawyers for Civil Justice, and is clothes, sheds significant light on an ongo- a consultant to Covington & Burling. She ing controversy about whether information is a graduate of American University (A.B. produced in the preliminary stages of civil 1978) and Catholic University Law School litigation should be kept confidential when (J.D. 1989). it is not used in court. In the fairy tale, several entrepreneurial tailors trick the emperor into believing that THE NEW FAIRY TALE they have designed the most exquisite clothing ever made for royalty. In reality, This tale parallels how courts have re- the tailors have fashioned nothing. To acted to the protective order and confiden- demonstrate his acute, discerning judgment tial settlement controversy over the last de- and his great vision to the people he rules, cade.1 Some members of the media and the the emperor claims to see the “exquisite organized plaintiffs bar claim that confi- garments” that the trickster tailors pretend dentiality orders entered in litigation have to parade before them. The emperor’s advi- concealed horrific defects in products that sors are afraid to tell him there is nothing have killed hundreds or have kept secret there. The tailors pretend to measure and corporate misdeeds that have caused un- fit the “garments” just as if they had real conscionable harm.2 Others, including the cloth in their hands. No one is willing to research arm of the United States Judicial admit that there is nothing in the tailors’ Conference and the chair of the con- hands and that, when the emperor “puts ference’s Advisory Committee on Civil on” the garments, the emperor is wearing Rules have tried to point out that the facts no clothes. alleged simply do not support the claims.3

1. See generally Martha Neil, Confidential Settle- ber 10, 1990). ments Scrutinized, A.B.A. J. July 2002 at 20-22; 2. Neil, supra note 1. See also Letter dated June Arthur R. Miller, Confidentiality, Protective Orders, 24, 2002, from Chief Judge Joseph F. Anderson Jr. and Public Access to the Courts, 105 HARV. L. REV. of the U.S. District Court for the District of South 427 (1991); Richard L. Marcus, The Discovery Con- Carolina, requesting the district judges to adopt a fidentiality Controversy, 1991 U. ILL. L. REV. 457, court rule to preclude confidential settlements; Scott 459; Arthur R. Miller, Private Lives or Public Ac- Bundgaard, member of the Arizona State Senate, Pe- cess? A.B.A. J., August 1991, at 65; Arthur R. tition under Rule 28 of Rules of the Arizona Supreme Miller, Memorandum to the New York State Office of Court, filed January 30, 2002. Court Administration on Proposed Rule 216.1 Re- 3. See, e.g., Federal Judicial Center, Report on garding the Sealing of Court Records at 3-7 (Decem- Protective Order Practice (1996). How Courts Deny Protection for Confidential Information Page 13

Despite the lack of real substance to the tive order controversy—or, at least, courts claims, over the last decade it has become are giving them very little attention. Yet increasingly difficult to protect confidential the privacy and property rights implicated information produced in discovery in civil in information in today’s world have as- litigation. Many courts no longer allow sumed transcendent importance to society, parties to a lawsuit to stipulate to a protec- just as the protective order debate has tive order providing blanket protection raged most fiercely.7 The rapid growth of against public disclosure for information electronic communications has placed per- that implicates privacy or property rights. sonal privacy high on the endangered spe- Instead, they insist on a document-by- cies list. The development and protection document review of the thousands— of intellectual property related to electronic indeed, tens of thousands—of pages often commerce, as well as more traditional produced in complex litigation, regardless forms of commercial activity involving of whether that information will ever be trade secrets, are among the paramount found sufficiently relevant to use in actual concerns of most businesses.8 A company’s court proceedings.4 proprietary interest in its intellectual prop- Courts also are increasingly refusing to erty may often be that company’s most allow litigants to settle legal claims condi- valuable asset. tioned on a promise that the settlement will At a time when the need for confidenti- be kept confidential.5 Even a non-substan- ality is greater than ever before for both tive order of dismissal that follows the par- private individuals and the business com- ties’ agreement to settle a dispute becomes munity, the courts are less likely to provide a triggering device that courts use to justify assurances that information produced in disclosure of information produced in the litigation will be kept confidential and pro- embryonic stages of litigation.6 Recent de- tected.9 This paradox, wherein courts re- cisions from the U.S. Court of Appeals for fuse to protect what now requires the high- the Seventh Circuit place litigants in an un- est levels of protection, is the result of a tenable catch-22 position. A settlement will systematic campaign by the organized remain confidential only if is never ap- plaintiffs bar and the communications me- proved by the court. However, if it is never dia over the last 15 to 20 years. approved by the court, the parties lack the These two groups have somehow con- ability to seek enforcement of the agree- vinced many courts, both state and federal, ment if one fails to comply. into believing that there is a problem that needs to be fixed. They have made some FORGETTING THE LITIGANTS courts believe that courts can and should It seems as if courts have forgotten that be champions of the public welfare through litigants have rights at stake in the protec- the active dissemination of confidential in-

4. See, e.g., Chicago Tribune Co. v. Bridgestone/ when sealed, are public acts subject to public disclo- Firestone Inc., 263 F.3d 1304, 1314-15 (11th Cir. sure). 2001). 7. See Pamela Samuelson, Information as Prop- 5. See, e.g., Jessup v. Luther, 277 F.3d 926 (7th erty: Do Ruckleshaus and Carpenter Signal a Cir. 2002); In re Adams v. City of Lebanon, avail- Changing Direction in Intellectual Property Law? able at http://caselaw.lp.findlaw.com/data2/tennessee 38 CATH. U. L. REV. 365, 367 (1989) (discussing statecases/appeals/2002_1/adamsjohn.pdf, rehearing whether information age requires change in how law denied, 2002 Tenn.App. Lexis 123 (court lacks juris- treats information). diction to issue protective oeder when there is no 8. See Gregory Gelfand, Taking Informational action before it). Property Through Discovery, 66 WASH. U. L.Q. 703 6. See, e.g., Herrnreiter v. Chicago Housing Au- (1988) thority, 281 F.3d 634 (7th Cir. 2002) (motion to file 9. Jessup, 277 F.3d at 929 (recognizing impor- documents under seal denied; appellate papers tance of confidentiality to trade secrets, personal pri- placed in public record) (ruling below, 2001 vacy and confidential settlements nothwithstanding U.S.Dist. Lexis 11071 (N.D. Ill.); Jessup, 277 F.3d at order upholding disclosure of confidential settlement 929 (court’s approval of dismissal of action and in specific case). placing settlement agreement in court files, even Page 14 DEFENSE COUNSEL JOURNAL—January 2003 formation, although the information was corporate conduct, environmental incident exchanged between private parties to re- or government action is potentially harmful solve private, civil legal disputes. They or wrong. Regulatory agencies, local gov- have convinced courts to believe and act as ernments and the media are far better if this role somehow trumps the courts’ ob- suited to providing information to the pub- ligation to serve as a neutral arbiter of legal lic. disputes. Courts have reacted to horror sto- In a number of cases, the initial media ries in the media about “court secrecy” and claims and lawsuits have had no scientific have give greater credence to public opin- basis. Good products and businesses have ion based on bald allegations than to docu- been unfairly taken off the market or mented claims of privilege and confidenti- driven out of business.11 That was the fate ality. of the Audi 5000 automobile and the Dow Fortunately for society, the claims of the Corning breast implants. Both products plaintiffs bar and the media have been in- were needlessly withdrawn from the mar- vestigated by judicial officers and scholars ket following massive media campaigns and been called “unfounded.”10 Indeed, this and thousands of lawsuits in which protec- emperor has no clothes. But unfortunately tive orders were involved. Scientific evi- for many parties who have been hauled dence eventually vindicated both products, into court against their will and compelled but that came too late. Women had thou- to produce highly confidential information, sands of unnecessary operations to remove courts have acted as if the claims were the implants alleged to be harmful. Dow true. The truth is that there is no problem Corning went into bankruptcy as a result of that needs to be addressed and nothing that the litigation. The market for Audi prod- warrants changes in legislation or court ucts in the United States was devastated for rules. years, and Audi and Audi owners suffered irreparable financial loss.12 NOT A ROLE FOR COURTS In the recent controversy over Firestone tires, a New York Times article exposed the No matter how strongly they believe to fact that the plaintiffs’ lawyers themselves the contrary, courts rarely, if ever, are had concealed information about accidents meaningful resources for warning the pub- involving the tires from the appropriate lic about imminent public health risks, ac- regulatory agency in order to have better tive environmental hazards or other pend- control of the litigation and garner higher ing threats to the public welfare. By the settlement awards.13 Contrary to the claims time a dispute gets into a court, any threat that Bridgestone/Firestone hid vital infor- to the public has been or could have been mation from the public, the 11th Circuit made known to the public through a vari- found that Firestone actually had produced ety of other means. Usually there is imme- trade secrets in the litigation which war- diate media coverage of even the most na- ranted a confidentiality order.14 scent suggestion that a consumer product,

10. See Federal Judicial Center report, supra note birth defects, yet Bendectin removed from market 3. See also Letter dated March 23, 1998, from Paul because of liability costs); Walter Olson, No Secrets, V. Niemeyer, Judge of the U.S. Court of Appeals for REASON, February 1991, at 25. the Fourth Circuit and then chair of the Judicial Con- 12. See Peter Huber, Manufacturing the Audi ference Advisory Committee on Civil Rules, to the Scare, WALL ST. J., December 18, 1989, at A18 (no Representative Henry J. Hyde, chair of the U.S. truth to claim that Audi 5000 was subject to sudden House Judiciary Committee; Miller, 105 HARV. L. acceleration). REV., supra note 1. 13. Keith Bratsher, S.U.V. Tire Defects Were 11. See Ealy v. Richardson-Merrell Inc., 897 F.2d Known in ’96 But Not Reported, N.Y. TIMES, June 1159 (D.C. Cir.), cert. denied, 498 U.S. 950 (1990) 24, 2001, at A1. (no scientific basis for claim that Bendectin caused 14. 263 F.3d at 1314-15. How Courts Deny Protection for Confidential Information Page 15

CAMPAIGN IN THE STATES in state legislatures over protective orders and confidentiality quieted down. The pro- When the protective order controversy ponents of restrictions on protective orders began in the early 1990s, more than half of and confidential settlement agreements the states considered legislation or court turned to Congress and federal rule makers rules to restrict the use of protective orders to make their claims, but ultimately they and confidentiality agreements. In 1991, 28 were unsuccessful.18 states considered but did not enact restric- Undeterred, the proponents of restrictive legislation of this type.15 The same tions on protective orders and confidential- year, four states considered rules changes, ity agreements returned to the states. In the but only two—New York and Delaware— 2001-02 legislative sessions, no less than put them into effect. Two states—Florida 22 bills were introduced to limit the use of and Texas—in 1990 enacted changes that confidentiality in civil litigation. Legisla- appeared likely to place heavy restrictions tion was considered in Arizona (S.B. on the availability of protective orders, par- 1453), California (S.B. 11 and A.B. 36), ticularly in product liability litigation.16 Connecticut (S.B. 625), Hawaii (H.B. Section 69.081(4) of the Florida statute 1350), Illinois (H.B. 75, 156, 3146 and states: 4277), Massachusetts (S.B. 862), Missouri (4) Any portion of an agreement or contract (S.B. 686 and 1021), New York (A.B. which has the purpose or effect of conceal- 7513 and 1066), North Carolina (S.B. ing a public hazard, any information con- 1071), Oklahoma (S.B. 1555), Rhode Is- cerning a public hazard, or any information land (H.B. 5617 and 6613, S.B. 194 and which may be useful to members of the pub- 2707) and Tennessee (H.B. 1216 and S.B. lic in protecting themselves from injury 1175). Although bills in a number of states which may result from the public hazard, is void, contrary to public policy, and may not had significant momentum toward passage be enforced. at various times, none had been enacted by October 2002. Texas Rule of Civil Procedure 76a states In general, the proposed legislation and that “court records . . . are presumed to be court rules are aimed at increasing public open to the general public,” and it defines access in discovery and settlement, and al- “court records” as, among other things, most every one was modeled after the “discovery, not filed of record, concerning Florida statute or the Texas court rule. The matters that have a probable adverse effect drafters anchor their proposals in the upon the general public health and safety.” states’ inherent police powers to regulate In practice, however, the Texas restric- public health, safety and welfare, thereby tions have not had the effect their support- attempting to justify the public access re- ers intended. Courts have interpreted the quirement as a necessary exercise of state changes in ways that preserve judicial dis- police power.19 But the 1991 California cretion to protect confidential informa- proposals also included personal injury and tion.17 wrongful death actions. From the early 1990s to 2000, the frenzy

15. Alabama, Alaska, Arkansas, California, Colo- public health and safety, thereby triggering restric- rado, Connecticut, Hawaii, I11inois, Iowa, Kansas, tion on protective orders); Eli Lilly K& Co. v. Biffle, Louisiana, Maine, Massachusetts, Minnesota, Mis- 868 S.W.2d 806 (Tex.App.—Dallas 1991) (issuing sissippi, Montana, Nevada, New Hampshire, New mandamus to direct trial court to interpret new rule Jersey, New Mexico, New York, Oregon, Pennsylva- to protect trade secrets). nia, Rhode Island, South Dakota, Virginia, Washing- 18. See Niemeyer letter, supra note 10; Arthur R. ton and Wisconsin. Miller, Protective Order Practice: No Need to 16. FLA. STAT. ANN. § 69.081 and TEX. R. CIV. Amend F.R.C.P. 26(c), PROD. LIAB. REP. (CCH), P. ANN. r. 76a. April 21, 1995 at 438-39. 17. See, e.g., Ford Motor Co. v. Benson, 846 19. See generally RICHARD A. EPSTEIN, TAKINGS S.W.2d 487 (Tex.App.—Houston 1993) (interpreting 107-45 (1985) (discussing the origins and nature of rule to require plaintiff to prove documents affect inherent police powers of state). Page 16 DEFENSE COUNSEL JOURNAL—January 2003

Following the Florida and Texas stan- court or used at trial would be immaterial.20 dards, courts could not issue protective or- This is contrary to legal tradition, which ders or seal court records if doing so would has always recognized the admission of have the purpose or effect of “concealing a evidence at trial as the “touchstone” of the public hazard or information concerning a public’s right to access.21 public hazard,” to quote the Alaska bill, or Most of the proposed legislation also if doing so “concerns matters that have a would allow members of the media and the probable adverse effect upon the general general public to intervene in litigation for public health or safety,” the Illinois formu- the sole purpose of obtaining access to lation. In recent years, some legislatures, confidential information that was produced particularly California, have expanded the subject to a protective order, confidential- definition to also include disclosure of in- ity agreement or court sealing. Both the formation concerning “environmental haz- California and Illinois introductions accord ards” and “financial fraud.” standing to “any person.” Several of the 1991 introductions—for Recent actions in South Carolina and instance, Alaska, Arkansas, Kansas, Mon- Arizona are much more problematic. In tana and South Dakota—defined “public August 2002, the federal district judges of hazard” as “an instrumentality, including the District of South Carolina, at the behest but not limited to any device, instrument, of Chief Judge Joseph F. Anderson Jr., an- person, procedure, product, or a condition nounced the adoption of a new provision to of a device, instrument, person, procedure, Local Rule 5.03 stating, “No settlement or product, that has caused and is likely to agreement filed with the court shall be cause injury.” This definition is remarkably sealed pursuant to the terms of this rule.” broad and could easily encompass much But the court also stated that it would re- more than some potential injury to public ceive comments until September 30, 2002, health and safety. Accessibility would be after which it would announce any “neces- required without regard for whether the in- sary” modification. A large volume of formation was contained in records filed comments was received from South Caro- with the court, kept in the private offices of lina, as well as out-of-state lawyers and na- the litigants themselves, or in the hands of tional organizations. Unmoved by the com- third parties. ments, on November 6, 2002, the court Whether the information was gleaned announced adoption and implementation of through discovery or document production the new amended rule.22 Not to be left be- and ultimately would not be filed with the hind, Chief Justice Jean Toal of the South

20. See In re Reporters Comm. for Freedom of sioned the passing around of documentary exhibits the Press, 773 F.2d 1325, 1338 (D.C. Cir. 1985), in from the jury to the audience, or the manual copying which then Judge Scalia analyzed the historical prac- of all of them.” 773 F.2d at 1334-35 n. 7. tice of courts regarding public access to court 21. Reporters Comm., 773 F.2d at 1338. records, relying heavily on decisions from the Su- 22. The notice of adoption of rule and the rule are preme Court of Michigan, Schmedding v. May, 48 available on the court’s website—www.scd.uscourts. N.W. 201 (Mich. 1891), and the Massachusetts Su- gov/rules/aug2001/cv/ch5.pdf, and the comments preme Judicial Court, Cowley v. Pulsifer, 137 Mass. are available at www.scd.uscourts.gov/Notices/ 392 (1884). In Cowley, the court said, “[I]t is clear COMLR503.pdf. The announcement of adoption of that [these grounds] have no application whatever to the amendment to Rule 5.03 is available at the contents of a preliminary written statement of a www.scd.uscourts.gov/Notices/LR503.pdf. See also claim or charge. These do not constitute proceedings Adam Liptak, In South Carolina, Judges Seek to Ban in open court. Knowledge of them throws no light Secret Settlements, N.Y. TIMES, September 2, 2002, upon the administration of justice. Both form and at A1. The New York Times was quick not only to contents depend wholly on the will of a private indi- endorse the South Carolina initiative but also to vidual, who may not even be an officer of the court.” speak favorably of barring parties and attorneys from 137 Mass. at 394. According to Judge Scalia, in or- participating in “secret settlements.” See Editorial, der to accept a public right of access to prejudgment Ending Legal Secrecy, N.Y. TIMES, September 5, records, “one would have to accept that the court, 2002, at A22. writing in the days before photostatic copying, envi- How Courts Deny Protection for Confidential Information Page 17

Carolina stated that she favored barring lic and the media, have no First Amend- “secret settlements” in South Carolina state ment right to obtain access to information courts.23 produced in civil discovery.26 The standard In January 2002, Scott Bundgaard, a applied in much of the proposed legislation member of the Arizona State Senate, peti- and rules reverses the presumption recog- tioned that state’s supreme court to con- nized under Seattle Times that the public sider adopting a court rule that would re- has no right of access to material produced strict the use of protective orders.24 in discovery. Instead, it gives the public a Proposed legislation in California would greater right to the information than the do away with the traditional “good cause” litigants who own and produce the infor- standard for obtaining a protective order. mation. Instead, it would require the court to bal- These legislative and rule-making activi- ance the interest of the public in having ties are highly troubling and unnecessary. access to the confidential information Courts already have the inherent authority against the need for confidentiality. Only if to control their own records, which in- the litigant’s confidentiality claim passes cludes the discretion to keep information the highest level of judicial scrutiny—that confidential or to make it public.27 Just as is, it demonstrates a compelling interest in important, the courts already are some of confidentiality that overcomes the public’s the most open governmental institutions in interest in access—will a protective order the United States.28 By common law tradi- issue. tion, civil and criminal trials, and the Yet it still is black-letter law under the records filed with the court and used at trial U.S. Supreme Court’s decision in Seattle or in judicial proceedings, are open to the Times Co. v. Rhinehart,25 that there is no public almost without exception.29 The right of public access to information pro- only areas that have been protected and duced in civil discovery. The exact lan- that should remain subject to protection are guage of the Court used is, “A litigant has areas at the periphery—information pro- no First Amendment right of access to induced in discovery and included in confi- formation made available only for pur- dential settlements. There is no tradition of poses of trying his suit.” This holding public access to prejudgment, or discovery means that non-parties, including the pub- records in civil cases.30

23. Rick Brundrett, Toal Backs Publicizing Law- 289 F.3d 1117, vacating and remanding 126 suit Settlements, THE STATE [Columbia, South Caro- F.Supp.2d 1328 (D. Wash. 2001) (no common right lina], August 7, 2002, at A5; Rick Brundrett, Toal: of access to documents filed under seal; First Secret Deals Often Break Rules, THE STATE [Colum- Amendment not sufficiently raised). bia, South Carolina], August 23, 2002, at B3. 27. Nixon v. Warner Communications Inc., 435 24. Supreme Court No. R-02-0002, Petition un- U.S. 589, 598 (1978). der Rule 28 of Rules of the Arizona Supreme Court, 28. Arthur R. Miller, Private Lives or Public Ac- filed January 30, 2002. Comments were due by Au- cess? A.B.A.J., August 1991, at 65; Schmedding, 48 gust 1, 2002, but no action had been taken by De- N.W. at 202. cember 1, 2002. See www.supreme.state.az.us/rules/ 29. The United States has a common law tradi- prrulciv.htm tion of holding public trials. See Richmond Newspa- 25. 467 U.S. 20 (1984), aff’g 654 P.2d 673 pers Inc. v. Virginia, 448 U.S. 555 (1980); Brown & (Wash. 1982). Williamson Tobacco Corp. v. Fed. Trade Comm’n, 26. In re Alexander Grant & Co. Litig., 820 F.2d 710 F.2d 1165, 1177-79 (6th Cir. 1983), cert. denied, 352, 355 (11th Cir. 1987), aff’g 629 F.Supp. 593 465 U.S. 1100 (1984); Marcus, Confidentiality Con- (S.D. Fla. 1986); Reporters Comm., 773 F.2d at troversy, supra note 1, at 459. 1339. See also Cippollone v. Liggett Group Inc., 785 30. Reporters Comm., 773 F.2d at 1334-39. F.2d 1108, 1119 (3rd Cir. 1986) (no First Amend- Nonetheless, at one time some federal circuit courts ment analysis required to determine whether protec- held to the contrary. See Seattle Times, 467 U.S. at tive order can bar public dissemination of discovery 25; In re Halkin, 598 F.2d 176 (D.C. Cir. 1979) (pro- information); Worrell Newspapers of Indiana Inc. v. tective order can act as prior restraint on litigant’s Westhafer, 739 F.2d 1219 (7th Cir. 1984), rev’g 570 First Amendment right to free speech); In re San F.Supp. 1447 (S.D. Ind. 1983) (no First Amendment Juan Star Co., 662 F.2d 108 (1st Cir. 1981) (protec- analysis required); Phillips v. Gen. Motors Corp., tive order is not prior restraint but does implicate 2002 U.S.App. Lexis 21489 (9th Cir.), amending First Amendment interests). But see Int’l Products Page 18 DEFENSE COUNSEL JOURNAL—January 2003

THE DISCOVERY PROCESS When litigants fear that confidential information will not be protected, they will not Discovery is a relatively new invention, be forthcoming in producing it. Discovery unknown prior to the adoption of the Fed- disputes will proliferate, making it neces- eral Rules of Civil Procedure in 1938. The sary for already overburdened courts to invasive nature of litigation today results mediate the pretrial process at a time when largely from the modern discovery process, it was designed to be self-executing. which requires the production of information, even if it will be inadmissible in the CONSTITUTIONAL DUTY TO underlying action, as long as it is likely to PROTECT LITIGANT RIGHTS lead to the production of admissible information. In its present incarnation, Rule In all the emotional rhetoric about the 26(a) requires initial disclosures of certain public’s right to know, “secret settlements” information without a discovery request. and “court secrecy,” the proponents of re- As recently as 1970, parties were required strictions on protective orders and confi- to show good cause before a court would dential settlements seem to ignore the fact compel discovery. In a complete reversal, that litigants also have rights. Often these the rules now require production unless a rights reside in the information that must party can show good cause not to pro- be produced under highly invasive modern duce.31 discovery rules in order to resolve the un- Surely, the founding fathers of the derlying legal dispute. Consequently, ef- United States, who believed strongly in forts to increase public access to informa- public trials, never imagined that prelimi- tion related to litigation are in significant nary, private information produced solely tension with the litigants’ need to protect to facilitate resolution of the lawsuit would confidential information from disclosure. be universally available to any and all tak- Only confidentiality protects the rights ers, particularly when it did not have the bound up in the information, rights which benefit of being found relevant to the un- may be of constitutional stature. derlying issues.32 It follows that when dis- Although this tension always has existed covery information results in a confidential to some extent, its dynamics have under- settlement, the information retains its con- gone a profound metamorphosis in the last fidential nature unless used in court pro- few decades as technological advances ceedings or introduced into court files.33 have moved society into the information The discovery process and civil litiga- age, where information itself is often an tion as contemplated under the Federal end product. Because of this transforma- Rules and the rules of most states envision tion, ensuring strong legal protection for the free flowing exchange of information information is of much greater importance in discovery between litigants in order to today than ever before. promote the early resolution of the dispute.

Corp. v. Koons, 325 F.2d 403 2d Cir. 1963) (no First covery?, 74 JUDICATURE 178 (1991); Frank H. Amendment restriction on dissemination of informa- Easterbrook, Discovery as Abuse, 69 B.U. L. REV. tion produced in litigation). See also Richard L. 635, 645 (1989); Maurice Rosenberg & Warren R. Marcus, Myth and Reality in Protective Order Liti- King, Curbing Discovery Abuse in Civil Litigation: gation, 69 CORNELL L. REV. 1 (1983) (discussing Enough Is Enough, 1981 BYU L. REV. 579; Wayne lower court cases prior to Seattle Times). Any D. Brazil, The Adversary Character of Civil Discov- doubts about public access rights to civil iscovery, ery: A Critique and Proposals for Change, 31 and whether they are grounded in the U.S. Constitu- VAND. L. REV. 1295 (1978). tion, were put to rest by Seattle Times. 32. See Reporters Comm., 773 F.2d at 1334-39 31. William W. Schwarzer, The Federal Rules, (discussing historical treatment of prejudgment the Adversary Process and Discovery Reform, 50 U. records in civil proceedings). PITT. L. REV. 703 (1989). In recent years, leading 33. See Luther, 277 F.3d at 928 (recognizing that scholars and jurists have recognized the abuse and even entire trial record may be sealed and citing sup- excess bred by the current rules. See, e.g., William porting cases recognizing continued validity of con- W. Schwarzer, Slaying the Monsters of Cost and De- fidentiality in litigation). lay: Would Disclosure Be More Effective than Dis- How Courts Deny Protection for Confidential Information Page 19

A. Property Rights in Information licensing the use of, or selling, exclusive information. Unlike tangible or real prop- Information is intangible property, and erty, which can be disposed of only once, the U.S. Supreme Court has recognized ex- the same information can be sold over and plicitly that information, such as trade over again without diminishing its original secrets and confidential business informa- value, as evidenced by the market for com- tion, is a form of property.34 To the found- puter programs or legal research services. ing fathers, who were steeped in Lockean If others can obtain the same information theory, securing private property against without paying for it, the potential value theft and government confiscation or mis- that can be derived from licensing or sell- appropriation was one of the most funda- ing the original information is substan- mental responsibilities of government. The tially, if not entirely, diminished. Fifth Amendment to the Constitution, When a court orders a litigant to produce which guarantees a number of rights, con- proprietary information in litigation and to tains the “takings clause,” which states that disclose that information to an opponent, “nor shall private property be taken for the court’s interference with the rights to public use, without just compensation.” exclusive possession and use of that infor- Protecting private property was, therefore, mation is immediately apparent. This inter- one of the driving forces behind the initial ference can be tolerated when the court ex- break between the colonies and Great Brit- ercises its authority under existing law to ain, and it retains its vitality today.35 prevent further disclosure outside of the An owner of private property is said to lawsuit, either through the issuance of a possess a “bundle of rights” in the prop- protective order or by sealing the informa- erty. One stick in this bundle is the right to tion in court files. exclusive possession of the property.36 The The degree of interference would in- right to exclusive possession is often of crease exponentially, however, perhaps to transcendent importance when the property the point of destroying the underlying at issue is information. Unlike tangible or property right, if the information disclosed real property, informational property can in a limited manner to the court and the be possessed simultaneously by more than opponent is further disclosed to the general one person. Thus, the basic value of infor- public, as would be required under the pro- mational property often is dependent on its posed legislation and court rules. Conse- exclusive possession or on confidentiality. quently, placing restrictions on or eliminat- If everyone knew the formula for Coca- ing the court’s authority to protect the Cola, for example, the Coca-Cola Co. confidentiality of proprietary information would have no special advantage over any produced in litigation places property other soft drink manufacturer. rights in information at serious risk of loss. Other sticks within the bundle of property rights include the right to control the B. Right to Privacy in Information use and ultimate disposition of property. Again, these rights are of paramount im- Another right of constitutional signifi- portance when the property is information, cance often embodied in information is the because the owner can derive value from right to privacy.37 Although the right to pri-

34. Carpenter v. United States, 484 U.S. 19, 25- (futures exchange’s price information protected by 26 (1987), aff’g 791 F.2d 1024 (2d Cir. 1986) law). See also Samuelson, Information as Property, (newspaper’s prepublication material is property); supra note 7. Ruckelshaus v. Monsanto Co, 467 U.S. 986, 1003-04 35. EPSTEIN, supra note 20, at 16-17. (1984), vacating and remanding 564 F. Supp. 552 36. See generally id., at 58-62. (E.D. Mo. 1983) (trade secrets are property); Dirks 37. See generally Samuel D. Warren & Louis D. v. Sec. Exch. Comm’n, 463 U.S. 646, 653 n.10 Brandeis, The Right to Privacy, 4 HARV. L. REV. (1983) (confidential business information is prop- 193 (1890); Gary R. Clouse, Note, The Constitu- erty); Bd. of Trade of Chicago v. Christie Grain & tional Right to Withhold Private Information, 77 Stock Co., 198 U.S. 236, 250-51 (1905), aff’g 130 F. NW. U. L. REV. 536 (1982) 507 (7th Cir. 1904), rev’g 125 F. 161 (8th Cir. 1903) Page 20 DEFENSE COUNSEL JOURNAL—January 2003 vacy is most often thought of as it relates but that also triggers other detrimental con- to individual autonomy over certain per- sequences. One can easily imagine how sonal decisions, the Supreme Court has this damage could occur, especially in light recognized a second branch of privacy that of some telling examples already dis- may guarantee the right to avoid govern- cussed, such as the Audi 5000 and breast ment disclosure to the public of certain pri- implants, in which premature publication vate or personal information. of confidential can inflict serious injury. The Court has recognized several types of information that an individual or corpo- BALANCING PUBLIC INTEREST ration may have an interest in preventing AND PRIVATE RIGHTS the government from disclosing, including: Although the public may have some in- personal information collected while in terest in obtaining access to information public office,38 identification of an indi- produced in litigation, litigants themselves vidual as a user of prescription narcotics,39 have important rights that are protected un- erroneous description of an individual as a drunkard,40 erroneous description of a com- der the Constitution—rights that may be pany as “lacking integrity,” 41 description of lost if information subject to a protective an individual as suicidal,42 and information order to settlement agreement is disclosed. about a prior arrest or criminal record.43 Both the public’s interest in access and liti- The concern in most of these cases is not gants’ interest in privacy cannot be satis- so much the risk that the information dis- fied; they are mutually exclusive. Allowing closed will be erroneous or otherwise public access to information whose value likely to stigmatize the individual or orga- depends on its confidentiality destroys the nization to whom it pertains, although property or privacy right in the informa- those are issues in these cases, but rather tion. Denying public access to confidential that disclosure will cause the individual proprietary information protects the prop- some further detriment or loss beyond the erty or privacy right but disregards the erroneous stigmatization or loss of reputa- public’s interest. Resolution of this conflict tion. requires a choice between the two compet- Again, it is immediately apparent that if ing interests. legislatures or rule makers restrict the au- Logic and fundamental fairness dictate a thority of courts to protect information in presumptive choice in favor of the litigant. which there may be a privacy right or inter- Before a lawsuit is filed, the public has no est, that action may result in the unwar- right of access to confidential information ranted public disclosure of information that kept by a private individual or organiza- not only injures the reputation of the indi- tion. Nothing dictates that the mere filing vidual to whom the information pertains, of a lawsuit changes this fact and creates a right of public access to the information that did not previously exist. On the other hand, the future litigants have a plethora of 38. Nixon v. Adm’r Gen. Servs. Admin., 433 legal rights and interests, including their U.S. 425, 431 (1877), aff’g 408 F.Supp. 321 (D. rights in confidential information. D.C. 1976). 39. Whalen v. Roe, 429 U.S. 589, 605-07 (1977), When a lawsuit is filed, a specific subset rev’g 463 F.Supp. 931 (S.D. N.Y. 1975). of the litigants’ rights or interests is placed 40. Wisconsin v. Constantineau, 400 U.S. 433, 435 (1971), aff’g 302 F.Supp. 861 (E.D. Wis. 1969). in question—that is, the legal issue to be 41. Old Dominion Dairy Products v. Sec’y of De- decided in the lawsuit. The litigants’ re- fense, 631 F.2d 953, 963 (D.C. Cir. 1980). maining rights and interests that are not at 42. Codd v. Velger, 429 U.S. 624 (1977). 43. U.S. Dep’t of Justice v. Reporters Comm. for issue in the lawsuit, including the rights Freedom of the Press, 489 U.S. 749 (1989), rev’g they have in confidential information, 816 F.2d 730 and 831 F.2d 1124 (D.C. Cir. 1981); should remain just the same during and af- Utz v. Cullinane, 520 F.2d 467, 476 (D.C. Cir. 1975); Tarlton v. Saxbe, 507 F.2d 1116, 1124 n.23 ter the lawsuit as they were prior to the (D.C. Cir. 1974). lawsuit. How Courts Deny Protection for Confidential Information Page 21

For example, a plaintiff may be required court system because vindication of one le- to produce intensely private medical gal right might result in the loss of other, records in order to resolve a personal in- perhaps more important, rights. Litigants jury action. The information is needed as a have a compelling argument that their in- tool to resolve the underlying issues of li- terests in confidentiality should override ability and the plaintiff’s right to recover the public’s interest in access, particularly compensation. The information itself and when those rights rise to the level of prop- the plaintiff’s right to keep it confidential, erty or privacy rights protected under the however, are not the underlying legal is- Constitution. The serendipitous or perhaps sues. Although requiring production of this even the malicious filing of a lawsuit are information is fair in order to resolve the not legitimate grounds for allowing the in- lawsuit, going one step further and allow- vasion of the litigants’ property and pri- ing public access to the medical records, vacy rights. thereby destroying the privacy right in them, is not fair. MEDIA HYPE, PLAINTIFFS BAR The same holds true for a defendant re- FRENZY ARE JUST THAT quired to produce design information in or- None of the media hype or the frantic der to vindicate itself in a product liability pleas from the organized plaintiffs’ bar can case. Any property right the defendant had change the reality of the law or the facts. in the information before the litigation The law protects confidential information should not be destroyed because of public produced in litigation but not used in judi- disclosure through the litigation. cial proceedings. Nothing has been pro- The law should and does authorize posed or exposed that warrants a change in courts to ensure a sort of legal homeostasis this fundamental tradition of American ju- for rights and legal interests that are un- risprudence. Courts that act or find to the avoidably brought into court along with the contrary are at risk of being like the em- actual legal issues that are central to re- peror duped by the outrageous claims of solving the dispute. Without this protec- the clever tailors—they may be emperors tion, citizens would be reluctant to use the with no clothes. The Privacy Project The Brave New World Is Here: Privacy Issues and the Human Genome Project

Governments and courts must step in to provide protections and regulations for the use of individuals’ genetic testing results

By Robert A. Curley Jr. and IADC member Robert A. Curley Jr. is By Lisa M. Caperna president of Curley & Curley, P.C., of Boston, where he concentrates his prac- CIENTIFIC discoveries and advances tice in the defense of product liability and in biological understanding during the catastrophic personal injuries. He is a S graduate of Harvard College (A.B. 1971) 20th century paved the path for the Human and Cornell University Law School (J.D. Genome Project. 1976). “We used to think our fate was in our Lisa M. Caperna is an associate at stars. Now we know, in large measure, our Curley & Curley. She was educated at fate is in our genes,” said James Watson, Boston College (B.A. 1997, J.D. 2000). who co-discovered the double-helix structure of DNA with Francis Crick in 1953.1 As for Crick’s thoughts, he stated, “You, your joys and your sorrows, your memo- Chase performed the definitive experiment ries and your ambitions, your sense of per- that showed that DNA was, in fact, the ge- sonal identity and free will, are in fact no netic material. more than the genetically determined be- Once more was known about DNA, the havior of a vast assembly of nerve cells next step was to figure out the molecule’s and their associated molecules.” 2 structure. The race was on. At Cambridge DNA was discovered in the mid 1800s. University, there were Watson and Crick. In 1868, a Swiss biologist, Friedrich At the same time, at King’s College in Miescher, identified DNA in the nuclei of London, Maurice Wilkins and Rosalind pus cells obtained from discarded surgical Franklin also were studying DNA. In 1953, bandages. But it was during the 20th cen- building from the King’s team’s research, tury that there were great advances in bio- Watson and Crick presented a model of the logical understanding of DNA. structure of DNA. In 1962, Watson, Crick In 1943, American Oswald Avery and Wilkins shared the Noble Prize for proved that DNA carries genetic informa- physiology and medicine. Franklin had tion. He even suggested that DNA might died by 1962, and the Nobel Prize rules do actually be the gene. Most people at that not allow an award to be made posthu- time thought the gene would be protein, mously, and interestingly nor do they allow not nuclei acid, but by the late 1940s, DNA more than three scientists to share the generally was accepted as the genetic mol- award. ecule. In 1952, Alfred Hershey and Martha Franklin actually was the one who discovered and first stated that the sugar- phosphate backbone of DNA lies on the 1. James Watson, quoted in Leon Jaroff, The outside of the molecule. She arrived at this Great Hunt, TIME, March 20, 1989, at 62, 67. discovery after examining the DNA mol- 2. FRANCIS CRICK, THE ASTONISHING HYPOTH- ESIS: THE SCIENTIFIC SEARCH FOR THE SOUL 3 ecule under an x-ray beam, a technique (1994). called x-ray crystallography. It would be Privacy Issues and the Human Genome Project Page 23 interesting to know which three of the four project at the National Institutes of Health, scientists would have received the Nobel has said, “It’s hard to overstate the impor- Prize had Franklin not died before the tance of reading our own instruction book, award was given. and that’s what the Human Genome Although genetics dates back to the mid Project is all about.”3 1800s, the last decade has proved to offer The United States also is home to the the milestones in genetic history, what with prominent private endeavor to map the technology advances and revolutionary sci- human genome being done by Celera entific endeavors like the Human Genome Genomics, a company in Rockville, Mary- Project. DNA’s discovery has been called land, headed by J. Craig Venter. the most important biological work of the last hundred years, and the research that it B. Basic Science has sparked will lead to monumental developments in the next hundred. For a better understanding of the work being done by the HGP, it may be useful to HUMAN GENOME PROJECT review Biology 101. Every human cell (except for red blood cells and the platelets A. What Is It? that are critical to normal blood clotting The Human Genome Project (HGP) is and wound healing) contains a nucleus that an international research effort to deter- has within it roughly six feet of a special mine the sequence of the three billion chemical called deoxyribonucleic acid, or chemical base pairs that make up the hu- DNA. DNA consists of a backbone of re- man DNA and to identify the approxi- peating sugar and phosphate units, each of mately 35,000 genes in human DNA. which binds a simple chemical structure While the HGP was conceived as early as called a nucleotide (more commonly, a the mid 1980s by scientists in the U.S. De- “base”). There are four kinds of bases partment of Energy, the initial planning found in DNA, and these are abbreviated: process culminated in 1990. Since then, re- A for adenine, C for cytosine, G for gua- searchers from the United States, the nine, and T for thymine. United Kingdom, Germany, Japan, China There are 46 strands of DNA in each and France have been reconstructing DNA human cell, and they coil into the consequences to produce detailed physical densed double helix shape contained in 23 maps of the human genome. pairs of chromosomes. The 46 molecules The international consortium is sup- of DNA contain an estimated 35,000 ported mostly by the U.S. National Insti- genes. Each nucleus-containing cell in an tutes of Health and the Wellcome Trust, a individual’s body has the same DNA. philanthropic organization based in Lon- There are three billion DNA bases in a cell, don and directed by Dr. Michael Dexter. called the genome. Technically, there are Other governmental agencies and chari- six billion base pairs of DNA; at concep- table institutions in the various countries tion, three billion bases in an unfertilized also fund the project. The driving force be- egg are joined with three billion from the hind the project is the identification and male sperm. Scientists think the two sets eradication of all genetically based dis- differ by about one DNA base in every one eases. thousand, differences that can be explored The U.S. Human Genome Project is a after one set has been sequenced. 13-year effort coordinated by the Depart- Encoded within the structure of the ment of Energy and the National Institutes nucleotide DNA chain is the information of Health. The project originally was necessary for cell structure and function. planned to last 15 years, but effective re- The DNA strand includes coding regions, source and technological advances have called genes. The sequence of nucleotide accelerated the expected completion date sub-units in genes directs cells to produce to 2003. Francis Collins, the director of the proteins, which provide structure to and Page 24 DEFENSE COUNSEL JOURNAL—January 2003 mediate chemical reactions within a cell. disease do not have the disease. Rather, Thus, proteins determine the characteristics they have an increased likelihood that the of cells, which in turn collectively deter- disease will develop. On the other hand, mine the characteristics of the individual. people with pre-symptomatic genetic con- There are an estimated 35,000 genes in the ditions will develop the disease if they live human genome. long enough. An example of such a condi- It is interesting to note that the remain- tion is Huntington’s disease. ing DNA, which may exceed 95 percent of Another aspect of genetic diseases is the the total and is unknown at this time, does gene’s penetrance and expressivity. Pen- not code for proteins and is often referred etrance is the likelihood that a gene will to as “junk” DNA. Further scientific explo- express itself. For example, the BRCA1 ration is necessary to determine the func- gene, which predisposes an individual to tion of this DNA. breast cancer, is about 85 percent pen- Genetic disorders may occur when there etrant, while the Huntington’s gene is 100 is a mutated gene. Sometimes full seg- percent. Expressivity deals with the sever- ments of DNA may be missing, multiplied ity and manner in which the gene manifests or transposed—that is, found on a different itself once it has penetrated. For instance, segment of the chromosome. A classic un- two women with the BRCA1 gene may de- usual example of a mutation-based genetic velop breast cancer at different ages and in disease is sickle-cell anemia, in which pre- varying degrees of severity. It is important cisely one A (the nucleotide, or base, to remember that not everyone who devel- adenine) has been replaced by a T. These ops breast cancer has the BRCA1 gene; mutations may be either inherited or ac- some may have “acquired” this genetic dis- quired. Such mutations may then lead to ease because of mutations that may form genetic disease. spontaneously from environmental factors, Genetic disorders may be classified as such as radiation, or age-related factors. either “multi-factorial” or “single-gene” The BRCA1 gene is responsible for ap- genetic conditions.4 Multi-factorial condi- proximately 5-10 percent of breast cancer, tions may not manifest themselves in the while 90-95 percent of breast cancers are absence of certain behavioral or environ- spontaneous genetic disorders.5 mental factors. These conditions rely on Wondering if you missed a day of Biol- the interaction of numerous genetic and en- ogy 101? Rest assured, whatever you vironmental factors. In the case of single- missed, you will learn as the Human gene diseases, such as cystic fibrosis and Genome Project’s discoveries continue to Huntington’s disease, the carrier received a make headlines. With the project’s grow- gene in which the disease will manifest iting popularity, good or bad, it is likely that self regardless of environmental factors. what may not have been part of the cur- It is important to distinguish between the riculum of the past, will be common terms “predisposed genetic condition” and knowledge in the future. “pre-symptomatic genetic condition.” People who are predisposed to a genetic C. HGP’s Goals The ultimate goals of the Human Ge- nome Project are to identify the approxi- 3. See “Rough Map of Human Genome Project Completed” at www.cnn.com/2000/health/06/26/ mately 35,000 genes in human DNA and to human.genome.03/index.html (visited June 26, map out and sequence the three billion 2002). chemical base pairs that make up human 4. See Christopher M. Keefer, Bridging the Gap 6 Between Life Insurer and Consumer in the Genetic DNA. In other words, to produce the hu- Testing Era: The RF Proposal, 74 IND. L.J. 1375, man blueprint. 1378 (Fall 1999). Mapping is a process that results in 5. Id. 6. See Human Genome Project Information at knowing the location of the gene on a www.ornl.gov/hgmis (visited May 30, 2002). chain of DNA. Sequencing is breaking Privacy Issues and the Human Genome Project Page 25 down the biochemical parts of the DNA D. Progress to Date that composes each gene into its nucle- In June 2000, President Clinton an- otides. The DNA sequence refers to the or- nounced the completion of a “working der of the nucleotides (A, C, G, and T) in draft” of the human genome, a collection the DNA chain. representing more than 90 percent of the The scientific techniques used by the genetic composition of chromosomes. Ap- Human Genome Project to detect altered proximately 75 percent of the sequence is genes result in the mapping of genetic dis- in a highly accurate “finished” state. The eases. Once a section of an individual’s other 25 percent is merely “draft” quality. DNA is mapped, it can be compared to This accomplishment led to the February known sequences created by the project to 12, 2001, declaration of the first readable determine whether the individual has the draft of the “Book of Life.”7 specific gene or genes that causes a genetic While there are still some gaps to be condition or makes the individual more filled, scientists are already forming a good susceptible to a genetic condition. idea of what the genome looks like. First, it The genes that are mapped and se- turns out that human chromosomes have quenced in the project do not come from crowded centers with many genes in close one human being but from cell lines that proximity to one another and vast expanses have been acquired and grown in many of unpopulated areas where only non- laboratories over a long period of time. coding “junk” DNA are found.8 This distri- These blueprints are then compared to bution of genes is very different from the maps of individuals with genetic disorders genomes of the other organisms sequenced in order to track down components of a by the HGP. The other organisms studied genetic disorder. Finding all of the compo- have genes that are relatively evenly nents of a complex genetic disorder re- spaced throughout. quires analyzing entire genomes of hun- Scientists also learned that human be- dreds and, in some cases, thousands of ings have only about twice as many genes individuals. as the worm or fly. Apparently, humans are Although called the Human Genome able to do more with what they have than Project, the project involves sequencing the other species. Instead of producing only DNA of many other organisms, such as the one protein per gene, the average human mouse, rat, worm, fly and yeast. The gene produces three different proteins. theory behind this is that the human ge- Moreover, the HGP has made significant nome should not be studied in a vacuum. progress in discovering the links between Learning how the human genome com- human genes and diseases. For instance, pares to those of other organisms will help scientists have identified the genes for an understanding the human genome’s cystic fibrosis, Tay Sachs disease, sickle makeup and how it has evolved. cell anemia, Duchenne muscular dystro- Additional goals of the U.S. Human Ge- phy, hemophilia A, Alzheimer’s disease, nome Project include storing this informa- Huntington’s disease and various forms of tion in databases, improving tools for data cancer. analysis, transferring related technologies to the private sector, training scientists who will be able to utilize the tools and resources developed to pursue biological studies that will improve human health, 7. See Human Genome Project Information, “The and examining the ethical, legal and social Science Behind the Human Genome Project,” at www.ornl.gov/hgmis/project/info.html (visited Au- implications of human genetics research. In gust 23, 2002). an effort to achieve some of these goals, 8. See National Genome Research Institute, “In- the project has licensed technologies to pri- ternational Human Genome Sequencing Consortium Publishes Sequence an Analysis of the Human Ge- vate companies and awarded grants for in- nome,” at www.nhgri.nih.gov/news/initial_sequence novative research. PR.html (visited May 1, 2002) Page 26 DEFENSE COUNSEL JOURNAL—January 2003

E. Likely Future Developments In the near future, there likely will be improvements to the draft sequence, along While scientists have identified a signifi- with the identification of single-gene and a cant number of genes and have linked few multi-gene diseases. In the meanwhile, many of them to known single-gene dis- continuous findings of the Human Genome eases, there are thousands of genes yet to Project will affect aspects of clinical medi- be understood, or even identified for that cine far beyond what is currently thought matter. It may take years or even decades of as genetic disease. As technology for to identify genes that do not have the typi- molecular testing improves and turnaround cal sequence characteristics of a gene. time for test results decreases, current com- Moreover, although geneticists have pin- mon diagnostic tests will be supplanted by pointed the genetic mutations behind some nucleic acid-based analyses. Gene therapy, single-gene diseases, there are still multi- through which the errant gene is replaced gene diseases that will be far more compli- with a normal gene, may become a com- cated to identify. Because each errant gene mon and practical way to treat genetic dis- makes only a small contribution to such eases. diseases, it has no obvious pattern of inher- As for the next group of genomes to be itance and its presence is hard to find sequenced, the National Human Genome among the natural variations in DNA se- Research Institute has announced its quence. “dream team.” The organisms designated It also is important to keep in mind that as high priority for sequencing include the draft of the “Book of Life” may have chickens, chimpanzee, several species of some inaccuracies. In fact, a private com- fungi, sea urchins and honey bees.10 pany in Iceland, called Decode Genetics, already has found some mistakes. Decode was founded by Dr. Kari Stefansson, a EXPECTATIONS OF PRIVACY former Harvard neuropathologist, who A. What is Privacy? chose Iceland because of its small population (278,000) and careful genealogic Dictionary definitions of “private” and record keeping, which allows disease genes “privacy” include “belonging to oneself,” to be traced back more than 10 generations. “intended for or restricted to the use of a Through its detailed knowledge of Icelan- particular person or group,” “not freely dic genomes, Decode has uncovered and available to the public” and “freedom from has been able to correct many errors in the unauthorized oversight or observation.” In human genome sequence produced by the the context of human genetic material, HGP. For example, Decode discovered that these definitions involve fundamental con- in more than 100 cases, large sections of cepts of ownership (“belonging”) and, the consortium’s human genome are in the more important, authorized use. wrong order or flipped head-to-tail, and the wrong order degrades the statistical power B. Traditional Property Concepts of gene-hunting methods.9 Generally speaking, a person has property rights in his or her body, although 9. See Nicolas Wade, Hunting for Disease there has been some legal reluctance in Genes in Iceland’s Genealogies [www.nytimes.com/ terming the human body as property. The 2002/06/18/health/genetics/18prof.html] and A Genomic Treasure Hunt May Be Striking Gold Uniform Anatomical Gift Act, which has [www.nytimes. com/2002/06/18/science/18deco. been widely adopted in the United States, html], both June 18, 2002. authorizes competent adults to make gifts 10. See National Genome Research Institute, “NHGRI Prioritizes Next Organisms to Sequence,” of all or any part of their body to take ef- at www.nhgri.nih.gov/NEWS/news.html (visited fect on death.11 The act limits donees to May 30, 2002) medical or dental care providers and 11. The text of the act, together with the prefatory note and comments, are available at www.law. schools, banks or storage facilities for upenn.edu/bll/ulc/fnact99/uaga87.pdf. medical or dental education, research, ad- Privacy Issues and the Human Genome Project Page 27 vancement of medical or dental science, for a population statistics database, identi- therapy or transplantation or any specified fication research and protocol develop- individual for medical therapy or trans- ment, or for quality control, but only if per- plantation. It authorizes gifts by living do- sonally identifiable information was nors for transplantation where the donor removed. Violation of the privacy provi- and two physicians who examined the do- sions was made a crime punishable by a nor and who are involved in the transporta- fine of up to $100,000. tion sign an affidavit. In 2000, a specific privacy protection A person’s heirs have certain property section was added (42 U.S.C. § 14135(e)), rights in the deceased person’s body and and the Federal Bureau of Investigation organs. As one court observed, in a case and states accessing the index were re- involving unauthorized cornea removal, quired to expunge the DNA records of per- “property is often conceptualized as a sons whose criminal convictions were ‘bundle of rights’ . . . which . . . include the overturned (42 U.S.C. § 14135(d)). right to possess, to use, to exclude, to profit, and to dispose.”12 C. Abandoned Property Blood may be donated, but that act and Human beings constantly shed samples the blood’s use is subject to substantial of their DNA into the environment—hair, governmental regulation.13 saliva, blood. Does an individual have a Persons unquestionably have property property right with respect to DNA no rights in their own DNA, but those rights longer directly attached to their person? In may be subject to greater societal and gov- the context of DNA found at crime scenes, ernmental interests. The Supreme Court of the answer clearly is no. Indiana has ruled that a rape suspect “had a In a case involving impressions of coun- legitimate expectation of privacy in his terfeit bills in sealed trash bags left on a body and blood samples” when they were sidewalk, the First Circuit held that the de- taken in a rape prosecution for which he fendant had no expectation of privacy as to was acquitted on the basis of a consent de- the content of the bags,16 but there is con- fense. In a later prosecution for another trary authority.17 Absent legislation, the rape, the court held that once his DNA, American rule is that title to abandoned which was collected pursuant to statute, property rests in the finder.18 became part of the DNA bank, “the profile In the brave new world of DNA technol- becomes the property of the crime lab.” ogy, where it is probable that samples of The defendant had no expectation of pri- DNA can be extracted from any trash bag vacy in the sample in the database, the left on the sidewalk—for example, saliva court ruled, and that there had been no vio- on an envelope—the law may need to ad- lation of the Fourth Amendment.14 dress previously unthought-of privacy con- In 1993, the United States enacted legis- cerns. In criminal cases, the interest of the lation (42 U.S.C. § 14132 et seq.) mandat- government probably will trump any arguing the creation of an index of DNA identification records of persons convicted of crimes and analyses of DNA from crime 12. Whaley v. County of Tuscola, 58 F.3d 1111, scenes, unidentified human remains and 1114 (6th Cir. 1995), cert. denied, 516 U.S. 975 (by later amendment) missing persons. The (1995). 15 13. See, e.g., MASS. GEN. LAWS ch. 111, states followed suit. §§ 184(B); 105 MASS. REGS. CODE § 135.001 et seq The original federal legislation ad- 14. Smith v. Indiana, 744 N.E.2d 437 (Ind. 2001). dressed privacy rights by limiting disclo- 15. See, e.g., MASS. GEN. LAWS ch. 22E, § 1 et seq. sure of stored DNA information to criminal 16. United States v. Mustone, 469 F.2d 970 (1st justice agencies, to courts in judicial pro- Cir. 1972). ceedings where DNA evidence is admis- 17. California v. Krivda, 486 P.2d 1262 (Cal. 1971), vacated and remanded, 409 U.S. 33 (1972). sible, and to criminal defendants for de- 18. Massachusetts v. Maritime Underwater Sur- fense purposes. Disclosure also was limited veyors Inc., 531 N.E.2d 549 (1988). Page 28 DEFENSE COUNSEL JOURNAL—January 2003 able privacy expectations. But in situations cause and a search warrant or exigent cir- involving the collection, analysis or use of cumstances justifying the lack of a war- abandoned DNA by non-governmental per- rant.19 Compulsory provision of blood for sons or entities in non-criminal and com- the purpose of blood typing and DNA mercial situations, a different balance may analysis in the course of a criminal pros- be in order. ecution may be authorized, subject to constitutional limitations.20 D. Traditional Tort Concepts All U.S. states have enacted legislation providing for databases of DNA from cer- Section 652A of the Restatement (Sec- 21 ond) of Torts recognizes an invasion of a tain convicted criminals. The use of reasonable force to collect DNA samples is right to privacy by an unreasonable intru- 22 sion on the seclusion of another, by the ap- authorized under these laws. These stat- propriation of another’s name or likeness, utes have been held constitutional in view by unreasonable publicity given to the of the low expectation of privacy of con- other’s private life, or publicity that unrea- victed criminals, the governmental need for sonably places the other in a false light. a reliable system of identification of convicted criminals and the minimal intrusion The commentary indicates that an invasion 23 of privacy is actionable where it would be involved in a pin-prick. As with the fed- highly offensive to a reasonable person. eral DNA database in the United States, According to Section 652H of the Restate- privacy rights have been addressed by restricting the authorized use of the database ment, damages recoverable for an invasion 24 of privacy include damages for the harm to and creating criminal penalties. the interest in privacy, mental distress and Legislation has authorized courts to or- special damages. In this era, most people der genetic marker testing in paternity ac- would probably find any unauthorized lo- tions. Privacy issues are addressed by clos- cation, extraction and use of their DNA to ing trials to the public and segregating be highly offensive. records. An adverse inference may be drawn from a refusal of any party to submit In the absence of any statutory frame- 25 work for civil actions arising from the lo- to a genetic marker test. cation, extraction and use of DNA, tort law will be the arena in which the parameters 2. Consensual DNA Testing for of privacy rights in DNA will develop. Research Biotechnology and companies with E. Authorized Extraction and Use “gen” in their names are hot. Academic ku- of Genetic Data dos will be heaped on those who continue 1. Non-consensual DNA Testing to unlock the secrets of the human genome. Research requires the acquisition of ge- In the context of criminal prosecution, netic material, especially where groups of the taking of a blood sample may be non- individuals with a specific characteristic consensual, provided there is probable are the subject of study. Consent may take many forms, as it is essentially a private agreement. With respect to university-sponsored or private 19. Schmerber v. California, 384 U.S. 757, 767 research, consent may be subject to com- (1966). pliance with university or company guide- 20. United States v. Goodridge, 945 F.Supp. 371 (D. Mass. 1996). lines on research. 21. See Laudry v. Attorney General, 709 N.E.2d Consensual donation of genetic matter 1085, 1087 (Mass. 1999). for the purposes of research either for the 22. E.g., MASS. GEN. LAWS ch. 22E, § 4. 23. Laudry, 709 N.E.2d 1085. acquisition of pure knowledge or commer- 24. E.g., MASS. GEN. LAWS ch. 22E §§ 9-14. cial application raises numerous issues. 25. E.g., MASS. GEN. LAWS ch. 209C, §§ 11, 12- From the viewpoint of personal privacy, 13, 17. Privacy Issues and the Human Genome Project Page 29 it would be desirable for genetic samples 3. Present Protection used in research to be identified in a way It is a “brave new world,” a world in that does not involve the name of the do- which an individual’s strand of hair or nor—for instance, by an alphanumeric des- speck of dandruff can be tested for the ignation—and which would prevent the re- presence of a myriad of genetic conditions search team from immediate knowledge of and diseases. As advances in technology the identity of the person whose genetic make it easier to access and understand the material is the subject of research. While it mysteries of the human genetic code, the is conceptually possible to devise a manner potential of abuse of such information be- of purely anonymous donation of genetic comes a real threat. Putting aside the fear material, such a system is probably less de- of human cloning and designing the “per- sirable from a number of viewpoints than fect” child, there is a growing concern that one in which the material can be traced to a dissemination of an individual’s genetic in- specific donor. From the viewpoint of re- formation will result in discrimination by search, it may be desirable to obtain addi- employers and insurers. The primary con- tional follow-up data from the donor. From cerns are that insurers will use genetic in- the viewpoint of the donor, it may be desir- formation to deny, limit or cancel insur- able to know the results of the genetic test- ance policies and that employers will use ing. Existing systems for the protection of the information against their workers or to the privacy of medical test data could prob- screen potential employees. The main ably serve as the model for privacy protec- question is: Do current laws protect people tion in this area. from this abuse? The answer: Maybe. In obtaining consent for the testing of genetic material, it probably is prudent to a. Federal Law address one of the thorniest ethical issues in this area: Should the donor be informed At the federal level in the United States, of the results if they disclose the possibil- the only legislation enacted to date that di- ity, probability or certainty that the donor rectly prohibits genetic discrimination is will develop certain medical conditions— the Health Insurance Portability and Ac- for example, Huntington’s disease—or has countability Act of 1996, known as HIPAA a genetic trait that may have an arguably (Pub. L. No.104-191). HIPAA states that adverse effect on offspring? In some cases, genetic information shall not be considered these disclosures could have an adverse ef- a pre-existing condition in the absence of a fect on the donor’s life long before the ac- diagnosis of the actual condition. The pro- tual development of a medical condition. tection afforded by the HIPAA is limited, At the time of consenting to genetic test- however, as it does not prohibit rate in- ing, the donor probably should be increases as a consequence of genetic test re- formed, within reason, of the possible results, it does not cover individuals who are sults of genetic testing, and the donor’s not in a group plan, and it does not protect informed choices should be honored. against discrimination by employers. Consent for research involving donated There are several federal statutes that genetic material probably should address, may offer some protection against genetic at least generically, the use of the research discrimination in the workplace. For in- and any connected commercial application. stance, Title VII of the Civil Rights Act of Donors should know that they are surren- 1964 (42 U.S.C. § 2000e et seq.) may pro- dering any property right in their genetic tect individuals to a limited extent. Under material, subject to privacy protections, Title VII, employers are prohibited from and that they have no right to prevent or discriminating on the basis of sex, race, na- control the appropriate publication of the tional origin, religion or color. Since a few research results or the commercial applica- genetic diseases are tied strongly to sex, tion of the knowledge derived from the re- race or ethnicity, an employer that dis- search. criminates against an employee based on Page 30 DEFENSE COUNSEL JOURNAL—January 2003 such genetic diseases may violate Title netic information is covered under the third VII. For example, in Norman-Bloodsaw v. prong of the ADA’s definitions of “disabil- Lawrence Berkeley Laboratory,26 the plain- ity.” 27 A recent U.S. Supreme Court case, tiffs, without their consent, were subjected however, suggests otherwise. to pre-employment screening that included In Bradgon v. Abbott,28 the Court held sickle-cell testing for African Americans. that a person with asymptomatic HIV is a The plaintiffs prevailed. However, most covered individual with a disability under genetic conditions are not predominately the ADA. The Court found a physical im- linked to a certain sex, race or ethnicity. pairment based on cellular and molecular For broader protection, one might be changes that take place in the body as a tempted to turn to Title I of the Americans result of the infection. Although similar with Disabilities Act of 1990 (ADA), en- reasoning might support the argument that forced by the Equal Employment Opportu- the ADA covers individuals with asymp- nity Commission (EEOC) for protection tomatic genetic predisposition under the against genetic discrimination in the work- first prong of the ADA’s definitions, Chief place, and similar disability-based anti- Justice Rehnquist’s dissenting opinion sug- discrimination laws, such as the Rehabilita- gests that the justices might be reluctant to tion Act of 1973. 42 U.S.C. § 12101 et define individuals with genetic alterations seq.; 29 U.S.C. § 701(b)(1)-(2). While as disabled within the meaning of the these laws do not explicitly address genetic ADA. The justices reasoned that the pos- information, they provide some protections sible effect of finding such individuals dis- against disability-related genetic discrimi- abled would be that all individuals with ge- nation in the workplace. The ADA, how- netic alterations would be considered ever, applies only to employers with 15 or disabled and, consequently, protected un- more employees. der the ADA. Given that, according to sci- Under the ADA, a person with a disabil- entists, every person has genetic alterations ity is defined as one who either (1) has a of some form, it does make sense to draw physical or mental impairment that sub- the line somewhere. stantially limits a major life activity, (2) While the ADA does not specifically has a record of such impairment or (3) is address genetic testing, it discusses medi- regarded as having such an impairment. cal examinations and inquiries. It divides The ADA would seem to cover people who medical examination and inquiries into have a manifested genetically related ill- three stages: pre-employment, pre-place- ness or disability that impairs a major life ment and post-placement. At the pre- activity, as well as those who have a record employment stage, the employer is proof a genetically related disability. But does hibited from asking prospective employees it prohibit discrimination based on a diag- if they are disabled and cannot conduct a nosed asymptomatic genetic condition that medical examination. The employer, how- does not substantially limit a major life ac- ever, can make offers of employment con- tivity? In 1995, the EEOC adopted the tingent on the successful completion of a view that discrimination on the basis of ge- pre-placement medical examination. At the pre-placement stage, the employer is allowed to administer a medical examination as long as all entering employees are tested 26. 135 F.3d 1260, 1264 (9th Cir. 1998). 27. Human Genome News, “Analyzing Genetic and the information is kept confidential, Discrimination in the Workplace,” remarks of EEOC with only a few exceptions. Similarly, the Commissioner Paul Miller at the EINSHAC Interna- employer may require the release of all of tional Working Conversation on Enviro/Genetic Dis- putes and Issues, July 2001, available at www.ornl. the individual’s medical records. Post- gov/hgmis/publicat/hgn/v12n1/09workplace.html placement, an employer can require em- (visited May 9, 2002). ployees to undergo a medical examination 28. 524 U.S. 624, 657-62 (1998), vacating and remanding 107 F.3d 934 (1st Cir. 1997). Decision if the examination is job-related and con- below, 912 F.Supp. 580 (D. Me. 1995). sistent with business necessity. Privacy Issues and the Human Genome Project Page 31

It is important to note that there are no adequate protection against it. Even where limits placed on pre-placement tests, and genetic discrimination may reasonably fall an individual who undergoes the tests has under the purview of the ADA, courts may no right to be told what tests are being con- find that it does not. Legislation introduced ducted, the test results, or how the informa- in the U.S. Congress last session by Sena- tion generated by the tests will be used in tors Thomas Daschle and Edward Kennedy determining employability. Moreover, if would prohibit discrimination by private the employer decides to withdraw a condi- sector employers on the basis of genetic tional offer of employment, the individual information and provide strong privacy has no right to be told why, not even that protections to any genetic information used the withdrawal was based on the test re- for medical treatment and research. sults. Although the ADA prohibits the The Daschle-Kennedy bill was based on withdrawal of a conditional offer for medi- a presidential executive order of February cal reasons, unless they are job-related, in- 8, 2000, which prohibits federal employers dividuals usually will not know the reason from considering genetic information in unless they pursue a legal action against hiring, promoting, discharging and all the employer. other employment decisions.30 Under the The permissible scope of an employee’s executive order, obtaining or disclosing ge- medical examination raises significant con- netic information about employees or po- cerns about genetic privacy. Individuals tential employees is prohibited, except may be reluctant to undergo genetic test- where it is necessary to provide medical ing, even if they are at risk for some ge- treatment to employees, ensure workplace netic condition or disease, because they health and safety or provide occupational fear that their employer, on whom they and health researchers access to data. Un- may depend for health insurance, will ac- der these exceptions, genetic monitoring is cess their medical records. Individuals may allowed. Genetic monitoring determines to also be worried that any time they have a what degree a person has been exposed to blood test, their employer could perform or harmed by toxins in the work environ- genetic testing without obtaining consent ment. As an executive order and not legis- or informing the employee. lation, it applies only to former and present In the near future, an employee’s genetic employees and applicants for employment privacy may be in jeopardy even if the em- by the federal government. ployee does not have an exam. Imagine With respect to protecting against the what once was possible only in science unlawful dissemination of genetic informa- fiction thrillers. Unscrupulous Manager tion, Congress’ best effort thus far is the sneaks into Associate’s office after hours recently enacted HIPPA National Stan- to confiscate Associate’s coffee mug. The dards to Protect Patients’ Personal Medical next morning, Manager sends mug to Records. This new regulation protects company’s lab to have Associate’s remnant medical records and other personal health saliva genetically tested. That afternoon, information maintained by health care pro- Manager fires Associate because he’s pre- viders, hospitals, health plans and health disposed to lung cancer and he’s on the insurers, and health care clearinghouses. company health insurance plan. The new standards limit the non-consen- If you think this is too easy, think again. sual use and release of private health infor- By 2010, scientists predict that the modest mation; give patients new rights to access sum of $100 will buy a test that effectively identifies genetic markers for a myriad of 29 conditions and diseases. 29. Human Genome News, supra note 27. Perhaps genetic discrimination is too 30. Exec. Order No. 13,145 (February 8, 2000), 3 different from traditional disability dis- C.F.R. 13,145. See Human Genome Project Informa- tion, “Genetics Privacy and Legislation,” available at crimination for the ADA or other disabil- http://www.ornl.gov/hgmis/elsi/legislat.html (visited ity-based anti-discrimination statutes to be May 1, 2002) Page 32 DEFENSE COUNSEL JOURNAL—January 2003 their medical records and to know who else matter that is consistent with the require- has accessed them; restrict most disclosure ments of federal law, including but not lim- of health information to the minimum ited to the ADA.” 34 needed for the intended purpose; establish While it is reassuring to see so many new criminal and civil sanctions for im- states explicitly addressing genetic dis- proper use or disclosure; and establish new crimination, the legislation has generated requirements for access to records by re- many questions. For examples: What is searchers and others.31 Note, however, that meant by a genetic test? Is genetic infor- these standards are not specific to genetics. mation distinct from or merely one form of medical information? Should a tissue b. State Law sample and data derived from it be the property of the person from which it was Currently, about half the states have leg- taken? islation prohibiting genetic discrimination Definitions of a genetic test vary widely. in the workplace. State legislatures began Some states define it as “a test of an enacting such laws in the 1970s as a re- individual’s DNA, RNA, or chromosomes sponse to discrimination against individu- . . . associated with a predisposition for a als carrying the sickle cell trait. Since that clinically recognized disease or disorder.” time, most states have updated their laws to Because this type of definition does not in- varying degrees. clude the testing of proteins, it excludes Some states have broad bans on dis- some newborn screening, prenatal tests for crimination while others specify particular neural tube defects, along with many tests types of discrimination that are prohibited. currently used to make diagnoses. Other Rhode Island, New Hampshire, Texas and states are more inclusive in that they define Oklahoma are among the states that genetic testing as analysis of a chromo- broadly prohibit discrimination based on some, a gene, DNA, RNA, or protein en- genetic information and provide no excep- coded by a gene. tions.32 In contrast, other states, including Whether genetic information is so differ- Delaware, Maine, Michigan, Arizona and ent from other clinical data that it deserves Massachusetts, allow employers to con- special protection is another issue that must sider and in some cases collect genetic in- be addressed when legislation is drafted. formation, if it can be proved to be job Considering that genetic tests may predict related and consistent with business activ- future risks for a healthy individual and ity.33 Then there are states like Illinois with may imply risks about that individual’s legislation stating that “an employer shall relatives, such data seems to warrant more treat genetic testing information in such a

31. For a fuller discussion of the HIPPA regula- a bona fide occupational qualification. tions, see Nancy A. Lawson, Jennifer M. Orr & MICH. COMP. LAWS § 37.1202 prohibits an em- Doedy Sheehan Klar, The HIPAA Privacy Rule: An ployer from refusing to hire, recruit, or promote an Overview, in this issue of Defense Counsel Journal, individual based on genetic information unrelated to page —. the individual’s ability to perform the duties of the 32. R.I. GEN. LAWS § 28-6.7-1; N.H. REV. STAT. job; from requiring an individual to submit to a ge- ANN. § 141-H:3; TEX. LAB. CODE ANN. § 21.402; netic test or to provide genetic information; and from OKLA. STAT. tit. 36, § 3614.2. acquiring or accessing genetic information concern- 33. DEL. CODE ANN. tit. 19, § 711 prohibits an ing an employee, an applicant for employment or a employer from discriminating against an individual member of the employee’s or applicant’s family. based on genetic information and from intentionally ARIZ. REV. STAT. § 41-1463 prohibits an em- collecting any genetic information concerning an ployer from discriminating against an individual employee or an applicant for employment, or any based on genetic information, but allows an em- member of their family, unless it can be demon- ployer to give and act on the results of any profes- strated that the information is job related and consis- sionally developed ability test. tent with business necessity or the information is MASS. GEN. LAWS ch. 151B, § 4 prohibits dis- sought in connection with the a benefit plan. crimination because of genetic information unless ME. REV. STAT. ANN. tit. 5, § 19302 prohibits an based on a bona fide occupational qualification). employer from discriminating against an individual 34. 410 ILL. COMP. STAT. 513/25 (2001). based on genetic information, except when based on Privacy Issues and the Human Genome Project Page 33 protection than other medical information. obvious, especially in an increasingly mo- On the other hand, separating genetic in- bile society. One can foresee that inexpen- formation from other medical information sive genetic testing is on the horizon. Is it may not be easy. worth $200 to screen a potential employee As genetic testing becomes part and par- for genetic information indicating potential cel of common medical care, it will be dif- health or performance issues? Is it worth ficult to enact draft legislation that requires $200 to acquire genetic information about separate treatment of portions of patients’ a political opponent in an election and leak medical records. One solution may be lan- it to the press? Will tabloids have a field guage that covers the access to and use of day revealing genetic information about all medical information. Arizona is on the celebrities? right track with a statute that provides It probably is an impossible task to pre- broad protection to genetic privacy based vent material from which genetic informa- on confidentiality rather than specifying tion can be extracted from coming into the situations in which genetic discrimination hands of a person determined to obtain it. is prohibited.35 However, the extraction of genetic infor- Whether tissue samples and the genetic mation is a task that can be performed only data derived from them should remain the by persons or entities with highly special- property of the individual tested also is ized knowledge and equipment. In terms of an issue that has stirred debate. In 1996, protecting the privacy and appropriate use Oregon enacted legislation specifically of genetic information, it makes sense to providing that an individual’s genetic in- regulate those who extract the information. formation is the property of the indi- Minimal concepts of regulation should vidual.36 In 1996, the New Jersey legisla- include the licensing of each facility for the tion passed a similar bill, but it was vetoed extraction of genetic material to assure by then-Governor Whitman because of competency and compliance with regula- protests from the pharmaceutical industry. tions and safeguards for the storage, use Researchers seem to want a clear right to and dissemination of information regarding use samples. A later version of the bill, genetic material. The safeguards should in- which the governor did sign, excluded the clude coding and restriction of identifying property provision but required that genetic information and restrictions on the dis- testing be preceded by written informed semination of information at least as strin- consent.37 gent as currently exist for medical records. In 2002, a third New Jersey bill, provid- Congress should determine whether state ing that an individual’s genetic information regulation should be pre-empted by federal is the property of the individual, passed.38 regulation. In other areas, federal regula- This most recent enactment also amended tion has provided a minimum set of stan- the 1996 legislation by applying the dards but has not pre-empted state regula- former’s provisions concerning notification tion beyond the federal minimum. For of genetic test results to the person who example, states were free to adopt more performs the test—that is, a clinical labora- stringent primary protections for informa- tory—rather than a person who requires or tion related to HIV than minimal protec- requests that genetic testing be done—that tions provided by federal regulations. is, an insurance carrier. On a global level, the extraction, dissemination and use of genetic information NASCENT GENETIC ISSUES create issues for the United Nations and the world’s governments. The United States A. Regulation While the states serve as legislative laboratories in the United States, the need 35. ARIZ. REV. STAT. § 12-2802 (2001). 36. OR. REV. STAT. § 659.715 (1996). for a comprehensive set of federal regula- 37. P.L. 1996, ch. 126, Genetic Privacy Act. tions concerning genetic information seems 38. 2002 Bill Text, N.J. A.B. 1379. Page 34 DEFENSE COUNSEL JOURNAL—January 2003 will need to involve itself in an interna- “yes” or “no” depending on one’s perspec- tional dialogue to reach balances between tive. the privacy interests of individuals with the interests of a variety of societies in secu- 2. Health Insurance rity, health care management, or conceiv- There are two major issues relating to ably genetic engineering of multiple forms. health insurance and the privacy of genetic information. One is the denial or limitation B. Employment of access to health insurance based on ge- While discrimination in employment netic test information. The second is the based on genetic information already is the potential beneficial use of broad-based ge- subject of federal and state legislation and netic test information in order to direct regulations, exceptions relating to the as- medical research and to allocate scarce re- surance of workplace health and safety or sources in the most efficient way. There is job performance requirements are exceed- a tension between the issues. ingly broad and trigger disputes requiring HIPAA provides limited protection legal resolution. Employers and society against discrimination in access to health clearly have an interest in assuming that insurance for group plans. Large numbers airline pilots, train engineers and drivers of of persons who are not eligible for group tractor-trailers can perform their jobs plans have no such protection, however, safely. Employees have substantial privacy and, as in the life insurance situation, soci- interests in not having genetic information etal values should determine whether ge- not legitimately related to job performance netic test results should exclude anyone revealed to an employer or potential em- from access to health insurance. The health ployer, especially if it is to reside in a per- insurance debate is beyond complex, and sonnel file for a considerable period of the introduction of genetic tests as a time. screening device for access to health insur- Regulation may be useful in determin- ance benefits or for access at an increased ing, on the basis of valid, scientific criteria, cost will only increase the complexity. what genetic tests are reasonably related to The accumulation of knowledge of the specific job performance and providing genetic characteristics of the population at that only genetic information related to a large holds the potential for providing specific performance requirement be re- knowledge that could direct research hav- leased to the employer. Regulation would ing the promise to reduce or eliminate also be useful in determining which em- certain medical conditions or alert the ployers can store, disseminate (if at all) or medical profession to earlier intervention use the results of genetic tests. in the treatment of certain conditions. This knowledge may serve to reduce health care C. Insurance costs. But sufficient data for use in making such determinations may involve, at least 1. Life Insurance in a limited sense, some surrender of ge- Life insurance companies profit by netic privacy. If government involvement handicapping the likelihood of a person’s in health insurance and medical research, death. They now make discriminating deci- which is already extensive, increases, then sions on whom to insure or not insure and the contribution of blood for genetic testing for how much on the basis of personal and may become the entry fee for access to private medical information. Genetic test- health insurance. ing will provide an additional tool for A bank of genetic data for an extensive them. Should some individuals be excluded portion of the population might be a dream from or priced-out of the opportunity to or a nightmare, depending on how it is obtain life insurance by the accident of used. If such a bank comes into existence, their birth? The answer to this question is then stringent limitations on the use of the Privacy Issues and the Human Genome Project Page 35 data for research and the direction of re- nies involved in genetic research, govern- search should be created in order to safe- mental entities or others may, through con- guard the privacy of the individual donors. sent for research, medical testing or other lawful means, become repositories of sub- D. Litigation stantial amounts of information about the genetic background of individuals. May the Courts will need to address questions re- holders of this information use it to target lated to privacy rights and genetic informa- individuals for unsolicited commercial tion in a host of contexts. The Federal Judi- contacts concerning medical treatments or cial Center has published materials on information about drugs? DNA testing in the context of criminal tri- The Supreme Judicial Court of Massa- als,39 but issues involving genetic testing in chusetts, in a case involving a marketing civil litigation will multiply. campaign by a pharmacy chain to use its prescription data to target customers who 1. Requests for Genetic Testing of had not requested the marketing material, Litigants held that a triable issue under the Massa- Rule 35 of the Federal Rules of Civil chusetts Privacy Act was presented and up- Procedure and similar rules in the states held the class certification of the plain- permit a party to seek a physical examina- tiffs.40 tion of an opposing litigant in appropriate The use of genetic information acquired cases. Requests for examinations may be in the course of medical testing or research accompanied by requests for certain diag- presents similar issues. nostic tests, and these might include genetic testing. In serious personal injury 4. Invasion of Privacy cases, where life care plans may project In situations where there has been an un- long-term care costs into the tens of mil- lawful extraction of genetic data or unau- lions of dollars, genetic testing may reveal thorized use, dissemination or publication information directly relevant to life expect- of genetic data about an individual, there ancy issues. will probably be sufficient basis for an in- In civil cases involving physical or vasion of privacy lawsuit based on the sexual assault, genetic testing may directly principles enunciated in the Restatement relate to identity issues or to corroboration (Second) of Torts.41 of the alleged tort. CONCLUSION 2. Protective Orders Rapid technological advances and scien- Where genetic testing potentially can re- tific discoveries will continue to challenge veal substantial private information about the ability of governmental and judicial in- an individual, any request for genetic test- stitutions to balance the benefit of in- ing is likely to be met with a request for a creased knowledge with traditionally val- protective order. Protective orders should ued concepts of personal privacy and address limitations on any genetic testing freedom. to relevant issues in a pending lawsuit, the confidentiality of the results of such testing, limitations on the disclosure of the results and their use in legal proceedings, and 39. David H. Kaye & George F. Sensabaugh Jr., Reference Guide on DNA Evidence in REFERENCE the return of records of the results after the MANUAL ON SCIENTIFIC EVIDENCE 485 (Federal Ju- close of litigation. dicial Center, 2d ed. 2000). This chapter also contains a useful glossary of terms. 40. Weld v. Glaxo Wellcome Inc., 746 N.E.2d 3. Limitations on Use of Lawfully 522 (Mass. 2001). Obtained Data 41. See J. Makdisi, Genetic Privacy: New Intru- sion a New Tort? 34 CREIGHTON L. REV. 965 It is foreseeable that universities, compa- (2001). The Privacy Project Discovery Unplugged: Should Internal E-mails Be Privileged Confidential Communications?

The concept of appropriate discovery should keep pace with modern communications technology and protect intra-company e-mail

By Ralph Streza IADC member Ralph Streza is a member of Porter Wright Morris & Arthur OST PEOPLE are more comfortable L.L.P. in the firm’s Cleveland office. He is Mwith old problems than new solu- a graduate of Miami University (B.A. tions. That notwithstanding, this article 1978) and Cleveland Marshall College of Law (J.D. 1982). argues for the creation of a new communications privilege based on privacy and business policy: An organization’s internal sional journal article database covering 900 e-mail communications related to advanc- leading legal and business journals was ing the goals of the organization should not similarly unavailing. No effort was evident be discoverable in litigation, provided the in pending or abandoned federal legisla- organization takes the steps necessary to tion. preserve the privacy of these communica- The evolution of computer technology in tions. the corporate world and in society has con- tributed to the mindset that e-mail should DISCOVERING E-MAIL be discoverable. The decisions sustaining the discoverability of e-mail, however, oc- Generally speaking, corporations, law- curred before the practical effects of allow- yers who represent corporations, lawyers ing that discovery were foreseen, or possi- who assert claims against corporations and bly even appreciated. The time may be ripe judges who manage discovery issues to rethink the propriety of invading these related to litigation involving corporations communications. have not questioned the propriety of Responding to a discovery request for allowing discovery of a company’s e-mail a corporation’s internal e-mail sounds database. It seems natural and logical for simple until the task begins. A corporation the litigation professionals to accept the served with a request to produce these discoverability of a preserved record of an electronic communications will soon learn individual’s thoughts, or a group of indi- that compliance can be time consuming viduals’ exchanged thoughts, within a cor- and very expensive. For instance, President poration and related to the advancement of Clinton’s chief of staff, John Podesta, in corporate goals. October 2000 estimated that the cost of the A search of the Lexis national case law effort to reconstruct, retrieve and analyze database for federal and state decisions lost e-mail related to the Monica Lewinsky from January 1990 to the summer of 2002 scandal would exceed $11 million. The uncovered no decision in which a court court ordered the defendant to pay the not considered creating a privilege for internal “undue” estimated cost in excess of $1 mil- corporate e-mail. A search of the profes- lion to retrieve electronic data in civil litigation discovery.1 1. See 1 Digital Discovery & e-Evidence at 16 (December 2000). See also Linnen v. A.H. Robins In addition to collecting and analyzing e- Co., 1999 WL 462015 (Mass.Super.). mail, the production can generate extensive Self-Critical Analysis Privilege in the Product Liability Context Page 37 spin-off discovery in an effort to leave no have centered on the privacy interests of stone unturned. An internal information the individual—particularly as people surf technology staff can be tied up for days or the Internet or send their encrypted mes- even weeks, according to some treatises. If sage into cyberspace expecting it to land in the IT staff is insufficient, the corporation another Internet user’s mailbox. But little must outsource the collection and analysis.2 attention has been devoted to an organi- The e-mail may pull otherwise unknowl- zation’s privacy as it relates to an intra- edgeable witnesses into the litigation. They company e-mail network. may add little, if anything, to the merits of Legal privilege is regulated by Rule 501 the claims or defenses, yet they are cor- of the Federal Rules of Evidence, which ralled, interrogated and distracted from provides in pertinent part that the “privi- otherwise productive duties. Instead of un- lege of a witness, person, government, covering truly relevant facts, e-mail pro- state, or political subdivision thereof shall ductions prolong and sidetrack the search be governed by the principles of the com- for truth, and sometimes it may even demon law as they may be interpreted by the velop untruth. Some written communica- courts of the United States in the light of tions found in e-mail just aren’t accurate. reason and experience.”4 This rule has not However, apart from these litigation- been amended since its adoption in 1972. related costs, which many people argue are When originally submitted to Congress, simply a cost of doing business, one must Article V of the proposed Federal Rules of ask whether the true social intent, benefit Evidence, of which Rule 501 is a part, and purpose of e-mail within companies, listed 13 specific rules. Nine defined spe- are advanced or suppressed by its use in cific non-constitutional privileges, one ex- civil litigation. pressly excluded all privileges not enumerated in Article V, and three addressed BASIS OF LEGAL PRIVILEGE waiver issues. Ultimately, Rule 501 was adopted with the view, according to the Concepts of legal privilege are grounded Advisory Committee Notes, that not only in private, confidential relationships. Com- were existing privileges to be applied, but munications made in confidence in these that privileges would continue to develop, relationship are not protected from disclo- in light of reason and experience, and that sure merely because of the confidentiality “the recognition of a privilege based on a of the communication, but because of a confidential relationship and other privi- strong public policy or a public concern leges should be determined on a case-by- that underlies the communication.3 Privi- case basis.” leges not to testify create narrow excep- It seems settled that an organization has tions to the principle that the truth should a reasonable expectation of privacy in its be ascertained by all rational means. closed e-mail system implemented to ex- Scores of articles discuss the new pri- clude third parties to allow its employees vacy concerns that have arisen with the ad- to communicate.5 It also is undisputed that vent of electronic communications. Most

2. Digital Discovery & e-Evidence, supra note 1, 4. Many states have adopted the “reason and ex- at 4. perience” guideline of Rule 501. Twenty-six states 3. 81 AM. JUR. 2D Witnesses § 286 (1992) states: have adopted this rationale, a rule patterned after Ar- “It must appear that the element of confidentiality is ticle V or similar provisions. 23 CHARLES ALAN essential to the full and satisfactory maintenance of WRIGHT & KENNETH W. GRAHAM, JR., FEDERAL the relation between the parties, the relation must be PRACTICE AND PROCEDURE: EVIDENCE § 5421 (2d one which in the opinion of the community ought to ed. 1982 & Supp. 2002). be sedulously fostered, and the injury that would in- 5. See Dow Chem. Co. v. United States, 476 U.S. ure to the relation by the disclosure of the communi- 227, 236 (1986), aff’g 749 F.2d 307 (6th Cir. 1984) cation must be greater than the benefit thereby (well settled that business that undertakes extensive gained for the correct disposal of litigation.” effort to protect interior of its business from un- Page 38 DEFENSE COUNSEL JOURNAL—January 2003 the closed e-mail network belongs to the E-mail users often communicate in an corporation and not to the employees who informal and casual manner, not taking the use it.6 At least one court has determined care usually invested when writing a for- that the expectation of privacy related to mal business document. Users often be- e-mail is linked to the type of e-mail in- lieve that once a message is communicated volved and the intended recipient. By and deleted, it disappears forever, much negative inference from that decision, the like a telephone call when the communica- users of a closed network have a much tion has ended. As a result, a discovering greater privacy right in a closed network.7 party may find a variety of candid statements made about company strategies and APPLICATION TO E-MAIL secrets that would never have been presented on paper.9 Accepting the premise that communica- Even if deleted, e-mail still can be re- tions given in the closed network are confi- covered, and if deleted e-mail is requested dential and private, one must remember the and produced, consideration must be given goals of e-mail. E-mail is a shorthand way to the reason for the deletion. It is quite of expressing a thought with the added possible that the person deleting the e-mail benefit that the other side of the communi- changed his or her mind about the content cation does not need to be present for the of the e-mail. Yet, an after-the-fact expla- thought to be sent or received. E-mail often nation may not be convincing. is a fleeting thought, unintentionally me- Despite its compromised reliability in morialized. While there sometimes is litigation, intra-company e-mail networks ample time to alter the thought, there is are useful to a corporation. One court has seldom corrective follow-up or retraction.8 recognized that companies not only incur In a very real sense, an e-mail is, at enormous expense in implementing the most, half of a conversation, and its reli- technology to stay competitive, they then ability for the truth of its content is suspect face substantial expense to produce the for many reasons. For example, in a con- data based on a concept of “litigation fair- versation, there is give and take, feedback ness.”10 E-mail has become as basic to in the form of questions, and pauses and most companies as the telephone, and in voice inflections that provide personal cues most setting has overtaken the telephone as to the interpretation of the message. Ideas the preferred method to communicate. are often modified or discarded during the Although e-mail discovery has been al- conversation. By contrast, in an exchange lowed in civil cases, it is ironic that the of e-mail thoughts, when an idea is same invasion into the content of private changed, there is not always a written ac- conversations—with or without a tele- knowledgment of that change. phone—generally has not been allowed, wanted intrusions from public or competitors “has a dant under an anonymous screen name. reasonable, legitimate and objective expectation of 8. See Connie W. Crook & Rosemary Booth, privacy within the interior of its covered buildings, Building Rapport in Electronic Mail Using Accom- and it is equally clear that expectation is one society modation Theory, SOC’Y FOR ADVANCEMENT OF is prepared to observe”). MANAGEMENT J., Winter 1997, at 4: “In electronic 6. See Smith v. Pillsbury Co., 914 F.Supp. 97 communication, the rapidity of response, the jargon (E.D. Pa. 1996) (company-owned e-mail system be- and symbols used, and the informality of the mes- longs to company, not to employees using system, sage give additional meaning to the communication. thereby distinguishing situations that involve em- Thus, to communicate effectively the author must ployees who claim invasion of their privacy when accommodate the message to the reader by adjusting company disciplines or discharges employee for it to reflect the reader’s communication style.” abusing or misusing company e-mail system). 9. Armen Artinyan, Legal Impediments to Dis- 7. See United States v. Maxwell, 45 M.J. 406 covery and Destruction of E-mail, 2 J. LEGAL (C.A.A.F. 1996). In this case, the court analyzed the ADVOC. & PRAC. 95, 96 (2000). scope of privacy related to e-mail transmitted via an 10. In re Brand Name Prescription Drugs Anti- Internet online service provider (AOL) in a criminal trust Litig., 1995 WL 360526 (N.D. Ill.). case of distributing child pornography by the defen- Self-Critical Analysis Privilege in the Product Liability Context Page 39 and evidence based on that invasion gener- ders have been issued. Wise technology ally is not admissible.11 It is unlawful for decisions may make compliance with dis- anyone to intercept the conversation of covery smooth and affordable; poor strate- third parties with wiretaps or listening de- gic planning can make it onerous and ex- vices, unbeknownst to those talking. Such pensive.”14 conduct otherwise might give rise to a pri- The production of deleted computerized vate cause of action for damages as an in- information is also part of the expense.15 vasion of privacy, and in some jurisdic- This has generated extensive efforts to en- tions it is a criminal offense. The “fruit” of sure that corporations responsibly manage a subpoena or request for production of e- internal e-mail and other computerized mail is fundamentally the same as the fruit data so that when a discovery request ar- of a wiretap or the illegal capture of con- rives, the company will not have to sift versation. through millions of pages of disorganized Courts have declined to admit illegally data to determine the content of the data. obtained evidence by way of wiretap in Spoliation of evidence has generated mil- civil litigation.12 Even where the wiretap lion dollar fines when a company failed to was authorized by law in the context of a preserve electronic data that harmed a criminal investigation, courts have re- claimant’s ability to establish its claims.16 frained from allowing civil litigants from discovering the recorded conversation.13 CONCLUSION No case could be found in which a court This article is intended to catalyze con- issued a wiretap order to help civil litigants tinued discussions on the benefits and bur- discover their claims or prepare their de- dens of intra-company e-mail productions. fenses. Underlying this rethinking is the question whether our concept of appropriate discov- NEVERTHLESS, PRODUCTION ery has kept pace with this communication ORDERED technology. The search for truth in the civil Despite these issues, corporations have discovery process existed for many years been required and presumably will con- before the advent of e-mail. The costs and tinue to be required to produce e-mail. The burdens on companies, as well as the argu- presumption that e-mail should be discov- able defeated purpose of e-mail generally, erable and admissible has developed a might outweigh the benefits to have been business mindset that discovery is a factor gained by discovery into intra-company e- in a company’s decision to employ an in- mail. If that is the case, then this may re- ternal e-mail communication system: quire a fundamental rethinking of whether “Technology should be easily adaptable intra-company e-mail should not be in- once litigation has begun and discovery or- cluded in the litigation process.

11. See Katz v. United States, 389 U.S. 347, 353 (18 U.S.C. § 2517 does not authorize pretrial disclo- (1967), rev’g 369 F.2d 130 (9th Cir. 1966) (use of sure of wiretap evidence to private civil litigants). eavesdropping devices without warrant violates See also Nat’l Broadcasting Co. v. U.S. Dep’t of Fourth Amendment when speaker has reasonable ex- Justice, 735 F.2d 51 (2d Cir. 1984) (finding lack of pectation of privacy). authority to compel government to release recorded 12. See, e.g., Filosa v. Filosa, 1991 WL 180392 tapes to private litigant pursuing civil matter). (E.D. N.Y.). The court relied on the prohibition in 18 14. William DeCoste, Sender Beware: The U.S.C. § 2515 on the use of illegally obtained wire- Discoverability and Admissibility of E-mail, 2 tap evidence or evidence derived therefrom in “any VAND. J. ENT. L. & PRAC. 79, 84 (2000). trial, hearing, or other proceeding in or before any 15. See Gregory I. Rasin & Joseph P. Moan, Fit- court.” See also United States v. Wuliger, 981 F.2d ting a Square Peg into a Round Hole: The Applica- 1497 (6th Cir. 1992) (declining to recognize im- tion of Traditional Rules of Law to Modern Techno- peachment exception to 18 U.S.C. § 2515 to allow logical Advancements in the Workplace, 66 MO. L. use of illegally obtained wiretap in civil proceedings REV. 793, 799 (2001). between private parties). 16. See In re Prudential Ins. Co. Sales Practices 13. See In re Motion to Unseal Electronic Sur- Litig., 169 F.R.D. 598, 617 (D. N.J. 1997). veillance Evidence, 990 F.2d 1015, (8th Cir. 1993) The Privacy Project The Self-critical Analysis Privilege in the Product Liability Context

If analyzed as a subsequent remedial measure, self-evaluation wouldn’t impede discovery, but the information would be protected

By George S. Hodges, Karen A. Jockimo IADC member George S. Hodges is By and Paul E. Svensson managing partner of Boeggeman, George, Hodges & Corde, P.C., of White Plains, T IS self-evident that any business New York, and a member of the IADC Ex- should emphasize self-critical analysis ecutive Committee. He is a graduate of I Fordham University (B.A. 1970; J.D. of its significant operations and products in 1973). order to deliver safe and effective products Karen A. Jockimo is a partner in the to its consumers. The opportunity to gain same firm. She was educated at Connecti- increased market share, maintain lower in- cut College (B.A. 1989) and Pace Univer- surance premiums and avoid both the high sity School of Law (J.D. 1993). costs of litigation and potential adverse Paul E. Svensson received his J.D. from judgments co-exist as tangible benefits. Pace University School of Law in 2002. Trouble arises when a company under- He also was educated at the University of takes self-examination, evaluates or makes Pittsburgh (M.P.H. 1979 and Holy Cross a product modification, and litigation still College (B.A. 1976). arises from a prior event. The principal issue becomes whether the party bringing suit should have access to any of the infor- stitution of the United States or provided by mation discovered through the self-exami- act of Congress or in rules prescribed by the nation. Or is that information privileged? Supreme Court pursuant to statutory authority, the privilege of a witness, person, gov- To date, only a few courts and commen- ernment, state, or political subdivision tators have considered the application of thereof shall be governed by the principles the self-critical analysis privilege in the of the common law as they may be inter- product liability context. preted by the courts of the United States in the light of reason and experience. However, HISTORICAL PERSPECTIVES in civil actions and proceedings with respect to an element of a claim or defense as to A. Judicial Review which state law supplies the rule of decision, Self-critical analysis has developed in the privilege of a witness, person, govern- the United States over the years as a fed- ment, state, or political subdivision thereof eral common law privilege based on the shall be determined in accordance with state law. application of Federal Rule of Evidence 501, which states: The privilege is premised on the public policy that frank and potentially damaging Except as otherwise required by the Con- self-criticism should be protected from discovery in order to encourage this socially 1. Sheppard v. Consol. Edison Co., 893 F.Supp. beneficial activity.1 This is particularly true 6, 7 (E.D. N.Y. 1995) (“disclosure of documents re- where businesses seek to review and im- flecting candid self-examination will deter or suppress socially useful investigations and evaluations prove on the safety of its products. The un- or compliance with the law”). derlying theory is that if discovery is al- Self-critical Analysis Privilege in the Product Liability Context Page 41 lowed, there may be a “direct chilling ef- cal privilege in regard to product safety re- fect on the institutional or individual self- view activities and nothing meaningful un- analyst; and that this effect operates to dis- der discussion. courage the analyst from investigating thoroughly and frankly or even from inves- B. Development of Privilege tigating at all.”2 This concern becomes The self-critical analysis privilege was even more meaningful where corrective first recognized in 1970 in the context of a measures can only be cultivated from self- medical malpractice action. In Bredice v. examination of the type the privilege is ex- Doctor’s Hospital, an administratrix, on pected to protect. behalf of the decedent, sued the hospital Unfortunately, the playing field facing for malpractice. The plaintiff moved for U.S. businesses over the past decade the production and inspection of minutes largely has been an uneven landscape. Nei- and reports of any board or committee of ther the Constitution, the Congress, nor the the hospital or its staff concerning the U.S. Supreme Court has expressly created death of the decedent and of reports, state- a self-critical analysis privilege. The ments or memoranda, including reports to Court’s decisions in University of Pennsyl- the malpractice insurance carrier pertaining vania v. Equal Employment Opportunity to the deceased or his treatment, no matter Commission3 and Trammel v. United when, to whom or by whom made. In es- States4 indicate that the application of a sence, the plaintiff was attempting to ob- self-critical analysis privilege should be tain the minutes of a hospital peer review decided on a case-by-case basis. meeting at which the decedent’s care was In judicial review, the privilege often evaluated. falls under severe scrutiny, resulting in its The U.S. District Court for the District uncertain application, thus thwarting the of Columbia denied access to the minutes, candor with which such evaluations are in- relying on the public policy rationale un- tended to be performed and deterring cor- derlying the self-critical or self-evaluative porations from proceeding with self-critical privilege. The court noted: studies. Judicial reluctance to extend the self- Confidentiality is essential to effective critical analysis privilege and the resultant functioning of the staff meetings; and these unpredictability of the privilege’s applica- meetings are essential to the continued im- tion to internal analytical reviews have provement of the care and treatment of pa- prompted commentators to advocate pro- tients. Candid and conscious evaluation of posals for codifying a broad self-critical clinical practices is a sine qua non of ad- 5 equate hospital care. To subject these dis- analysis privilege. However, as is the case cussions and deliberations to the discovery with Congress, at the present time there is process, without a showing of exceptional no state legislation addressing a self-criti- necessity, would result in terminating such

2. See Note, The Privilege of Self-critical Analy- Freedom of Information Act in which Congress in- sis, 96 HARV. L. REV. 1083, 1091-92 (1983) (ex- corporated well-established privilege for deliberative plaining that direct chilling effect not only includes intra-agency documents); Douglas Oil Co. v. Petrol fear of lawsuits, but also that analyst may “temper Stops Northwest, 441 U.S. 211 (1979), rev’g 571 his criticism out of a fear that reprisals will result” if F.2d 1127 (9th Cir. 1978) (recognizing privileged result is liability). nature of grand jury proceedings). 3. 493 U.S. 182 (1990), aff’g 850 F.2d 969 (3d 4. 445 U.S. 40, 47 (1980), aff’g 583 F.2d 1166 Cir. 1988) (refusing to recognize peer review privi- (10th Cir. 1978). lege relative to employment documents). The Su- 5. See, e.g., Paul B. Taylor (Note), Encouraging preme Court, however, has recognized privileges Product Safety Testing by Applying the Privilege of similar to the privilege of self-critical analysis on at Self-Critical Analysis when Punitive Damages Are least three occasions: United States v. Nixon, 418 Sought, 16 HARV. J.L. & PUB. POL’Y 769, 796-97 U.S. 683 (1974), aff’g 377 F.2d 1326 (D. D.C. 1974) (1993); David P. Leonard, Codifying a Privilege for (qualified privilege for Presidential communica- Self-critical Analysis, 25 HARV. J. ON LEGIS. 113, tions); Nat’l Labor Relations Bd. v. Sears, Roebuck 117 (1988). & Co., 421 U.S. 132 (1975) (construing exception to Page 42 DEFENSE COUNSEL JOURNAL—January 2003

deliberations. Constructive, professional making investigations which are calculated criticism cannot occur in an atmosphere of to have a positive effect on equalizing em- tension that one doctor’s suggestion will be ployment opportunities.” used as a denunciation of a colleague’s con- 6 Since the self-critical analysis privilege duct in a malpractice suit.” was first recognized judicially in Bredice The court also noted that the purpose of and Banks, it has been extended to numer- the hospital’s staff meetings was to im- ous areas including accounting records;8 prove, through self-analysis, the efficiency securities losses;9 academic peer reviews;10 of medical procedures, techniques and pa- railroad accident investigations;11 product tient care. Without an ability to conduct a safety assessments;12 and products liabil- retrospective review, the value of these ity.13 types of meetings would be undermined if The rationale behind applying the self- they and the names of those participating critical analysis privilege in these situa- were to be opened to discovery. tions has essentially been the same: “It al- The Bredice rationale for refusing to dis- lows individuals or businesses to candidly close the minutes and reports of hospital assess compliance with regulatory and le- staff meetings was adopted by the U.S. gal requirements without creating evidence District Court for the Northern District of that may be used against them by their op- Georgia in Banks v. Lockheed-Georgia ponents in future litigation.”14 Co.7 The Banks court held that disclosure of information concerning a company’s A QUALIFIED PRIVILEGE candid self-analysis, which evaluated its employment practices and affirmative ac- In determining whether a self-critical tion compliance programs, would have a analysis privilege will apply, courts have discouraging effect on equal employment followed no single rule, test, analysis or opportunities. evaluation. In fact, it is clear that the self- The Banks court concluded that “it critical analysis privilege is a qualified one would be contrary to [public] policy to dis- whose application cannot be guaranteed courage frank self-criticism and evaluation under any circumstances. The three criteria in the development of affirmative action historically considered by courts include: programs of this kind.” The court also re- • Whether the information resulted lied on the reasoning of Bredice and noted from critical self-analysis taken by the par- that to allow “access to the written opin- ties seeking protection; ions and conclusions of the members of • Whether the public has a strong inter- Lockheed’s own research team would dis- est in preserving the free flow of the type courage companies such as Lockheed from of information sought; and • Whether the information is of a type whose flow would be curtailed if discovery were not allowed. 6. 50 F.R.D. 249, 250 (D. D.C. 1970), aff’d, 479 F.2d 920 (D.C. Cir. 1973). The burden of establishing that these cri- 7. 53 F.R.D. 283 (N.D. Ga. 1971). teria have been meet is on the party seek- 8. New York Stock Exch. v. Sloan, 489 F.2d 1 ing to assert the self-critical analysis privi- (2d Cir. 1973). 9. Crazy Eddie Sec. Litig., 792 F.Supp. 197 (E.D. lege. Meanwhile, courts also have created N.Y. 1992). numerous limitations and restrictions on 10. Keyes v. Lenori Rhyne College, 552 F.2d 579 (4th Cir.), cert. denied, 443 U.S. 904 (1977) the self-critical analysis privilege. 11. Granger v. Nat’l R.R. Corp., 116 F.R.D. 507 First, a document generally will not be (E.D. Pa. 1987). accorded this privilege unless it was pre- 12. Lloyd v. Cessna Aircraft Co., 74 F.R.D. 518 (E.D. Tenn. 1977) pared with the expectation that it would be 13. Bradley v. Melroe Co., 141 F.R.D. 1 (D. D.C. kept confidential and, equally as important, 1991) has been kept confidential. This limitation 14. Reichhold Chemicals Inc. v. Textron Inc., 157 F.R.D. 522, 524 (N.D. Fla. 1994). was first enunciated in Dowling v. Ameri- 15. 971 F.2d 423 (9th Cir. 1992). can Hawaii Cruises.15 In Dowling, the Self-critical Analysis Privilege in the Product Liability Context Page 43

Ninth Circuit was asked to determine the privilege has been found inapplicable whether the plaintiffs could discover the in a circumstance where the document has minutes of meetings of a ship safety com- been subpoenaed by a government agency mittee held prior to a crewman’s injury. as part of an administrative review.19 The ship had asserted that the documents Finally, it has been held that the self- were protected by the self-critical analysis critical analysis privilege is a qualified one privilege. In addition to applying the three that can be overcome by a showing to the criteria above, the court also considered court of “extraordinary circumstances or whether the documents were prepared with special need.”20 Thus, as in the application the expectation that they be kept confiden- of the attorney work product privilege, a tial. litigant seeking disclosure of a document The Dowling court ultimately concluded from a possessor asserting the self-critical that the documents should not be given the analysis privilege may overcome the privi- benefit of the self-critical analysis privilege by showing extraordinary circum- lege, holding that routine safety inspections stances and special need. It has been ar- would not be curtailed merely because they gued that to allow a party to overcome the might be subject to future disclosure. privilege by showing exceptional needs Moreover, the court did not believe that risks the evisceration of the privilege itself. routine safety inspections were normally Proponents of a legislatively mandated performed with the expectation that they self-critical analysis privilege contend that would be kept confidential.16 allowing such limitations to the privilege Thus, the Dowling court applied a fourth leaves businesses that conduct self-critical prong to the historical self-critical analysis analysis “uncertain of their protection.”21 privilege test by requiring that any self- evaluative documents be created with the PRODUCT LIABILITY DECISIONS intent that they be confidential and be kept Claims of self-critical privilege have confidential. As a consequence, it is often been reviewed consistently under Rule 501 recommended that an evaluator conspicu- of the Federal Rules of Evidence, but the ously mark self-critical documents as con- tests applied by the various federal courts fidential and that the internal and external have varied in part because of the applica- distribution of the documents be limited in tion of state common law when jurisdiction order effectively to limit their disclosure.17 is based on diversity of citizenship.22 In the Since Dowling, some federal courts have state courts, the application of a self- applied this test, while others have not. critical analysis privilege has been consid- The privilege also has been limited to ered under state evidence law based on the extent that it has been held to apply Rule 501, as well as the test recognized by only to subjective impressions and opin- the applicable state common law. In doing ions exercised in evaluating the product so, some state courts have recognized this and not to statistical or objective facts re- privilege,23 while others have not.24 garding use of the product.18 Additionally,

16. See also Reichhhold, 157 F.R.D. 522. 22. See, e.g., Lawson v. Fisher-Price, 191 F.R.D. 17. See Note, Legal Development: The Privilege 381 (D. Vt. 1999). of Self-critical Analysis: A Survey of the Law, 60 23. Kansas Gas & Elec. v. Eye, 789 P.2d 1161 ALB. L. REV. 171 (1996). (Kan. 1990) (discussing Berst v. Chapman, 653 P.2d 18. Webb v. Westinghouse Elec. Corp., 81 107 (Kan. 1982), in which the Kansas Supreme F.R.D. 431, 433-35 (D. Pa. 1978); Reed Lockheed Court recognized the self-critical analysis privilege); Aeronautics, 199 F.R.D. 379 (N.D. Ga. 2001). Anderson v. Hahnemann Med. Coll., 1985 WL 19. Fed. Trade Comm’n v. TRW Inc., 628 F.2d 47218 (Pa.Commw.Ct.). 207, 210 (D.C. Cir. 1980). 24. Payton v. New Jersey Turnpike Auth., 691 20. See, e.g., Mao-Shiung Wei v. Bodner, 127 A.2d 321 (N.J. 1997) (self-critical analysis does not F.R.D. 91 (D. N.J. 1989). See also Bredice, 50 exist in common law but court may consider it in F.R.D. 249. balancing need for discovery against prejudice to 21. See Note, Privilege of Self-critical Analysis, party resisting it); Univ. of Ky. v. Courier-Journal & supra note 2. Louisville Times Co., 830 S.W.2d 373 (Ky. 1992); Page 44 DEFENSE COUNSEL JOURNAL—January 2003

A. State Courts these dealt with product safety issues.27 Of the state cases, only Limite v. Emer- B. Federal Courts son Electric Co.—White Rodgers Division involved litigation related to the disclosure Federal courts historically have been of product safety information.25 The New concerned with a vexing dilemma between York Appellate Division affirmed an order the interest in disclosure that is expected to compelling discovery of all documents cre- “contribute to full and fair determination of ated during an investigation by the federal all facts relevant to the plaintiff’s claims,” Consumer Product Safety Commission. and the importance of maintaining “confi- The court held that a section of the Con- dentiality both to assure fairness to persons sumer Product Safety Act mandating non- who have been required by law to engage disclosure of CPSC investigations was in- in self-evaluation . . . and to make the self- applicable to judicial proceedings based on evaluation process more effective by creat- its plain language. ing an effective incentive structure for can- The Limite court also modified the order did and unconstrained self-regulation.”28 of the trial court to protect all information The federal cases reviewed below ad- in the documents disclosed by Emerson dressed the self-critical analysis privilege Electric to the plaintiff from public disclo- involving both the protection of pre-acci- sure, but the plaintiff was provided with dent and post-accident reviews, as required Emerson Electric’s self-critical analysis to by the Consumer Product Safety Act,29 and use in developing its case and subsequently with the protection of documents produced at trial. The court opined that any danger to in the course of self-evaluation. the defendant’s reputation as a manufac- In contrast to the New York decisions, turer from plaintiffs’ access to incomplete the federal courts in Shipes v. BIC Corp.,30 or inaccurate information should be obvi- Roberts v. Carrier Corp.31 and Ashley v. ated by an appropriate protective order, Uniden Corp.32 endorsed the self-critical thus complying with the legislative intent analysis privilege and applied it to confi- of the statute.26 dential self-evaluation documents created There have been other New York deci- by a manufacturer for submission to the sions recognizing privileges similar to a CPSC. A state court case, Scroggins v. self-critical analysis privilege, but none of Uniden Corp.,33 decided shortly after Rob-

Scroggins v. Uniden Corp. of Am., 506 N.E.2d 83 26. See also Consumer Prod. Safety Comm’n v. (Ind.App. 1987) (Indiana courts recognize only GTE Sylvania Inc., 447 U.S. 102, 111-13 (1980), statutory privileges); Southern Bell Tel. & Tel. Co. aff’g 598 F.2d 790 (3d Cir. 1979). v. Beard, 597 So.2d 873 (Fla.App. 1992) (all privi- 27. Martin v. Gross, 605 N.Y.S.2d 742 (App. leges in Florida are statutory, thus no common law Div. 1st Dep’t 1993) (applying public interest privi- privilege for self-critical analysis exists); Combined lege to child protective services records); One Communications Corp. v. Pub. Serv. Co. of Colo- Beekman Place Inc. v. City of New York, 564 rado, 865 P.2d 893 (Colo.App. 1993) (self-critical N.Y.S.2d 169 (App.Div. 1st Dep’t 1991) (applying analysis privilege does not exist in Colorado, al- privilege of communication between public officers though court applied self-critical analysis to case and regarding zoning determination). held that it did not apply); Cloud v. Superior Court 28. O’Connor v. Chrysler Corp., 86 F.R.D. 211, (Litton Indus. Inc.), 58 Cal.Rptr.2d 365 (Cal.App. 218 (D. Mass. 1980). 1996), (self-critical analysis privilege not in state 29. 15 U.S.C. §§ 2051-83. For another example evidence code, thus does not exist in California); of regulation with ramifications in the products li- Grimes v. DSC Comm. Corp., 724 A.2d 561 ability area, see Patricia L. Andel, Inapplicability of (Del.Ch. 1998); Harris-Lewis v. Mudge, 1999 WL the Self-critical Analysis Privilege to the Drug and 98589 (Mass.Super. 1999); Office of Consumer Medical Device Industry, 34 SAN DIEGO L. REV. 93 Council v. Dep’t of Pub. Util. Control, 665 A.2d 921 (1997) (advocating inapplicability of privilege to (Conn.Super. 1994); Lamite v. Emerson Elec. Co.— drug and medical device industry, which is subject to White Rodgers Div., 535 N.Y.S.2d 650 (App.Div. 3d federal Food, Drug, and Cosmetic Act and Freedom Dep’t 1988), leave to appeal dismissed, 74 N.Y.2d of Information Act). 650 (1989) (permitting disclosure for purposes of 30. 154 F.R.D. 301 (M.D. Ga. 1994). litigation but barring any public dissemination of in- 31. 107 F.R.D. 678 (N.D. Ind. 1985). formation). 32. 1986 U.S.Dist. Lexis 22409 (W.D. Tex.). 25. 535 N.Y.S.2d 650, supra note 24. 33. 506 N.E.2d 83 (Ind.App. 1987). Self-critical Analysis Privilege in the Product Liability Context Page 45 erts and Ashley, declined to recognize a tests when evaluating a party’s claim of a non-statutory privilege, and Lawson v. self-critical privilege. It reviewed the test Fisher-Price Inc.,34 another federal court used by the district court in Indiana in Rob- case, also did not recognize the privilege. erts, which held that for the materials to be privileged: (1) they must have been pre- 1. Shipes pared for mandatory government reports; (2) the privilege only extends to subjective, In Shipes, jurisdiction was based on di- evaluative materials; (3) the privilege does versity, and the U.S. District Court for the not extend to objective data in the same Middle District of Georgia applied the test reports; and (4) discovery should be denied favored in that state. The court noted that only where the policy favoring exclusion Georgia’s self-critical privilege statute is has clearly outweighed plaintiff’s need.37 applicable only to “medical peer review” The Shipes court concluded that regardless activities.35 However, it reviewed the of which test was applied in the case before analysis of the federal common law privi- it, the same conclusion is reached. lege that had been conducted in Banks by The Shipes court reasoned that since the the federal court for the Northern District documents were equivalent to “medical of Georgia. The Shipes court concluded peer review” under Georgia law because that the reasoning behind the federal com- they were submitted to the CPSC pursuant mon law privilege for self-critical analysis to the Consumer Product Safety Act, they mirrors that supporting the Georgia statu- were entitled to the self-critical analysis tory medical peer review privilege and that privilege. However, the court held that the the public interest is furthered when orga- documents must have been specifically nizations or corporations critically analyze created for submission to the review their safety records. agency in order to be privileged and that Under the test applied in Georgia, which information, documents or records other- was derived from the Ninth Circuit deci- wise available from original sources are sion in Dowling, the party asserting the not immune from discovery merely be- privilege must meet four criteria: cause they were sent to the reviewing “First, the information must result from a agency. The court added that the material critical self-analysis undertaken by the party would not be privileged unless it was sub- seeking protection; second, the public must jective and evaluative; thus, factual mate- have a strong interest in preserving the free rial would be discoverable. flow of information sought; [third], the The determination that factual material information must be of the type whose is not protected by the self-critical analysis [creation] would be curtailed if discovery were allowed” . . . Additionally, the docu- privilege is consistent with federal court ment must have been created with the ex- decisions. It also is well settled that the pectation that it would be kept confidential privilege, when recognized, must be bal- and must have remained so.36 anced against the party’s need for full and fair discovery to determine the issues in the The Shipes court also recognized that litigation.38 In a majority of cases, the fed- federal courts have applied two different

34. 191 F.R.D. 381 (D. Vt. 1999). 38. Fischer v. Borden, 1994 U.S.Dist. Lexis 35. GA. CODE ANN. § 31-7-143; Hollowell v. 21275 (D. N.J.) (buyer’s internal inspection reports Jove, 270 S.E.2d 430 (Ga. 1981) (materials gener- were not protected because information they con- ated in course of medical review committee proceed- tained was factual, reviews were not made with eye ings concerning physician’s competence protected to being kept confidential, and buyer would not stop from discovery in civil lawsuits). making them as result of disclosure); Bradley, 141 36. 154 F.R.D. at 307, quoting Dowling, 971 F.R.D. 1 (mental impressions, opinions, evaluations, F.2d at 426. Compare Roberts, 107 F.R.D. at 684 recommendations and theories of investigatory files (setting forth different four-part test for self-critical privileged but factual material discoverable); Lloyd, analysis). 74 F.R.D. 518 (disallowing discovery of minutes and 37. 107 F.R.D. at 684. See also Resnick v. Am. memoranda of meetings concerning self-evaluation Dental Ass’n, 95 F.R.D. 372, 374 (N.D. Ill. 1982). of possible negligent manufacture of products). Page 46 DEFENSE COUNSEL JOURNAL—January 2003 eral courts have recognized a privilege of and Shipes courts to be protected by the self-critical analysis precluding the discov- privilege. Instead, the court interpreted the ery of impressions, opinions and evalua- public policy behind the self-critical analy- tions, but allowing discovery of factual sis privilege “‘to assure fairness to persons data. required by law to engage in self-evalua- Although there is some danger that the tion . . . and to make the self-evaluation factual information will be used to develop process more effective by creating an ef- litigation, critical evaluation is protected fective incentive structure for candid and because the ultimate benefits far outweigh unconstrained self-evaluation.’”40 Applying any benefits of disclosure, and thus the this standard to the facts of its case, the evaluation itself is limited from public ex- court concluded that any document not posure, because it is not realistic to expect specifically prepared for and turned over to candid expressions of opinion or suggested the Consumer Product Safety Commission changes in policies, procedures or pro- enjoyed no privilege. cesses when people know that such state- Although the information was turned ments or suggestions may very well be over voluntarily to the commission, the used against colleagues and employees in Roberts court held that since it was origi- subsequent litigation.39 nally prepared “in the regular course of business,” it was not entitled to protection 2. Roberts because it was not prepared specifically as a government-required report. The court In Roberts, the federal district court for borrowed this holding from an employ- the Northern District of Indiana acknowl- ment discrimination case, as this was the edged the applicability of a self-critical first federal court to consider the applica- analysis privilege to a post-accident report tion of the self-critical analysis privilege in review required by federal law, but it re- a product safety context. The court refused fused to apply it to the voluntary disclosure to accept the defendant’s argument that by the manufacturer to the Consumer Prod- public policy favored protecting self- uct Safety Commission. The Roberts court critical analysis as an incentive for busi- applied a slightly different test from that nesses to conduct such an analysis without used by the Shipes court, focusing on the fear of subsequent reprisal. It interpreted condition that the material sought to be the plain language of the Consumer Prod- privileged must be prepared for mandatory uct Safety Act as requiring businesses to reports to the government. The distinction report any defective condition discovered. from the Dowling and Shipes tests is clear. Thus, the court reasoned that any damag- Instead of covering any material produced ing information would be protected under in critical self-analysis, Roberts required this express test. that the material be mandated by operation However, the risk that information can of law. Thus, any self-critical analysis con- be gathered before evidence of a defective ducted by the business entity to improve its condition is known, and that this informa- product, but not mandated by law, would tion may be used to develop litigation, cre- be unprotected. ates a strong disincentive, contrary to pub- As a consequence, the test applied in lic policy, to study a product critically Roberts does not allow a business to en- before an accident occurs. The interpreta- gage confidentially in the type of pre-acci- tion by Roberts of the plain language of the dent review activity found by the Dowling statute must be clearly distinguished when counsel seeks to protect post-accident in- 39. See Bradley, 141 F.R.D. at 3, citing William formation. B. Johnson, Annotation, Discoverability of Traffic Accident Reports and Derivative Information, 84 3. Ashley A.L.R.4th 15, 24 (1991). 40. 107 F.R.D. 684, quoting O’Connor, 86 In Ashley, the U.S. District Court for the F.R.D. at 218. Western District of Texas addressed a Self-critical Analysis Privilege in the Product Liability Context Page 47 plaintiffs’ motion to compel the defendant privilege against production of self-critical to state what efforts it made to comply with analysis. It is the role of either Congress Section 15 of the Consumer Product Safety or the state legislature to create such a Act. The defendant refused to answer the privilege, the court declared, not its pre- interrogatory on the ground of the common rogative. The court opined that “a respon- law privilege against the disclosure of criti- sible manufacturer who discovered a dan- cal self-analysis. gerous article and filed a self-critical Ashley follows the test of Roberts. The analysis reflecting the danger, would cease court acknowledged that the privilege distribution of it, or at least be ordered to arises with respect to materials containing cease and desist” by the Consumer Product subjective, evaluative information that Safety Commission. The court failed to have been prepared as part of a mandatory conduct any search of the literature or con- report to a governmental agency when the duct any discovery to support its assump- factors favoring exclusion clearly outweigh tion that a self-critical analysis necessarily a plaintiff’s need for the information. The required a product recall, even though the court also recognized that the regulations case involved the same defendant as in issued under the act encourage manufactur- Ashley. ers to engage in critical self-analysis and to err on the side of reporting. The court rea- 5. Lawson soned that 15 U.S.C. § 2064(b) and the In Lawson, the most recent product regulations promulgated thereunder en- safety case to be considered by the federal courage a manufacturer to issue a report courts, the Vermont federal district court even where the manufacturer might doubt held that information submitted to the Con- the existence of a defect.41 sumer Product Safety Commission prior to More important, the Ashley court recog- the subject accident was not protected by nized that the need to encourage full and the self-critical analysis privilege. Jurisdic- frank disclosure of information to the gov- tion was based on diversity and the court ernment regarding defective products is of was bound to apply Vermont law. The test crucial importance to the consuming pub- used in Vermont differs from that under lic. The court opined that the success of the both Roberts and Shipes, and the court en- reporting scheme would be severely under- gaged in no discussion as to the findings in cut if manufacturers feared that their frank these cases, the implications of these find- disclosures might be used against them in ings on the case before it, or the divergence lawsuits. in the tests as applied by the different Ashley concluded that reporting itself courts. comes within the privilege of critical self- The Lawson court concluded that, under analysis. The court reasoned that the same Vermont law, the following four-part test policy considerations that dictate non-dis- for recognition of a discovery privilege closure of critical self-analysis also dictate non-disclosure of the very fact of reporting. The court stated that the mere fact that a manufacturer has reported that its product 41. 15 U.S.C. § 2064(b) provides: “Every manu- might have a defect can be just as damag- facturer of a consumer product distributed in coming before a jury as the very details of the merce, and every distributor and retailer of such product, who obtains information which reasonably defect. supports the conclusion that such product—(1) fails to comply with an applicable consumer product 4. Scroggins safety rule; or (2) contains a defect which could create a substantial product hazard described in subsec- In Scroggins, decided shortly after Rob- tion (a)(2) of this section, shall immediately inform the commission of such failure to comply or of such erts and Ashley, the Indiana Court of Ap- defect, unless such manufacturer, distributor, or re- peals held that in Indiana all privileges are tailer has actual knowledge that the commission has statutory in nature and that there was no been adequately informed of such defect or failure to comply.” Page 48 DEFENSE COUNSEL JOURNAL—January 2003 must be applied: (1) The communications However, the court viewed this prong must originate in a confidence that they only from the perspective of the commis- will not be disclosed. (2) This element of sion, indicating that the commission’s rela- confidentiality must be essential to the full tionship and dependence on the accurate and satisfactory maintenance of the rela- reporting of information will not be under- tion between the parties. (3) The relation cut by subsequent disclosure of that mate- must be one that in the opinion of the com- rial in litigation. “The reporting of certain munity ought to be sedulously fostered. (4) information about potential product defects The injury that would inure to the party by to the [commission] is mandated by law; the disclosure of the communications must thus, a company’s refusal to compile and be greater than the benefit gained for the disclose materials to [the commission] out correct disposal of litigation. The party of fear of subsequent public disclosure seeking creation of the privilege has the would simply be illegal,” the court stated.42 burden of satisfying the four conditions The court also held that the information and must meet all four before the privilege under review failed the last two prongs of will be recognized. the test because, while it appeared impor- At first, the Vermont court’s test seems tant to foster the relationship between cor- to be a broader application of the test ap- porations and the commission, the manda- plied in Roberts and Ashley. Instead of lim- tory nature of reporting mitigated the need iting protection to government mandated to develop a strong relationship between reports, on its face this test would allow the two parties. In doing so, the court to- materials prepared in confidence and for tally neglected to recognize that the provi- the purposes of monitoring product safety sion of self-critical information, not subject to be privileged, particularly if the materi- to disclosure, was integral to the relation- als were subsequently disclosed to the ship between the parties as created by op- Consumer Product Safety Commission. eration of law. Moreover, these materials need not be limited to evaluations, but they theoretically WHERE ARE WE GOING? could include factual data as well. Both the A. Case Law Lawson and Roberts-Ashley tests allow for a balancing of public policy interests in fair One may wonder what rhyme or reason litigation practice and on-going product can be drawn from this crazy quilt of case safety evaluation by the court. law. The self-critical evaluation privilege is The test as applied in Lawson reflects of recent origin and one that is narrowly few of those characteristics, thus making applied even in those jurisdictions where it the absence of reference to Roberts, Shipes is recognized. On their own, the cases give and Ashley all the more puzzling. The court some indication what one may expect in a held that the information submitted to the particular jurisdiction, but because of the CPSC failed to meet the test, reasoning that lack of well-settled precedents, it is equally although the communication did originate feasible to expect that a court could refine in a confidential situation, since the com- its thinking with proper persuasion. Coun- mission rules restricting disclosure assured sel who seek to invoke the self-critical the investigated party that produced mate- analysis privilege should apply the prin- rials will not be lightly disclosed, such con- ciples of Shipes, Ashley, Roberts and fidentiality “does not appear to be essential Lawson in their arguments to emphasize to the full and satisfactory maintenance of and distinguish the test to be applied. the relation between the parties as required Perhaps the most significant barrier oc- by the second prong” of the test. curs when a court disagrees that voluntary self-critical analysis will be abandoned if it is later found to be discoverable in litigation. The Dowling court asserted: 42. 191 F.R.D. at 386. Organizations have many incentives to Self-critical Analysis Privilege in the Product Liability Context Page 49

conduct such reviews that outweigh the may be a limited evidentiary shield, the harm that might result from disclosure. The policy behind it of limiting admissibility of most prominent of these is surely the desire remedial measures as proof of negligence to avoid law suits arising from unsafe condi- or culpable conduct is consistent with the tions. But organizations also have a strong privilege claimed under self-critical analy- incentive to [seek] . . . a reputation for safety sis. Rule 407, entitled “Subsequent Reme- [that] renders a product more marketable.43 dial Measures,” states: Even if true, is this enough to justify When, after an injury or harm allegedly prohibiting an enterprise the benefit of the caused by an event, measures are taken that, self-critical analysis privilege and with- if taken previously, would have made the holding from the public the benefit of en- injury or harm less likely to occur, evidence couraging self-improvement through unin- of the subsequent measures is not admissible hibited self-analysis and evaluation? to prove negligence, culpable conduct, a defect in a product, a defect in a product’s de- B. Evidence Rules sign, or a need for a warning or instruction. . . .45 All the cases discussed above were decided based on state evidence laws consis- Federal courts that have applied this ra- tent with Rule 501 of the Federal Rules of tionale are split as to its import. The Dis- Evidence or under Rule 501 itself. Rule trict Court of Minnesota recognized Rule 501, the general rule governing privileges, 407 as a rule of public policy rather than one of relevancy, but questioned its appli- recognizes no particular privilege; it en- 46 courages a case-by-case consideration. cability to matters of pretrial discovery. The privilege of self-critical analysis, as a On the contrary, the Northern District of product of Rule 501, could protect a self- Florida relied on Rule 407 in its decision recognizing the self-evaluative privilege to critical document from both discovery and 47 later use at trial. Yet even if the state protect environmental audits. choose reasonable criteria or tests by which Strong support therefore exists for the to measure the application of the privilege view that the self-evaluative privilege and applied them fairly, the result would be should be analyzed under the subsequent still a patchwork of local law. remedial measures rationale of Rule 407 The U.S. Supreme Court stated in Tram- rather than the “relational privileges” pro- mel that it will not create and apply an evi- tected under Rule 501. In this focus, self- evaluative practices within an organization dentiary privilege unless it “promotes suf- would be seen more sensibly as remedial ficiently important interests to outweigh measures, rather than activities involving the need for probative evidence, [and as] . . the kind of confidential relationships that . testimonial exclusionary rules and privi- Rule 501 seeks to protect. leges contravene the fundamental principle Courts that have upheld the self-evalua- that ‘the public . . . has a right to every tive privilege did not limit discovery of man’s evidence,’” any such privilege must factual matters, only the self-evaluations “be strictly construed.”44 Moreover, although Rule 501 manifests a congressional desire “not to freeze the law of privilege,” but rather to provide the 43. 971 F.2d at 426. 44. 445 U.S. at 50, 51, quoting United States v. courts with flexibility to develop rules of Bryan, 339 U.S. 323, 331 (1950). privilege on a case-by-case basis, accord- 45. The Advisory Committee’s Note to Rule 407 ing to Trammel, the Supreme Court has ex- clarifies that courts have applied the principle broadly to exclude “evidence of subsequent remedial pressed no interest in exercising this au- repairs, installation of safety devices, changes in thority expansively. The Court opined that company rules, and discharge of employees.” the balancing of conflicting interests of this 46. Capellupo v. FMC Corp., 1988 U.S.Dist. type is particularly a legislative function. Lexis 3792 (D. Minn. 1989). See also 2 WEINSTEIN, EVIDENCE ¶ 407[07], at 407-37 through 407-38. On the other hand, although Rule 407 47. Reichhold, 157 F.R.D. at 524. Page 50 DEFENSE COUNSEL JOURNAL—January 2003 and their related conclusions and actions. are significant. The primary ramification is This result is quite similar to that which that the self-evaluative privilege would ap- would be achieved under a Rule 407 analy- ply not against the initial discovery re- sis. As Judge Posner of the Seventh Circuit quest, but rather as a bar against admission has stated, the major purpose of Rule 407 of the evidence at trial. This would allow “is to promote safety by removing the dis- discovery of the facts of the self-evaluative incentive to make repairs (or take other evidence, consistent with the holdings of safety measures) after an accident that the federal courts, which support the privi- would exist if the accident victim could use lege, but the analysis and any remedial those measures as evidence of the defen- measures themselves could not be intro- dant’s liability.”48 duced at trial as evidence of negligence or culpability. A GOOD RESULT Therefore, it is recommended that an argument based on Rule 407 should be in- The implications of this shift in analysis cluded with an argument grounded in Rule 501 in any judicial review of the applica- 48. Flaminio v. Honda Motor Co., 733 F.2d 463, bility of the privilege, or any legislative ef- 469 (7th Cir. 1984). fort to codify the privilege. The Privacy Project Cybersmear May Be Coming to a Website Near You: A Primer for Corporate Victims

How to respond or combat venomous comments from current or former disgruntled employees presents both legal and non-legal problems

By Thomas G. Ciarlone Jr. and IADC member Eric W. Wiechmann is a By Eric W. Wiechmann litigation partner of Cummings & Lockwood, LLC, in the firm’s Harford, AMUEL Taylor Coleridge wrote, Connecticut, office. He is a graduate of “Whispering tongues can poison Hamilton College (B.A. 1970) and Cornell S Law School (J.D. 1974). truth.” The Internet is no exception to this A litigation associate in the firm’s simple maxim. With one of three Ameri- Stamford, Connecticut, office, Thomas G. cans logging onto it daily, and at least 350 Ciarlone Jr. was educated at New York million users worldwide by 2003, the University (B.A. 1998) and Cornell Law Internet has the potential to become the School (J.D. 2001). electronic rumor mill for the new millennium.1 Much of the time, online gossip is merely scurrilous and perhaps embarrass- Then there is Varian Medical Systems, a ing. For example, corporate executives and publicly traded, Fortune 500 company with their alleged sexual proclivities are favorite a market capitalization in the billions. Dis- topics for online badmouths.2 Sometimes, gruntled former employees posted more however, boorish banter gives way to inju- than 14,000 messages—on hundreds of rious falsehood. Consider the story of websites—accusing the company and its popular cookie manufacturer Mrs. Fields. management of everything from homopho- In 1996, speeding along the information bia to pregnancy discrimination to the sur- superhighway was speculation that the reptitious videotaping of public bathrooms. company planned to donate pounds of When Varian sued them for defamation, cookies, brownies and other sweets to an the defendants turned around and created O.J. Simpson victory party. Despite its fa- their own web site. Varian prevailed on the cial implausibility, this myth inspired rum- merits after a protracted trial.4 But as a blings of a national boycott. Mrs. Fields practical matter, it may have won the battle was unable to expose the hoax until it re- but lost the war. It incurred substantial le- tained a public relations firm at great ex- gal fees and generated negative publicity, pense.3

1. See Drilling Down into Computer and Web 2. See, e.g., Cybersmear Litigation Joins Online Trends, at http://www.learnframe.com/aboutelearn- Arsenal Ridge, THE RECORD, March 1, 2000, at B01, ing/page16.asp; Bruce W. Sanford & Michael J. available at 2000 WL 15812270. Lorenger, Teaching an Old Dog New Tricks: The 3. Liar, Liar: Unscrupulous Web Pages, PC First Amendment in an Online World, 28 CONN. L. COMPUTING, December 1, 1998, at 89. REV. 1137, 1137 (1996); Geoff Thompson, $40,000 4. Shannon Lafferty, California Internet Libel Awarded in First Cyberspace Defamation Case, Suit Yields Big Verdict, THE RECORDER [San Fran- AUSTRALIAN FIN. REV., May 4, 1994, at S41 (“unin- cisco], December 14, 2001, available in archive at hibited defamation is one of the things that makes www.law.com/california. cyberspace such a fun place to be”). Page 52 DEFENSE COUNSEL JOURNAL—January 2003 but it has yet to silence the defendants, brand name, and thus profitability.8 who continue to lambaste the company on Unbridled innuendo has broader, sys- their home page. The victory was bitter- temically corrosive consequences to soci- sweet and more or less pyrrhic.5 ety. It compromises meaningful dialogue. As a general proposition, civil libertar- Cloaked in anonymity and unencumbered ians would applaud this result. These activ- by editorial filters, almost anyone with a ists insist that the typical action to suppress computer can take to the Internet and share online discourse is frivolous. It serves only their convictions with the world at large. to harass, they say, and often offends con- This has the cumulative effect of gener- stitutional rights, including those to privacy ating massive amounts of conflicting and free speech.6 information, the credibility of which is Taken to its extreme, this rhetoric brings frequently beyond evaluation. The online David and Goliath into the digital age: marketplace of ideas becomes increasingly Corporations dig deep into their pockets to incoherent and in the final analysis pay for lawyers whose tactics aim to in- struggles to fulfill what should be its cen- timidate and ultimately muzzle computer- tral role: an arena in which competing savvy but underfinanced critics.7 Whatever ideas collide, but out of which the truth facial appeal it may have, such hyperbole eventually emerges. cannot withstand closer scrutiny. To urge What are the theories of liability that that corporate America seeks only retribu- corporate plaintiffs may enlist to combat tion when it pursues scandalmongers is to cybersmear campaigns? What are the pros ignore certain economic realities and and cons of bringing suit? What are the policy concerns. alternatives to litigation? What preventive When broadcast over the Internet, defa- measures are there to reduce both the inci- matory speech sometimes causes substan- dence and the impact of digital defama- tial monetary losses, especially for publicly tion? traded companies. Stock prices can fluctu- ate wildly; their movement is a function of THEORIES OF LIABILITY information or, as the case may be, misin- While purveyors of fibbery are sued formation. Cyberlibel can manifest itself time and again for defamation, other not only as personal potshots that bruise causes of action can lie against them. De- egos, but also as institutional slurs that pending on the facts, they might be pros- move markets. Companies that try to curb ecuted for, among other things, violating the dissemination of misinformation are securities laws, breaching contracts, or di- improperly cast as corporate bullies. Quite luting intellectual property. In any event, the contrary. These companies are honor- affected businesses should appreciate that ing their obligation to shareholders to at- their options are not necessarily limited to tend to matters that jeopardize reputation, classic theories of defamation.

5. See the following stories, all in THE RECORDER Lawsuits Against Public Participation, 25 SEATTLE by Shannon Lafferty and all available in archive at U.L. REV. 213 (2001); Bruce P. Smith, Cyber- www.law.com/california: Defendants Not Nice in smearing and the Problem of Anonymous Online Internet Case, November 6, 2001; No Easy Outs Speech, COMM. LAW. 3 (18-Fall 2000). Seen in Suit for Internet Libel, December 12, 2001; 7. See, e.g., Jeffrey R. Elkin, Cybersmears: The Judge Silences Ravings of Angry Ex-employees, De- Next Generation, 10 BUS. L. TODAY 42 (August cember 13, 2001; Web War of Words Drawing More 2001). Hits, March 26, 2002; Contempt Hearing Set in 8. See generally Werner F.M. De Bondt & Rich- Internet Libel Case, March 27, 2002; Court Issues ard H. Thaler, Does the Stock Market Overreact? 40 Stay in Case over Web Defamation, April 18, 2002; J. FIN. 793 (1985); Wayne Joerding, Are Stock FBI Investigating Death Threats in Varian Libel Prices Excessively Sensitive to Current Information? Case, August 1, 2002. See also www.geocities.com/ 9 J. ECON. BEHAV. & ORG. 71 (1988); Mark J. Roe, mobeta_inc/slapp/slapp.html. The Shareholder Wealth Maximization Norm and In- 6. See generally Joshua R. Furman (Comment), dustrial Organization, 149 U. PA. L. REV. 2063, Cybersmear or Cyber-SLAPP: Analyzing Defama- 2065. tion Suits Against Online John Does As Strategic Cybersmear: A Primer for Corporate Victims Page 53

A. Defamation be expected to invoke libel, as opposed to slander, in online defamation cases.14 1. Libel or Slander This observation is hardly just an aca- There is a dearth of precedent as to demic one. It has practical and, for that whether electronic communications are matter, positive ramifications for corporate subject to the rules of libel, on the one victims of cybersmear. At common law, a hand, or of slander, on the other. Doctri- prima facie case of slander requires a nally, this issue turns—obviously enough greater quantum of proof. In particular, the —on whether such communications are slander plaintiff must demonstrate that more analogous to the printed or the spo- which the libel plaintiff need not: special ken word. damages, as distinguished from actual or The same issue confronted the legal general damages, or, stated differently, ac- community when radio and television first tual pecuniary harm.15 became popular. Initially, when broadcast- In a libel action, that is to say, plaintiffs ers read from scripts, libel provided the must establish only injury to reputation; rule of law, but when they spoke extempo- they need not go a step further and prove raneously, slander principles applied.9 Over resultant economic damages. The underly- time, courts “recognized the breadth of ex- ing rationale is that the relative perma- posure and resulting damage from broad- nence of the written word raises a pre- cast defamation was akin to published sumption of harm, whereas the ephemeral defamation, and began to apply libel stan- qualities of speech cannot occasion a simi- dards to broadcast defamation.”10 Today lar inference. television stations are considered publish- Modern jurisprudence, however, is in ers of libelous material, with limited ex- some instances collapsing the distinction ceptions to this rule,11 notwithstanding any between libel and slander. As a result, absence of a script.12 To the extent that the some states—most notably, New York— Internet is susceptible to classification, it have begun to require proof of special has evolved into an interactive blend of damages even when libel is the theory on print and broadcast media.13 Courts should which suit has been brought.16

9. LAURENCE H. ELDREDGE, THE LAW OF DEFA- Trimmer, 143 A.2d 1, 3 (N.J.Super. 1958), cert. de- MATION § 13, at 83 (1978). nied, 145 A.2d 168 (N.J. 1958). See also Susan 10. Anthony M. Townsend et al., Libel and Slan- Oliver, Opening the Channels of Communication der on the Internet, 43 COMM. OF THE ACM 15, 15- among Employers: Can Employers Discard Their 17 (June 2000). “No Comment” and Neutral Job Reference Policies? 11. California, for example, still adheres to the 33 VAL. U. L. REV. 687, 700 (1999) (harm or actual minority view, treating defamatory statements on injury presumed with written defamatory statements television and radio as slander. See generally CAL. because written statements are likely to be perma- CIV. CODE ANN. §§ 46, 48.5; Arno v. Stewart, 54 nent; slander plaintiff must prove special harm or Cal.Rptr. 382 (Cal.App. 1966). actual pecuniary loss). Accord ELDREDGE, supra 12. See Finley P. Maxson (Note), A Pothole in note 9, § 12, at 77; DAN B. DOBBS, THE LAW OF the Information Superhighway: BBS Operator Li- TORTS § 409, at 1144. ability for Defamatory Statements, 75 WASH. U. See also RESTATEMENT (SECOND) OF TORTS L.Q. 673, 676 n.13 (1997). § 569 (1977) (“One who falsely publishes matter 13. See, e.g., Julie Adams, Will Wage Gap Per- defamatory of another in such a manner as to make sist for Women in New Media? in Harvard Third the publication a libel is subject to liability to the Biennial Conference on Internet & Society, available other although no special harm results from the pub- at www.news.harvard.edu/net_news2000/06.02/ lication.”) wage.html (last updated June 2, 2000). 16. See, e.g., Boule v. Hutton, 138 F.Supp.2d 14. But some commentators suspect otherwise, 491, 506 (S.D. N.Y. 2001) (applying New York predicting that slander laws may ultimately control law). But inasmuch as it muddies the doctrinal wa- certain iterations of online defamation. See, e.g., ters of defamation, this trend has been the target of Karen S. Frank, Potential Liability on the Internet, some criticism. See, e.g., Mike Steenson, Defama- 437 PLI/Pat. 417, 437 (1996). tion Per Se: Defamation By Mistake? 27 WM. 15. See, e.g., Vanover v. Kansas City Life Ins. MITCHELL L. REV. 779, 809 (2000). Co., 553 N.W.2d 192, 197 (N.D. 1996); Stickle v. Page 54 DEFENSE COUNSEL JOURNAL—January 2003

Legal philosophy aside, the bottom line is narrowly defined and reaches only state- is clear: if cast in the role of defamation ments that cannot be proved false or that plaintiff, a corporation, whenever possible, cannot be reasonably interpreted as stating should proceed under a theory of libel actual facts about an individual.21 rather than slander. While in the final Because of this closely circumscribed analysis the former may prove only mar- definition, accused libelists cannot escape ginally easier to maintain, common sense liability by qualifying their defamatory ut- alone dictates that no advantage go terances with the caveat that they were unexploited. merely expressing opinions, rather than statements of fact. Accepting such super- 2. Libel Defenses ficial assurances at face value would elevate form over substance in an flourish Even though special damages are often of naïveté.22 As the First Circuit has put it, not a prerequisite to recovery, libel remains “to say ‘I think’ is not enough to turn fact a notoriously difficult cause of action to into opinion, where what is supposedly prosecute successfully,17 not because of a ‘thought’ is, or implies, a proposition of high prima facie hurdle, but because of a fact.”23 panoply of privileges and affirmative de- The question becomes: Under what cir- fenses that do not lend themselves to refu- cumstances will a statement, however tation.18 Figuring most prominently among unflattering, find refuge under cover of them is, of course, the First Amendment. opinion? Because libel cases are almost invariably fact-intensive, a satisfying answer a. Constitutional Privileges is difficult to come by. One federal judge (i) Opinion has ventured that a statement takes on the character of opinion “where it involves ex- Opinions are tantamount to ideas, the pressions of personal judgment, especially policing of which is rightly the province of as the judgments become more vague and neither judges nor juries. Opinions are of- subjective in character.”24 ten not actionable under a theory of libel,19 In effect, courts subscribe to that kernel but the U.S. Supreme Court has stressed of wisdom first inspired by bullies and that its decisions have stopped short of hatched in playgrounds: “Sticks and stones carving out a wholesale defamation ex- may break my bones, but names will never emption for “opinion.”20 Indeed, to the ex- hurt me.” While the adage is a simple one, tent it serves as a defense to libel, opinion

17. See, e.g., Bonheur v. Dresdner Bank, 1986 767192, at *5 (C.D. Cal.); Davis v. Ross, 754 F.2d WL 4702, at *2 n.2 (S.D. N.Y.); Lyrissa Barnett 80, 85 (2d Cir. 1985); Hotchner v. Castillo-Puche, Lidsky, Prying, Spying, and Lying: Intrusive 551 F.2d 910, 913 (2d Cir. 1977), cert. denied, 434 Newsgathering and What the Law Should Do About U.S. 834 (1977)). It, 73 TUL. L. REV. 173, 198 n.103 (1998). When set 20. Milkovich v. Lorain Journal Co., 497 U.S. 1, against the backdrop of the Internet, libel is further 18 (1990), rev’g and remanding 545 N.E.2d 1320 complicated by a host of knotty, extralegal concerns. (Ohio App. 1989). 18. See, e.g., Robert E. Drechsel, The Paradox of 21. See generally Philadelphia Newspapers Inc. Professionalism: Journalism and Malpractice, 23 U. v. Hepps, 475 U.S. 767 (1986), rev’g and remanding ARK. LITTLE ROCK L. REV. 181, 194-95 (2000); 485 A.2d 374 (Pa. 1984); Greenbelt Coop. Pub. James C. Goodale & Rex S. Heinke, Libel Litiga- Ass’n v. Bresler, 398 U.S. 6 (1970), rev’g and re- tion: Summary Judgment, 338 PLI/Pat. 137, 139 manding 252 A.2d 755 (Md. 1969); Old Dominion (1992); Kevin T. Peters, Defamation and the First Branch No. 469, Nat’l Ass’n of Letter Carriers v. Amendment: Recent Cases Emphasizing the Content Austin, 418 U.S. 264 (1974), rev’g 192 S.E.2d 737 of Defamatory Communications and the Nature of (Va. 1972); Hustler Magazine Inc. v. Falwell, 485 the Communicator, 20 SUFFOLK U. L. REV. 1089, U.S. 46 (1988), rev’g 797 F.2d 1270 (4th Cir. 1986); 1092 (1986). Milkovich, 497 U.S. 19. 19. Gertz v. Robert Welch Inc., 418 U.S. 323, 22. Cianci v. New Times Pub. Co., 639 F.2d 54, 339-40 (1974), rev’g and remanding 471 F.2d 801 64 (2d Cir. 1980) (7th Cir. 1072); Henry v. Nat’l Ass’n of Air Traffic 23. Gray v. St. Martin’s Press Inc., 221 F.3d 243, Specialists Inc., 836 F.Supp. 1204, 1214 (D. Md. 248 (1st Cir. 2000) (citations omitted). 1993); Gifford v. Nat’l Enquirer Inc., 1993 WL 24. Id. at 248. Cybersmear: A Primer for Corporate Victims Page 55 subsumed under it is an important lesson: concern will not be chilled by the threat of Corporate managers must recognize the litigation.”28 Such unabashed endorsement difference between the truly pestilent and of the marketplace of ideas harkens back to the merely vulgar and indecorous—the a landmark decision of the U.S. Supreme stuff that batters big egos, rather than big Court, New York Times Co. v Sullivan,29 in profits. Legal action properly presents it- which the Court held that public officials self as an option only with respect to the and figures may recover for defamatory former genus of online opprobrium. statements only when the statements are made with “actual malice”—that is, with (ii) Parody knowledge of their falsity, or with reckless disregard for the truth. Satire is everywhere, and perhaps due in Defining who are public figure, how- part to its prevalence, it frequently lies out- ever, is no easy task. At the risk of over- side the bounds of actionable defamation. simplification, it may be said that public “There is no libel,” according to one appel- figures typically hail from one of two fac- late court, where the “material is suscep- tions: those who “occupy positions of such tible of only non-defamatory meaning and persuasive power and influence that they is clearly understood as being parody [or] are deemed public figures for all purposes” satire.”25 That is not to say, however, that or those who “have thrust themselves to the comedian enjoys a license to defame. the forefront of particular public controver- What sets parody apart from other sies in order to influence the resolution of strains of humor is its essential character, the issues involved.”30 one of conspicuous “distortion and exag- Examples of the sorts of personalities geration. [L]ike the warped and curved that courts have classified as public figures mirrors in a carnival fun house, it depends include political activists, candidates for upon the grotesque for its effects.”26 Stated office and even football coaches who be- differently, parody can be mistaken for come state university athletic directors.31 nothing else, and its satirical nature is im- Natural extensions of these examples mediately self-evident. For that reason, a would include executives at major corpora- parody necessarily cannot “defame . . . by tions who become ensnarled in controver- false attribution or presentation of false sies implicating matters of public concern. facts.”27 Take, for instance, Bill Gates, founder of Corporate executives must recognize software giant Microsoft. His antitrust de- that they and their companies may become bacle with the Justice Department has fodder for satirists whose work appears on transformed him into the archetypal public web pages, in discussion groups, or in chat figure, perhaps explaining why he has be- rooms. This bothersome reality is best come a favorite subject for editorial car- viewed as a cost of doing business, rather than a reason to retain counsel. Although it is frustrating to be the butt of a joke built on hyperbole or tall talk, the law simply 25. Salek v. Passaic Collegiate Sch., 605 A.2d offers little relief to those whose only com- 276, 278 (N.J.Super. 1992), citing Romaine v. plaint is that they have been reduced to Kallinger, 537 A.2d 284, 288 (N.J. 1988). 26. Salomone v. MacMillan Pub. Co., 411 caricatures. N.Y.S.2d 105, 109 (Sup.Ct. N.Y. County 1978). 27. See, e.g., San Francisco Bay Guardian Inc. v. (iii) Public Figures Superior Ct. (Sparks), 21 Cal.Rptr.2d 464, 467 (Cal.App. 1993). Commenting on the debate surrounding 28. Goetz v. Kunstler, 625 N.Y.S.2d 447, 453 (Sup.Ct. N.Y. County 1985). the highly publicized shootings of four 29. 376 U.S. 254 (1964). teenagers in a Manhattan subway, a New 30. Gertz, 418 U.S. at 345. York judge opined that it “is a paramount 31. See generally Curtis Pub. Co. v. Butts, 388 U.S. 130 (1967), aff’g 351 F.2d 702 (5th Cir. 1965); interest of a free society to assure that open Monitor Patriot Co. v. Roy, 401 U.S. 265 (1971), and spirited discussion of matters of public rev’g and remanding 254 A.2d 832 (N.H. 1969). Page 56 DEFENSE COUNSEL JOURNAL—January 2003 toonists whose works are scattered far and in lawsuits brought primarily to chill the wide across the Internet. valid exercise of the constitutional right of Gates—or, for that matter, anyone simi- freedom of speech,” the legislation requires larly situated—could proceed against his libel plaintiffs to establish a likelihood of critics only with great difficulty, since they success on the merits before trial. Should could almost certainly avail themselves of they fail to make this showing, they subject the heightened actual malice standard. Per- their defamation claims to a special motion haps more important, for a public figure to to strike, which generally will succeed if initiate a libel action is often to ignite a the challenged statements amount to acts in public relations nightmare. furtherance of the right of “petition or free Besides, litigation is not necessarily the speech,” which are defined as, among other most effective solution for a prominent things, “statement[s] or writing[s] made in persona. Abraham Lincoln said that “truth a place open to the public or a public is generally the best vindication against forum in connection with . . . issue[s] of slander.” In this respect, “public figures public interest.” usually enjoy significantly greater access Referring to this language, a California to the channels of effective communication appellate court ruled that Internet discus- and hence have a more realistic opportu- sion groups about the management of pub- nity to counteract false statements then pri- licly held companies are “open and free to vate individuals normally enjoy.”32 Since anyone who wants to read” them, are rel- both the courts and the public at large are evant to matters of public interest, and are keenly aware of this imbalance in power, thus “public forums” for purposes of the the corporate behemoth that accuses a legislation. The court then recognized a single, vociferous individual of defamation range of comments from one such discus- may appear to be using the law not as an sion group as “disparaging” but nonethe- instrument of justice, but instead as a tool less non-actionable.34 of coercion. At least a dozen other jurisdictions—including New York, Massachusetts and 2. Common Law and Statutory Florida—have enacted similar statutory Defenses schemes.35 Legislators have not ignored the public perception that, through predatory a. Anti-SLAPP Legislation litigation tactics, big business sometimes Home to Silicon Valley and its hotbed of exploits the power and resources it has. Be- Internet start-ups, California has erected a fore dragging cyberlibelists into court, heightened barrier to recovery for online large corporate entities should be certain defamation—the Strategic Lawsuit Against that their claims are not just legally cogni- Public Participation Act, conveniently zable, but also are compelling, persuasive known by the acronym SLAPP.33 On a leg- and meritorious. Otherwise, libel defen- islative finding that “a disturbing increase dants may reach up their sleeves for an

32. Gertz, 418 U.S. at 344. CODE ANN. § 9-11-11.1 (Supp. 1997); IND. CODE 33. CAL. CIV. PROC. CODE § 425.16. ANN. §§ 34-7-7-1 to 34-7-7-10 (West Supp. 1998); 34. ComputerXpress Inc. v. Jackson, 113 Cal. LA. CODE CIV. PROC. ANN. art. 971 (West 1999); Rptr.2d 625 (Cal.App. 2001) (company became mat- ME. REV. STAT. ANN. tit. 14, § 556 (West Supp. ter of public interest merely because it was “publicly 1997); MASS. GEN. LAWS ANN. ch. 231, § 59H traded company” and “had inserted itself into the (West 1997); MINN. STAT. ANN. §§ 554.01-554.05 public arena by means of numerous press releases”). (West Supp. 1997); NEB. REV. STAT. §§ 25-21,241 The posted comments were far from innocuous and to 25-21,246 (1995); NEV. REV. STAT.. §§ 41.640- included the abrasive likes of the following: “When 41.670 (Supp. 1993); N.Y. C.P.L.R. § 3211(g) the people who have . . . been duped into this stock (McKinney 1997-1998); OKLA. STAT. ANN. tit. realize the scam they were coaxed into, my guess is 12, § 1443.1 (1999); R.I. GEN. LAWS §§ 9-33-1 to 9- there will be hell to pay.” 33-4 (Supp. 1996); TENN. CODE ANN. §§ 4-21-1001 35. DEL. CODE ANN. tit. 10, §§ 8136-8138 (Supp. to 4-21-1003 (1997); WASH. REV. CODE ANN. 1996); FLA STAT. ANN. § 768.295 (West 2000); GA. §§ 4.24.500-4.24.520 (West Supp. 1997). Cybersmear: A Primer for Corporate Victims Page 57 anti-SLAPP statute, use it to cast them- of subscribers had open access. The court selves in the role of David and garner the held that the Wisconsin retraction statute sympathy that courts often afford the un- did not apply to bulletin board postings be- derdog. cause they do not constitute a “publication” according to its ordinary meaning. b. Retraction Statutes In the end, corporate victims of cybersmear, if they elect to pursue their harass- Ordinarily, the public retraction of a li- ers in court, usually can dispense with con- belous statement does not defuse liability cerns over retraction statutes—at least with but does mitigate damages.36 While histori- respect to the merits of their cases. Even cally a function of common law, this prin- when retraction laws are facially inappli- ciple today is embedded in so-called “re- cable to non-media defendants, badmouths traction statutes,” which provide that the who voluntarily forswear their words still timely renunciation of defamatory declara- can insulate themselves from liability, al- tions will serve to limit damages, usually to beit not completely, because, however mo- those for actual harm.37 tivated, retractions will tend to breed evi- For purposes of online defamation, how- dence of good faith and thus mitigate ever, retraction statutes may offer little or damages.40 no shelter to average defendants, who often are individuals, acting alone or in collabo- c. Statutes of Limitations ration with a few friends, and who spread their word on electronic bulletin boards, in The limitations period for a libel claim Internet chat rooms and on independent customarily begins to run upon the publica- web sites. Retraction statutes typically tion of the purportedly libelous material. reach members of the media, to the exclu- Establishing the date of publication for li- sion of all other classes of libel defen- bel appearing in a book, newspaper or dants.38 magazine is a relatively straightforward A widely cited decision from the Wis- task. The same cannot be said of libel that consin Court of Appeals illustrates this. In manifests itself on the Internet. It’s in the Cards Inc. v. Fuschetto,39 the The dynamic nature of the online com- court held that a trial judge had erred by munity is to blame—or, as some may see granting summary judgment to the defen- it, credited—for this difficulty. Unlike dant, on the grounds that the plaintiffs had those memorialized on paper and in ink, never demanded a retraction pursuant to a messages broadcast on the Internet can state statute. Rosario Fuschetto, the defen- propagate at truly exponential rates. This dant, had made a series of allegedly defa- robust proliferation is attributable to a vari- matory statements about the plaintiffs, a ety of causes, so-called “hypertext” per- sports memorabilia store and its owner. haps the most prominent among them. Fuschetto posted his statements on an elec- Hypertext lies at the heart of the Internet tronic bulletin board to which a community and the programming language—hypertext

36. See, e.g., ROBERT D. SACK. LIBEL, SLANDER chusetts, Nebraska, Texas, and West Virginia apply AND RELATED PROBLEMS § V.5.1.1 at 211 (1980). their statutes to all defendants.” 37. See, e.g., CONN. GEN. STAT. ANN. § 52-237 39. 535 N.W.2d 11 (Wis.App. 1995). (West 2002); NEB. REV. STAT. § 25-840.01 (2001). 40. Jonathan D. Hart et al., Cyberspace Liability, Some jurisdictions go so far as to make a request for 523 PLI/Pat. 123, 163 (1998). retraction a condition precedent to filing a libel suit. 41. Matisse Enzer, Glossary of Internet Terms, FLA. STAT. ANN. § 770.01 (West 2001). available at www.matisse.net/files/glossary.html#H 38. In Hinerman v. Daily Gazette Co., 423 S.E.2d (updated February 24, 2002). See also www.netdic- 560, 595 n.21 (W.Va. 1992), Miller, J., dissenting, tionary.com/html/h/html, which defines html as noted different statutes and stated: “California, for “[t]ext that includes links or shortcuts to other docu- example, follows the majority approach and provides ments, allowing the reader to easily jump from one only for certain media defendants in its retraction text to related texts, and consequentially from one statute, while Connecticut, Louisiana, Maine, Massa- idea to another, in a non-linear fashion.” Page 58 DEFENSE COUNSEL JOURNAL—January 2003 markup language, commonly referred to as d. Insulated ISP HTML—that gives it interactive life. At Deep corporate pockets are on the short the risk of oversimplifying matters, hyper- list of defendants in just about any tort ac- text has been defined as “any text that con- tion. Libel claims are no different. Unlike tains links to other documents—words or print media giants, however, Internet phrases in the document that can be chosen by a reader and which cause another docu- heavyweights can often find asylum from ment to be retrieved and displayed.”41 defamation in a unique array of defenses. Since ramping onto the Internet has be- In this way, libel plaintiffs inevitably face come an inexpensive proposition, the likes uphill, if not impossible, battles when of hypertext and the complex network of matched against the likes of America interconnectivity that it inspires can trans- Online, Yahoo! and other web portals and form a person’s keystrokes into gospel for internet service providers (ISPs). the masses. Among the most potent of these de- Aside from its practical implications, fenses is the Communications Decency Act hypertext raises jurisprudential concerns of 1996 (CDA), 47 U.S.C. § 230 et seq. Enacted to overrule a decision of a New over the time at which claims for cyber- 43 libel accrue. “Under the single publication York trial court, the CDA states that “no rule,” one commentator has written, “a provider or user of an interactive computer cause of action accrues at the time of the service shall be treated as the publisher or original publication; therefore, subsequent speaker of any information provided by an- shipments and . . . reprintings of the same other information content provider.” This edition of the work do not extend the date.” Good Samaritan provision, as it is fre- But, at the same time, “reprintings of a quently called, has been construed to book in a new edition . . . will usually con- largely immunize the ISP industry against stitute a new publication of the libel.”42 defamation lawsuits. 44 While application of these rules is In Zeran v. America Online Inc., for simple enough for print media, their exten- example, a Virginia federal district court sion to the digital frontier is awkward. The refused to hold America Online (AOL), the fundamental nature of the World Wide largest ISP in the United States, account- Web—and the billions, if not trillions, of able for a series of profoundly distasteful hypertextual links populating it—blur the messages that one of its users had posted to distinctions between reprinting and subse- an AOL bulletin board. The messages ad- quent editions. To date, the courts have of- vertised tee shirts containing slogans that fered next to no guidance on this issue. joked about the 1995 bombing of the fed- While this is sure to change over time, libel eral building in Oklahoma City. Worst of plaintiffs must for the moment arm them- all, the name and telephone number of the selves only with the knowledge that de- plaintiff, Zeran, were included in the mes- fenses based on limitations periods may sages, although he had absolutely nothing present issues of first impression that re- to do with them. He was inundated with a quire creative argumentation rather than barrage of harassing telephone calls, a extensive reliance on existing precedent. number of them threatening his life. Alleging that it failed to take timely steps to delete the messages and to cancel 42. Elizabeth A. McNamara, A Selective Survey the account of the offending user, the of Current Issues Facing Book and Magazine Pub- plaintiff sued AOL for his monetary loss lishers, 601 PLI/Pat. 9, at 45 (2000). and emotional suffering. Laboring under 43. Stratton-Oakmont Inc. v. Prodigy Servs. Co., 1995 WL 323710 (N.Y. Sup.Ct. Nassau County) the express terms of the CDA, the district (defendant liable for statements that one of its sub- court was all but obligated to reject his scribers posted on electronic message board over claim pursuant to a theory of statutory im- which it exercised some editorial control). 44. 958 F.Supp. 1124 (E.D. Va. 1997), aff’d, 129 munity. F.3d 327 (4th Cir. 1997). The legal hurdles to prosecuting an ISP Cybersmear: A Primer for Corporate Victims Page 59 for the defamatory remarks of its users just their payrolls. Of course, shrewd em- carry dire consequences for the cyberlibel ployees—versed in the contractual prohibi- plaintiff. Because of the inherently anony- tions to which they are subject—can skirt mous character of the Internet, to try to the edges of confidentiality agreements, for identify an online defamer may be to instance, by carefully eschewing references attempt the impossible.45 So with ISPs to trade secrets, proprietary data and re- shrouded in statutory protections and lated varieties of sensitive information. libelists cloaked in anonymity, parties ag- Dissatisfied employees who grumble, grieved by cybersmear may be left with gripe and grouse over the Internet also may fingers, but with nowhere to point them. violate provisions embedded in employment manuals or other internal company B. Collateral Theories of Liability policies. Several legal commentators have alluded to this possibility,48 which presum- Although defamation is the most obvi- ably would at a minimum help justify the ous theory on which cybersmear plaintiffs discharge of refractory employees. may rely, creative litigants can sometimes turn to other causes of action in their pur- 2. Securities Laws and Business Torts suit of online irritants. In this realm, however, the law is in the throes of infancy and Transmitted via the Internet, false or thus remains a necessarily scant and often otherwise misleading reports about a com- unsettled lot. pany, especially those opining on its financial stead or its business prospects, can 1. Employment Relationship wreak immediate and sometimes irrevers- ible havoc. When this happens, affected Unhappy, disgruntled current and former companies should look beyond defamation employees comprise a common class of law to vindicate their rights. In Hart v. cyberlibelists.46 Armed with inside infor- Internet Wire Inc.,49 for example, a former mation, office gossip and axes to grind, employee of the defendant news wire con- they have used the Internet to launch at- cocted a phony press release about Emulex tacks against corporate entities big and Corp. After short selling large blocks of small. Sometimes, these offensives are not Emulex stock, he sent the release to defamatory but are in derogation of con- Internet Wire, which then published it. The tracts attendant to the employment rela- bogus release subsequently was redistrib- tionship. uted by Bloomberg News, another but The execution of a confidentiality or much larger news service. Predictably, the nondisclosure agreement is becoming an price of Emulex stock plunged to $60 a increasingly standard term of employment, share in just 15 minutes. especially in high-tech industries.47 When The plaintiff sued under color of federal drafted broadly enough, they can endow law, alleging that both Bloomberg and employers with an instrument to silence Internet Wire had run afoul of Section detractors who are a drain on more than 10(b)(5) of the Securities Exchange Act of

45. See Nancy Toross (Note), Double-Click on 46. See, e.g., Peter Schnitzler, Web Attacks Tough This: Keeping Pace with On-Line Market Manipula- to Stop, INDIANAPOLIS BUS. J., May 6, 2002, at 19; tion, 32 LOY. L.A. L. REV. 1399, 1419 (1999) (one Stephanie Armour, Courts Frown on Online Bad- can “hide his or her identity on the Internet and make mouthing; Grousing Ex-workers Lose Legal Battles, statements on an anonymous or false basis, thus USA TODAY, January 7, 2002, at B01. making it difficult to identify and prosecute”); 47. See, e.g., Carole Levitt, Computer Counselor, Shahram A. Shayesteh (Comment), High-Speed L.A. LAWYER, October 2000, at 62. Chase on the Internet Superhighway: The Evolution 48. See, e.g., Tonianne Florentino, Privacy in the of Criminal Liability for Internet Piracy, 33 LOY. Ever-evolving Workplace, 632A PLI/Pat. 453, 463- L.A. L. REV. 183, 193-94 (1999) (discussing various 65 (2001). means by which Internet users can hide their true 49. 145 F.Supp.2d 360 (S.D. N.Y. 2001). identities). Page 60 DEFENSE COUNSEL JOURNAL—January 2003

1934. Although the plaintiff later suc- about the quality and reliability of its ser- cumbed to a motion to dismiss, his claim vices.52 AOL might argue that its distinc- failed only because neither defendant had tive insignia, which it promotes at an an- published the fictitious press release with nual cost in the millions,53 is diluted when the requisite scienter—that is, an intent to positioned beside an array of denigrating defraud or with fraudulent intent. comments. Under slightly different facts, in other Trademark dilution is actionable under words, the plaintiff could have successfully 15 U.S.C. § 1127, which defines it as the prosecuted his 10(b)(5) claim. In fact, rec- “lessening of the capacity of a famous ognizing the vast potential for the manipu- mark to identify and distinguish goods or lation of stock prices through online em- services, regardless of the presence or ab- broidery, the Securities and Exchange sence” of competition among the parties or Commission has established an Office of any likelihood of confusion. Dilution can Internet Enforcement, which employs manifest itself in two ways: through “blur- about 60 attorneys “who devote substan- ring,” when a mark is attributed to goods tially all of their time to [the] detection and or services neither produced nor delivered investigation of fraud on the Internet.”50 by the trademark owner, or through The plaintiff might also have brought a de- “tarnishment,” when a mark is enlisted so rivative action against the author of the as to taint or debase it.54 press release for, among other things, com- Dilution claims, unlike those for trade- mercial disparagement, sometimes known mark infringement, can succeed without as trade libel,51 and tortious interference first establishing any likelihood of confu- with business relations. sion. Instead, plaintiffs need only show that So, while it may generally be the most the mark is famous and that the defendant apposite, libel is not necessarily the only is blurring its distinctiveness or tarnishing theory of liability that can ensnare digital its prominence through some commercial defamers. application.55 Since this standard obviously differs from that for libel, a dilution claim, 3. Intellectual Property depending, of course, on the facts, may present itself as an alternative means of When corporations are derided online, proceeding against a libel-proof plaintiff. their intellectual property is frequently implicated. Often, their trademarks are co- TO SUE OR NOT TO SUE opted, inextricably entwined in defamatory speech. By way of example, one web So much for theory. The question is no site—aolsucks.org—depicts the strangula- longer how to sue, but whether to do so at tion of a cartoon figure whose head bears a all. If the answer is yes, corporate plaintiffs striking resemblance to the AOL logo and should recognize the inevitable extralegal its familiar triangular design. Surrounding consequences and understand how to neu- the image is a collection of caustic anec- tralize them. And, if the answer is no, the dotes about the company and particularly savvy lawyer will be attuned to and pre-

50. Thad A. Davis, A New Model of Securities 53. See, e.g., Beth Healy, Former Thomson Fi- Law Enforcement, 32 CUMB. L. REV. 69, 85 (2001- nancial Chief Resurfaces at Web Firm, BOSTON 02). GLOBE, May 21, 2000, at C5. 51. Picker Int’l v. Leavitt, 865 F.Supp. 951, 964 54. See generally I.P. Lund Trading ApS & Kroin (D. Mass 1994) (noting that Section 623A of the Inc. v. Kohler Co., 163 F.3d 27 (1st Cir. 1998); Restatement (Second) of Torts defines “commercial Intermatic Inc. v. Toeppen, 947 F.Supp. 1227 (N.D. disparagement” as a false statement intended to Ill. 1996); Hasbro Inc. v. Internet Entertainment bring into question quality of rival’s goods or ser- Group Ltd., 40 U.S.P.Q.2d 1479 (W.D. Wash. vices in order to inflict pecuniary harm). 1996); Toys ‘R’ Us v. Akkaoui, 1996 U.S.Dist. 52. See AOL Watch—Updated Daily! available at LEXIS 17090 (N.D. Cal.). www.aolsucks.org/aolwatch27b.htm (visited May 55. See, e.g., Ian C. Ballon, Litigation Trends in 27, 2002). Internet Disputes, 691 PLI/Pat. 245, 294-96 (2002). Cybersmear: A Primer for Corporate Victims Page 61 pared to implement any number of alterna- generate bad press for the plaintiff compa- tives to litigation. nies, the limelight also can illuminate a blunt message: Proceed at your own risk. A. The Pros Because the anonymity of the Internet wid- ens comfort zones even for the ordinarily The advantages to combating corporate risk-averse, it may be incumbent on corpo- cybersmear through litigation are two-fold. rate America to remind the public that torts On one hand, there are upsides that exist are no less actionable when committed on on a purely legal plane. At the same time, the Internet. formal proceedings can occasion a range of From a broader perspective, cybersmear positive, extralegal effects. They can, for has palpable systemic effects that threaten example, sponsor larger, systemic values the very evolution of the Internet. While it and, not least of all, act as a visible and serves as a vehicle for entertainment and powerful deterrent for aspiring libelists. other varieties of lighter fare, the Internet is As an altogether legal matter, successful first and foremost a mechanism for gather- online defamation claims serve at least two ing and disseminating information. In this ends. First, they promote finality. By seek- sense, it was dubbed the “Information Su- ing appropriately broad injunctive relief, perhighway” because of its unique poten- plaintiffs can rest somewhat easier know- tial for delivering knowledge to popula- ing that if detractors succumb during litiga- tions everywhere. Since information and tion but later resurface, emboldened anew, power go hand in hand, if the Internet is they will already have an equitable judg- impaired in its ability to share the former ment in hand. Unburdened by any thresh- with the world at large, its role as the great old inquiries into liability, aggrieved cor- equalizing force of the new millennium porations can focus on enforcement alone, will be compromised. and thus bring a more rapid end to their Inasmuch as its essence borrows from problems. that of a program of misinformation, Second, a victory on the merits can cybersmear hampers public discourse that establish valuable precedent. Because is truthful, ingenuous and thus meaningful. Internet libel is in its formative stages, vis- Veiled in anonymity and emancipated from ible companies subject to public scrutiny editorial oversight, anyone with access to might be wise to shape the doctrines devel- the Internet can spread deceptive propa- oping around cyberlibel in ways consonant ganda around the globe. This might have with their best interests. Otherwise, lobbies the over-all effect of spawning vast bodies on the opposite side of the aisle—the of conflicting information, the reliability of American Civil Liberties Union, the Digi- which often cannot be assessed. In this tal Freedom Network and the Electronic way, the Internet may be infected with Privacy Information Center, to name but a falsehoods that will never be identified as few—may make a point of getting in on such in the online marketplace of ideas. the ground floor. By undertaking the de- Companies that take cyberlibelists to fense in the early waves of cases, they may task will work toward eliminating this dy- set the sort of speech-protective precedent namic, and will thus do their part, however that elevates personal freedoms over the small, to contribute to the public good. right to seek redress of reputational wrongs in a court of law. B. The Cons Extralegally, corporations emerging vic- torious from cyberlibel suits can generate Taking to the courts in pursuit of digital disincentives for armchair malingers who mudslingers is not without its fair share of harbor disparaging thoughts, but have yet distinct disadvantages. The biggest concern to graft them onto some Internet outpost is that a lawsuit will simply exacerbate the for mass consumption. While any publicity visibility and thus the impact of the alleged surrounding online defamation cases may defamation. Page 62 DEFENSE COUNSEL JOURNAL—January 2003

In particular, so-called “backlash” web- tainty of litigation marching at the head of sites can be nightmares; recall the plight of the pack. Corporate executives should be Varian Medical Systems. Although the sure to put fiscal realities before their own company won a series of legal victories, it pride. To be attacked is not necessarily to thereby aroused the wrath of two past em- suffer any genuine harm. Put another way, ployees whom it had accused of libel. In ego has no place in the process of deciding time, making matters even worse, the back- whether libelous statements threaten the lash website gave rise to several collateral sort of damages which would warrant the complications: republishing and a new time and expense of litigation. phenomenon sometimes known as “spam- Each of the following, however, are dexing.” among the many other factors properly put As its name suggests, republishing refers into the balance when exploring the expe- to the distribution of libelous statements dience of initiating legal action: the poten- through an outlet other than the original tial impact on public image, especially the host. Such secondary outlets are usually perception of the plaintiff as a monied cor- members of the media. Spamdexing, a porate tyrant; the consequent costs of re- nouveau term of art, pertains to “a modern medial public relations initiatives; and, fi- variant on long-utilized systems of key- nally, the difficulties in identifying and word indexing.”56 Specifically, the process later satisfying a cash judgment against an involves the abuse of “meta tags”—words individual defendant who is swathed in and phrases transparently implanted in web anonymity but not in wealth. pages to facilitate their indexing by search engines.57 C. Alternatives to Litigation Apparently through the manipulation of meta tags, the Varian defendants It should come as no surprise that busi- were able to raise the profile of their web- nesses affected by cybersmear can vindi- site on popular search engines Yahoo! and cate their rights through means other than Google. Of the more than 10,800 destina- litigation. The most common and often the tions containing the phrase “Varian Medi- simplest and most effective approach is a cal Systems,” the site operated by the de- cease-and-desist letter. Because the Inter- fendants was listed third, directly beneath net is a virtual costume ball—with the an official Varian home page.58 identities of its millions of guests hidden Because spamdexing can be so effective, behind masks of an intangible sort—the the reach of backlash sites should not be perceived anonymity of online speech lulls underestimated: If properly coded, they many into a false sense of invincibility. will not necessarily wallow in obscurity. When the mythology of unassailability is A parade of other drawbacks can follow shattered on receipt of a sternly worded let- the decision to file suit, the cost and uncer- ter from an attorney, the average muck- raker is quick to apologize and retract the causidical statements. 56. Ira S. Nathanson, Internet Inflogut and Invis- Taking coordinated, cooperative action ible Ink: Spamdexing Search Engines with Meta with the appropriate ISP is a second possi- Tags, 12 HARV. J.L. & TECH. 43, 47 (1998). 57. See, e.g., DON SELLERS, GETTING HITS: THE bility. Ordinarily, web surfers are required, DEFINITIVE GUIDE TO PROMOTING YOUR WEB SITE even if only impliedly, to consent to certain 22 (1997). 58. Search results for Varian Medical Systems, at terms of use before logging onto the http://google.yahoo.com/bin/query?p=Varian+ Internet or viewing a home page.59 The Medical+Systems&hc=1&hs=1 (visited June 2, Microsoft Network, for instance, 2002). 59. Yahoo! is a perfect example. Its terms of ser- reserves the right at all times to disclose any vice emphasize, “Yahoo provides its service to you, information as Microsoft deems necessary to subject to the following Terms of Service . . . which may be updated by us from time to time without satisfy any applicable law, regulation, legal notice to you.” Available at http://docs.yahoo.com/ process or governmental request, or to edit, info/terms (visited June 3, 2002) (emphasis added). refuse to post or to remove any information Cybersmear: A Primer for Corporate Victims Page 63

or materials, in whole or in part, in Micro- had bought an espresso machine from cof- soft’s sole discretion.60 fee giant Starbucks. Apparently, the ma- The effect of such language is to imbue chine was defective, and Starbucks never service providers with the unilateral au- sent Dorosin the complimentary coffee that thority to regulate their domains as they was to accompany his purchase. When see fit. And, while the typical ISP is immu- Starbucks refused his demand that it re- nized against liability for the statements of place the broken machine with one costing its users, no one likes trouble. From this thousands of dollars more, Dorosin took perspective, a corporation portrayed in a out a full-page spread in the Wall Street patently offensive light may discover that Journal. The advertisement invited readers the ISP, which hosts the objectionable con- to voice their complaints about Starbucks tent or user, prefers to delete the material by calling a toll-free number that Dorosin summarily or revoke the membership of had established, or by visiting “starbucked. the offender, rather than risk entanglement com,” a website that also included a de- in litigation.61 tailed account of his problems with the cof- 62 Another option, albeit a riskier one, is to fee company. counteract cyberlibelists with a dose of The advice to glean from the foregoing their own medicine. By publicly respond- episode should be obvious. Preemptively ing to them in their own forum, a defamed register unflattering domain names that co- company can try to set the record straight. opt your corporate identity. Purchase Defusing and discrediting revilers on their Internet addresses in bulk; they can be had own turf has the added advantage of com- on the cheap. Especially for large, publicly municating with the same general audience held companies, the annual cost will be de to which the tortfeasor first appealed. The minimis. downside, however, is that the calumnia- Next consider that the unseen enemy is tors may be provoked into intensifying bad enough, but that the unknown enemy is their crusades. Should this occur, company even worse. Accordingly, businesses must officials are left with two choices, both un- devise some means of monitoring the enviable: continue the dialogue, which Internet for defamatory materials concern- could rapidly degenerate into an obtuse ing them, their products and services, as slugfest; or, withdraw from the exchange, well as their individual officers, directors which can smack of giving up or, even and key employees. All but the largest enti- worse, of conceding the truth of the objec- ties will be best served by outsourcing this tionable statements. responsibility to any of the growing num- Last, a company may do nothing as an ber of third-party services that specialize in external matter, while at the same time tak- scouring the web for derogatory references 63 ing internal steps to lay the foundation for to their corporate clients. litigation. To this end, it must preserve some evidence of the offending statements. 60. Available at http://privacy.msn.com/tou (last Given the temporary nature of Internet modified March 2002) (emphasis added). Weighing content, the aspersive language inherently in at a total of nearly 9,000 words, the MSN terms of will lack permanence, and it should be use span some 25, single-spaced pages. 61. See, e.g., Ronald F. Lopez, Corporate Strate- documented to prepare for future legal ac- gies for Addressing Internet “Complaint” Sites, 14 tion. INT’L L. PRACTICUM 101, 104 (2001). 62. Id. 63. eWatch L.L.C. is perhaps the leading such D. Corporate Pre-emptive Measures service. Information about it is available at http:// ewatch.com/about_ewatch.html (visited June 3, Although it may be impossible to elimi- 2002) (describing a range of corporate intelligence nate them entirely, both the incidence and solutions). Another prominent member of this bur- the impact of cybersmear can be lessened geoning “cottage industry” is Connecticut-based CyberAlert Inc. See Shaun B. Spencer, CyberSLAPP by taking certain precautions. First con- Suits and John Doe Subpoenas, 19 J. MARSHALL J. sider the story of one Jeremy Dorosin, who COMPUTER & INFO. L. 493, 494 n.9 (2001). Page 64 DEFENSE COUNSEL JOURNAL—January 2003

Third, the prudent company will plan greater extent during the work day. Woe- now for what has yet to come. Vicious ru- fully behind the times is any modern busi- mors can materialize on the Internet out of ness that has yet to promulgate and enforce nowhere, and will sometimes spread like stringent company policies for the use of wildfire. If it becomes necessary to under- electronic mail and of the Internet gener- take some form of damage control, a con- ally. tingency plan—or the lack thereof—may While some employees will inevitably mean the difference between the effective break the rules, others at least will reflect and the feckless response strategy. Caught on them and think twice before using an off guard, a firm layered in bureaucracy office computer to speak out against their may struggle to first formulate and then ex- employer. With such policies in place, ecute a rapid, but still measured rejoinder. transgressive employees also may subject Last, a timeless truth deserves repeating. themselves unwittingly to liability not only Those closest to us sometimes hurt us in tort, but also in contract. most. For present purposes, the sentiment is intended to underscore the fact that cor- CONCLUSION porate cyberlibel recurrently comes from To call the Internet a new frontier is by within.64 Although employers can exercise now a misnomer. Its reach is global, its little or no control over the after-hours ac- content consumed by billions, and almost tivities of their employees, vigilant compa- anyone with a computer can tap its power. nies can regulate behavior to a much The Internet is becoming a bully pulpit from which the disgruntled broadcast their frustrations to the world at large. 64. See, e.g., Matthew S. Effland, Digital Age Squarely in their crosshairs—much like Defamation, 75 FLA. B.J. 63, 63-64 (2001) (observ- politicians, celebrities and other magnets ing that damaging comments made by disgruntled employees about company business practices is not for public attention—will be corporations new phenomena, but suggesting that Internet has the world over. Because that much is inevi- magnified problem); Daniel P. Schafer (Note), table, companies today must understand Canada’s Approach to Jurisdiction over Cybertorts, 23 FORDHAM INT’L L.J. 1209-10 (2000) (“Since the intricate contours of the problem, ap- [Internet] bulletin boards provide an easy and inex- preciate both their legal and extralegal op- pensive way for a speaker to reach a large audience, tions, and prepare themselves—now, rather disgruntled . . . employees have used them to voice their concerns over a company, regardless if the than later- for the trouble that will eventu- complaints are justified.”) (footnote omitted). ally come knocking. The Privacy Project Between the Devil and the Deep Blue Sea: Monitoring the Electronic Workplace

Employers should have detailed, understandable and fair computer, e-mail and Internet usage policies impartially administered

The evil that men do lives after them; The good is oft interred with their bones; IADC member William G. Porter II is a —William Shakespeare, Julius Caesar, Act senior partner at Vorys, Sater, Seymour —III, scene 2 and Pease LLP in its Columbus, Ohio, office, where he concentrates his trial prac- I have come to believe that if anything will tice in business and employment disputes. bring about the downfall of a company, or He is a graduate of Amherst College maybe even a country, it is blind copies of e- (1978) and Case Western Reserve Univer- mails that should never have been sent in the sity School of Law (1984). first place. Michael C. Griffaton is an associate in —Michael Eisner (commenting to the gradu- the same firm and concentrates in employ- —ating class at the University of Southern ment law. He is a graduate of Ohio —California) Wesleyan University (1990) and Case Western Reserve University School of Law I suggested deleting some language that might (1993). suggest we have concluded the release is misleading. —E-mail sent by Nancy Temple, in-house American Management Association, at —counsel for Arthur Andersen, referring to least 50 percent of all workplace Internet —an e-mail that was central to the jury’s activity is not business-related.3 —decision to convict the accounting firm • A study by the ePolicy Institute found that 85 percent of employees admit to rec- By William G. Porter II and reational surfing at work.4 Seventy percent By Michael C. Griffaton of employees admitted to receiving or sending adult-oriented personal e-mails at ITH JUST a few clicks of a mouse, work, while 60 percent admitted to ex- Wan employer may lose valuable trade changing e-mail that could be considered secrets and confidential information, be li- racist, sexist or otherwise “politically in- able for violating copyright laws, or be exposed to claims that it permitted a hostile work environment. The pervasive and 1. Edward Morawski, The Internet Around the World: Rising to the Challenge (Spring 2001) ubiquitous nature and exponential growth (online at http://www.angusreid.com/pdf/publicat/ of electronic mail and the Internet highlight fow_art.pdf). the need to monitor the electronic work- 2. Jay P. Kesan, Cyber-Working or Cyber-Shirk- ing: A First Principles Examination of Electronic place to curb that liability. Privacy in the Workplace, 54 FLA. L. REV. 289, 289 Just consider: (2002). The number of e-mail users increased 3. Samuel Greengard, The High Cost of Cyber- • slacking, 79 PERSONNEL J. 2224 (December 1, from 8 million in 1991 to 108 million in 2000). 2000.1 In 2000, 40 million employees ex- 4. Elron Software, 1999 Email Abuse Study changed more than 60 billion messages (online at www.elronsw.com/pdf/1999_Email_ 2 Study.pdf). See also 2001 Electronic Policies and daily. Practices Survey, available at www.epolicyinstitute. • According to a 1999 study by the com/survey/index.html Page 66 DEFENSE COUNSEL JOURNAL—January 2003 correct.” Most traffic to Internet porno- mation. The ePolicy Institute study showed graphic sites occurs during regular busi- that 68 percent of employers that monitor ness hours, probably because Internet cite legal liability as their primary reason. connections usually are faster in the work- No federal or state statute currently pro- place. hibits employers from monitoring their Companies have taken note of these sta- electronic workplace. The federal Elec- tistics and have adopted e-mail and Internet tronic Communications Privacy Act and usage policies that may contain provisions similar state laws provide some limitations, for continuous or random monitoring of us- but these limitations can be overcome in age. The ePolicy Institute study reports that the workplace through various exceptions 77 percent of employers monitor employ- in the statutes.9 The federal act prohibits ees’ e-mail and Internet use. In fact, 10 the interception of electronic communica- percent of workers with e-mail/Internet actions such as e-mail. It defines “intercep- cess (about 14 million people) are under tion” to mean the “contemporaneous acqui- continuous online surveillance.5 About two sition of the communication,” so an thirds of employers have disciplined or ter- interception takes place only when an indi- minated employees for violating electronic vidual sends an e-mail and a third party is usage policies.6 able to obtain a copy of the transmission at Employers give several reasons for the time it is sent. monitoring. Generally, they wish to main- In reality, however, the act provides em- tain their professional reputation and ployees little protection from the monitor- image. They also are concerned with em- ing of their workplace electronic communi- ployee productivity and business effi- cations. It does not apply to e-mails in their ciency, as “cyberslacking accounts for 30 “stored” state. This means that employers to 40 percent of lost worker productivity.”7 can freely obtain copies of e-mails from a With respect to legal liability, one com- network computer or the employee’s hard mentator has stated, “Via the recent expan- drive without violating the act. Even when sion of the strict liability doctrine of re- the employer intercepts electronic commu- spondeat superior, an employee may be nications, monitoring is permitted when held strictly liable for the foreseeable torts done in the “ordinary course of business” and crimes of employees.”8 Therefore, or when the employee has “consented” to monitoring may assist employers in pre- it. venting and discouraging sexual or other Moreover, few states (among them, illegal workplace harassment, defamation, Delaware and Connecticut) even require copyright violations from the illegal down- that employers notify their employees of loading of software, music and movies, and monitoring.10 the deliberate or inadvertent disclosure of As a general matter, employees in the trade secrets and other confidential infor- private sector have no reasonable expecta-

5. 14 Million U.S. Workers under Continuous ANN. 2A:156A-1 et seq. (2002); N.Y. PENAL LAW Online Surveillance, July 9, 2001 (online at 250.00 et seq. (2002); 18 PA. CONS. STAT. ANN. www.privacyfoundation.org/resources/14million. 5701 et seq. (2002). asp). 10. See DEL. CODE ANN. tit. 19, § 705 (2002) 6. Greengard, supra note 3. (“No employer . . . shall monitor or otherwise inter- 7. Russell J. McEwan & David Fish, Privacy in cept any . . . electronic mail or transmission, or the Workplace, 23 N.J. LAW. 20 (February 2002), Internet access or usage of or by a Delaware em- citing Workers Surf at Your Own Risk, Business ployee unless the employer either: (1) provides an week.com, June 12, 2000. electronic notice of such monitoring or intercepting 8. Kesan, supra note 2, at 311, citing John Ed- policies or activities to the employee at least once ward Davidson, Reconciling the Tension Between during each day the employee accesses the employer Employer Liability and Employee Privacy, 8 GEO. provided E-mail or Internet access services; or (2) MASON U. CIV. RTS. L.J. 145, 147 (1997). has first given a one-time notice to the employee of 9. 18 U.S.C. § 2510 (2002). For an overview of such monitoring or intercepting activity or poli- the Electronic Communications Privacy Act, see cies.”) See also CONN. GEN. STAT. § 31-48d (2002) Kesan, supra note 2, at 295-301. See also N.J. STAT. (“each employer who engages in any type of elec- Monitoring the Electronic Workplace Page 67 tion of privacy in their workplace e-mail E-MAIL AND INTERNET USE: and Internet usage that otherwise would EMPLOYEES’ CONDUCT AT WORK abrogate the employer’s right to monitor Employers have always monitored work- that usage. In fact, courts almost expect place conduct. In O’Connor v. Ortega,13 that employers will engage in some form for example, the U.S. Supreme Court rec- of monitoring. As the Seventh Circuit ex- ognized that employers have legitimate in- plained in Muick v. Glenayre Electronics: terests in monitoring their employees’ The laptops were [the employer’s] property work environment. and it could attach whatever conditions to their use it wanted to. They didn’t have to be A. Sexually Explicit E-mails reasonable conditions; but the abuse of access to workplace computers is so common In the Seventh Circuit Muick case, cited (workers being prone to use them as me- above, federal law enforcement authorities dium of gossip, titillation, and other enter- notified Glenayre Electronics, Albert tainment and distraction) that reserving a Muick’s employer, that they were investi- right of inspection is so far from being un- gating Muick’s dealings with child pornog- reasonable that failure to do so might well 11 raphy. At their request, Glenayre seized be thought irresponsible. Muick’s workplace computer until the au- E-mail and Internet privacy issues were thorities obtained a warrant for it. Muick addressed in the Defense Counsel Journal claimed that Glenayre’s actions constituted in 2000 by Hall Adams III, Suzanne M. an unreasonable search and seizure and a Scheuing and Stacey A. Feeley in E-Mail violation of his right to privacy. Monitoring in the Workplace: The Good, The court first rejected Muick’s claims the Bad and the Ugly.12 Their paper ad- that the company conducted an illegal dressed the central issue of whether an em- search or violated his constitutional rights ployer can legally monitor employee e- by cooperating with federal investigators mails and Internet usage without violating because Glenayre was not acting as a gov- employees’ privacy or some other state or ernment agent when it turned over the federal law. The answer to that question computer to the authorities. Next, the court was essentially, yes; the courts have con- rejected Muick’s right to privacy claim to sistently rejected claims that e-mail and the computer the employer had furnished Internet monitoring represents and invasion for use in the workplace, noting that of privacy. “Glenayre had announced that it could in- This article surveys the flip side of the spect the laptops that it furnished for the employer’s right to monitor: an employer’s use of its employees, and this destroyed liability for actually acquiring information any reasonable expectation of privacy that through electronic monitoring, having that Muick might have had and so scotches his information and potentially acting—or fail- claim.” The case reinforces the importance ing to act—on that information. In many of a properly drafted e-mail policy to pre- respects, this delves into uncharted areas of vent employees from succeeding in an in- cyberlaw, as the courts are just beginning vasion of privacy claim. to explore what liability, if any, employers In Blakey v. Continental Airlines,14 may have in this arena. Tammy Blakey, Continental Airlines’ first tronic monitoring shall give prior written notice to employees are engaged in conduct which violates the all employees who may be affected, informing them law, violates the legal rights of the employer or the of the types of monitoring which may occur. Each employer’s employees, or creates a hostile work- employer shall post, in a conspicuous place which is place environment, and electronic monitoring may readily available for viewing by its employees, a no- produce evidence of this misconduct.). tice concerning the types of electronic monitoring 11. 280 F.3d 741, 743 (7th Cir. 2002) (parentheti- which the employer may engage in. Such posting cal by the court). shall constitute such prior written notice.” An em- 12. 67 DEF. COUNS. J. 32 (2000). ployer may conduct monitoring without prior written 13. 480 U.S. 709, 722 (1987). notice when it has reasonable grounds to believe that 14. 751 A.2d 538 (N.J. 2000). Page 68 DEFENSE COUNSEL JOURNAL—January 2003 female pilot on the A300 Airbus aircraft, computer network is not an extension of sued Continental in federal court for sexual the workplace. harassment, discrimination and defama- In Strauss v. Microsoft Corp.,15 Karen tion. During that litigation, a number of Strauss, a female employee, sued Micro- Continental pilots posted insulting, defa- soft for gender discrimination in failing to matory and derogatory remarks about her promote her, relying in part on sexually re- on the pilot’s online computer bulletin lated e-mails she received from her super- board, which was accessible via the visor as evidence of gender bias. The e- Internet by all Continental pilots and crew mails included an advertisement for members through their paid membership in “mouse balls,” a news report on Finland’s CompuServe. Blakey sued Continental and proposal to institute a “sex holiday,” a several coworkers who posted messages on parody of a play entitled “A Girl’s Guide the bulletin board in state court for, among to Condoms,” and a message entitled other things, retaliatory sexual harassment. “Alice in Unix Land” that mixed computer The New Jersey Supreme Court ex- language with sexual references. Some of plained that an employer can be held liable the e-mails were not sent directly to for co-workers’ retaliatory harassment if it Strauss but by the supervisor to another knew, or should have known, about the ha- employee, who, in turn, forwarded them to rassment but failed to act to stop it, and the rest of the staff. employers have a duty to take effective The U.S. District Court for the Southern measures to stop that harassment in the District of New York denied Microsoft’s workplace and settings related to the work- motion for summary judgment, concluding place. Consequently, Continental’s liability that a jury could find pretext for gender would depend on whether the on-line fo- discrimination based on the e-mails. Moni- rum was such an integral part of the work- toring e-mail could have revealed this con- place that harassment there should be re- duct and possibly short-circuited the “ha- garded as a continuation or extension of rassment” of which Strauss complained. the pattern of workplace harassment. The Finally, in Coniglio v. City of Berwyn,16 case was remanded to the trial court for Susan Coniglio was employed by the City that determination. of Berwyn as manager of the its computer It is notable that the Blakey court did not department. Allen Zank, the city comptrol- hold that employers have a duty to monitor ler, was her direct supervisor. Coniglio al- private communications of their employ- leged that, among other things, Zank regu- ees, but it did admonish employers that “it larly viewed pornography on the Internet, may well be in [their] best interests to in full view of her and other city employ- adopt a proactive stance when it comes to ees, would print out pornographic pictures dealing with co-employee harassment,” and store them in binders in his office, and adding that “the best defense may be a would invite her into his office and attempt good offense.” Effective remedial steps re- to elicit her reaction to sexually explicit flecting a lack of tolerance for harassment pictures on his computer screen. She testi- will be relevant to an employer’s affirma- fied that the women were sometimes pic- tive defense that its actions absolve it from tured in different sexual positions with all liability for sexual harassment. This creatures resembling medieval gargoyles. case was unusual because the employer did Coniglio complained of Zank’s behavior, not own the computer network at issue. and Zank later terminated her. Where the employer does so, as in most She sued, alleging in part that Zank’s be- cases, it will be nearly impossible to argue havior created a hostile work environment. that what occurs on the employer’s own The U.S. District Court for the Northern District of Illinois denied the city’s motion for summary judgment on this claim. 15. 814 F.Supp. 1186 (S.D. N.Y. 1993); see also 1995 WL 326492 (S.D. N.Y.). Both Strauss and Coniglio highlight the 16. 2000 WL 967989 (N.D. Ill.). importance of e-mail and sexual harass- Monitoring the Electronic Workplace Page 69 ment policies. Just as calendar “pin-ups” B. Trade Secrets and Confidential and are no longer acceptable in the workplace, Proprietary Information on-screen pornographic or sexual images The National Counterintelligence Agency are not acceptable and can be evidence of a estimates that businesses lost $44 billion hostile work environment. While the em- due to economic espionage in one 17- ployers in those two cases ultimately may month period.19 Employers’ greatest risk to prevail at trial, defense of the cases (like their computer security comes not from most litigation) will be costly in terms of outside hackers but from current and money, time and negative publicity. former employees who deliberately or in- While most employees have been trained advertently disclose confidential or sensi- about improper office behavior—for ex- tive information. According to a 2001 sur- ample, sexual harassment—many do not vey by Elron Software, more than 40 view e-mail as an avenue for harassment percent of respondents admitted to receiv- and tend to treat their incoming and outgo- ing company confidential information such ing messages more casually than a letter or as client lists, financial statements and memo written on company letterhead. In product specifications from “outside their one case that garnered considerable press organizations—a 356 percent increase coverage, Chevron paid female employees since 1999.”20 Employees no longer have $2.2 million in 1995 to settle a sexual ha- to photocopy documents surreptitiously; rassment lawsuit from inappropriate e- they can simply download reams of data to mail, including “25 Reasons Why Beer is disk, CD or DVD, or even e-mail the infor- Better than Women,” sent by male employ- mation to a competitor with the click of a ees, including male supervisors.17 mouse. In Faragher v. City of Boca Raton and For example, a former executive of Burlington Industries Inc. v. Ellerth,18 the Borland International, a software company, U.S. Supreme Court made employers liable was accused of e-mailing trade secrets to a for the wrongful action of supervisors that competitor, which happened to be his new result in adverse employment action, even employer, before he quit Borland. Criminal if the employers were unaware of specific charges were filed, but eventually dropped, actions involved or taken. If employers fail and the civil dispute was quietly settled.21 to take affirmative steps to prevent sexual In Frasier v. Nationwide Insurance,22 harassment, they are exposing themselves Nationwide searched its file server and to potentially larger damage awards. Of located e-mail communications that re- course, it is likely that the more an em- vealed its employee, Richard Frasier, had ployer monitors its e-mail and Internet us- e-mailed correspondence critical of Nation- age, the more responsibility the employer wide’s business practices to a competitor. will be assessed for its content. As the New Soon after discovering this, Nationwide Jersey Supreme Court pointed out in terminated Frasier. Frasier sued, alleging Blakey, the best defense may be a good that Nationwide had unlawfully intercepted offense, and monitoring e-mail and Internet his e-mail communication in violation of usage may be that “good offense.”

17. Liz Stevens, Today’s Technology Makes It Web and Email Study, 5 (2001) (online at http:// Easier for Supervisors to Watch Workers, MILWAU- www.elronsoftware.com/pdf/NFOreport.pdf). KEE J. SENTINEL, October 6, 1999, at 3. 21. See Garry G. Mathiason & Roland M. Juarez, 18. 524 U.S. 775 (1998) and 524 U.S. 742 The Electronic Workplace: An Overview, CEB CA- (1998). LIF. BUS. L. R. 188, 189 (1995). See California v. 19. James E. Hudson III, Trade Secret Theft Eubanks, 927 P.2d 310 (Cal. 1996), as modified and Threatens Everyone with Corporate Economic Es- rehearing denied, 1997 Cal. Lexis 1016 (software pionage Escapades, HOUSTON BUS. J. TECH. Q., Oc- company paid for services of two computers experts tober 1, 1999 (online at http://www.bizjournals.com/ to assist prosecutor). houston/stories/1999/10/04/focus13.html). 22. 135 F.Supp.2d 623 (E.D. Pa. 2001). 20. Elron Software, The Year 2001 Corporate Page 70 DEFENSE COUNSEL JOURNAL—January 2003 state and federal wiretap laws and had un- had maintained a computer server that em- lawfully accessed his e-mail from storage ployees used specifically for downloading, in violation of stored communication laws. storing and sharing MP3 files.24 The federal district court for the Eastern District of Pennsylvania rejected both con- E-MAIL AND INTERNET USE tentions, first, because there was no “inter- BEYOND THE WORKPLACE ception,” and, second, because the employer had lawfully accessed its own Most electronic monitoring by employ- equipment and “stored” e-mail to obtain ers, like the monitoring of employees’ con- the information. duct in general, is conducted in the work- An electronic monitoring policy may place, but employers also monitor and even help the employer uncover such activities, discipline employees’ off-duty conduct. A perhaps in time to prevent what could be common example of monitoring is investi- substantial damage to the employer’s busi- gating whether workers’ compensation ness. claimants are in fact working when they claim to be unable to do so. An example of C. Copyright Infringement discipline is terminating of an employee who comes to work under the influence of Employers also may be needlessly ex- drugs or alcohol. Electronic monitoring exposed to lawsuits for copyright violations if pands the employer’s potential range of they permit (or ignore the fact that) em- surveillance and the potential liability for ployees to receive and/or download soft- invasion of privacy. ware or other materials, such as music, Generally, employees are unsuccessful video and graphics files, from e-mail sys- in claims if the employer can establish a tems or the Internet. Copyright infringe- nexus (however somewhat tangential) be- ment can result in civil and criminal penal- tween the off-duty conduct and the work- ties, not to mention adverse publicity. place. Some states, such as New York, Electronic monitoring is an effective way have made it unlawful to discriminate to minimize that legal exposure for copy- against employees based on their “legal right infringement. recreational activities outside work hours, Northwestern University, for example, off the employer’s premises and without fired Carla Tomina, a secretary who had use of the employer’s equipment or prop- amassed more than 2,000 MP3 music files erty.” “Recreational activities” means “any on her work computer. While Tomina lawful, leisure-time activity, for which the claimed the files came from her own CD employee receives no compensation and collection, as opposed to those on a which is generally engaged in for recre- website like Napster, the university had ational purposes, including but not limited been contacted by at least one music copy- to sports, games, hobbies, exercise, reading right holder in connection with unautho- and the viewing of television, movies or 23 rized, downloaded works. similar material.”25 Statutes such as this Another company agreed to a $1 million one may limit an employer’s ability to dis- out-of-court settlement with the Recording cipline employees for their off-duty, per- Industry of America because the company sonal e-mail and Internet use. Many people operate their own websites 23. Casey Newton, Downloading MP3’s Gets NU for personal interests ranging from geneal- Employee Downsized, THE SUMMER NORTHWEST- ogy to pornography. George and Tracy ERN, July 26, 2001 (online at http://www.polarity1. Miller, for example, were fired from their com/pcrr3.html). 24. Benny Evangalista, Deleting Download: nursing positions at an Arizona hospital for Companies Concerned over Employees’ File-Shar- operating an Internet pornography site ing at Work, S.F. CHRON., June 3, 2002 (online at showing the Millers engaged in sexual in- http://www.websense.com/company/news/company news/02/060302.cfm). tercourse. They claimed was they operated 25. N.Y. LAB. LAW 201-d. the site to make money for their children’s Monitoring the Electronic Workplace Page 71 college education. Hospital computer staff grabbed but can’t do anything about what alerted hospital administrators that employ- people say. Of course, the supervisor is le- ees were logging onto the site while at gally incorrect, but Owens ultimately de- work. The hospital initially suspended the cided not to sue.28 Millers pending investigation, and then ter- Finally, in October 2001, a Georgia po- minated them, stating that their website lice officer sent an e-mail to an online dis- created a hostile environment for the cussion list that advocated “eliminating the hospital’s employees. The hospital noted entire Arab world” if terrorism continued that the Millers had signed a policy state- and suggested that that United States bomb ment that provided employees could be Mecca so that Muslims would be forced to discharged for “immoral or indecent con- pray “at a crater 25 miles across.” The of- duct” while on or off duty. ficer had created the discussion list as a The Millers initially filed a charge of forum for law enforcement officers, and discrimination with the Equal Employment the list was not officially tied to any law Opportunity Commission and received a enforcement agency. The officer’s e-mail right-to-sue letter. (It’s unclear the pro- message, however, carried his professional tected class into which the Millers would e-mail signature, which identified him as a fall.) However, they elected not to pursue police officer. Subscribers to the list com- the claim and, instead, are now radio talk plained to the police chief, and the officer show hosts.26 agreed to resign.29 According to an article in the Sun-Her- ald in North Port, Florida, in March 2001, PROTECTION UNDER NATIONAL police officer Daniel Lake was suspended LABOR REALTIONS ACT for three days for “conduct unbecoming an A. Introduction officer” for pornography-related activities. The officer, who had a record described as Employer monitoring of e-mail and “excellent,” was not personally involved Internet usage raises a host of labor law with the pornography. Rather, his wife had issues. Under Section 8(a)(1) of the Na- submitted pornographic images of herself tional Labor Relations Act (NLRA), em- to a voyeuristic website as a birthday ployers are prohibited from giving even the present for her husband. While some resi- impression of surveillance of employees’ dents reportedly were opposed to the sus- union activity. As the National Labor Rela- pension, police officials were adamant in tions Board (NLRB) explained, “Employ- their belief that they had the right to regu- ees should be free to participate in union late the personal conduct of a police organizing campaigns without the fear that officer’s family.27 members of management are peering over Bill Owens, a Maryland Home Depot their shoulders, taking note of who is in- salesman, claimed that his supervisors ignored blatant sexual harassment by a female coworker because he and his wife operated a live sex video streaming site. In 26. After Hours, abcNEWS.com, December 9, 1999 (online at abcnews.go.com/onair/2020/tran- May 1999, a female coworker called him scripts/2020_991209_onlineporn_trans.html); Cyber “Buck Hunter,” his web site pseudonym, porn Nurse: “I Feel Like Larry Flynt” (online at asked him for oral sex, exposed her breasts http://zdnet.com.com/2100-11-515178.html?legacy= zdnn). to him and grabbed his crotch in full view 27. Elaine Allen-Emrich, Residents React to Re- of customers. Owens quit because he was cent City Internet Sex Scandal (online at http:// afraid of having his secret identity re- www.sun-herald.com/search/search.asp?showarticle =117710). vealed. When he later went back to his su- 28. John Simons, X-tracurricular Activities, pervisor to try to work things out, the su- Business 2.0 (January 2001) (online at www.busi- pervisor was helpful “until he heard about ness2.com/articles/mag/0,1640,14445,ff.html). 29. Erin McClam, Ga. Cop Asked to Resign for the site.” Owens alleged that his supervisor E-mail, AP Online, October 4, 2001, reported at said that he can protect him from being 2001 WL 28748621. Page 72 DEFENSE COUNSEL JOURNAL—January 2003 volved in union activities, and in what par- only against employees sending union ticular ways.”30 Electronic monitoring en- messages, the general counsel outlined a ables employers to record information new theory, derived from no-solicitation about the employees and their activities, and no-distribution case law, that the mere often without the employees even realizing existence of a business-only policy violates it. the NLRA—in effect, that a business-only Within the past several years, the NLRB policy was similar to a no-solicitation General Counsel’s Office has considered policy. several cases involving employer limita- In labor law parlance, no-solicitation tions on employee use of company e-mail rules prohibit employees from communi- and computers. The employers generally cating to fellow employees for various maintained “no solicitation/no distribution causes, including union organizing. To be policies” prohibiting dissemination of non- lawful, a no-solicitation rule must be non- business-related messages through internal discriminatory (it cannot apply just to e-mail systems. The lead case in this area union organizing), and it must apply only is Pratt & Whitney,31 in which the general to solicitations that take place in work ar- counsel challenged the legality of a busi- eas during working time. A company may ness-only e-mail policy. At issue was the not ban solicitation by employees during use of e-mail by the company’s 2,450 pro- non-working time, whether or not it occurs fessional and technical employees who in a work area. No-distribution rules pro- worked in one department and communi- hibit the distribution of literature on the cated extensively via e-mail. The general employer’s premises, and they also must counsel reasoned that Pratt & Whitney’s be non-discriminatory. However, a com- policy prohibiting all non-business use of a pany may lawfully ban distribution of ma- company’s e-mail and computer system terials in work areas at any time, whether was overbroad and facially unlawful. working or non-working, but in most in- Pratt & Whitney’s written policy prohib- dustries, an employer cannot ban distribu- ited the use of computer resources for non- tion by employees in non-work areas. business, unauthorized or personal pur- In the Pratt & Whitney opinion, the gen- poses However, the policy was not strictly eral counsel first concluded that employee enforced, and employees often violated it. computer workstations were work areas. After a union organizing campaign was un- Next, the opinion noted that the employer’s derway, the employer disciplined several e-mail system was used as a tool for con- employees who were union activists for versations and that the business-only rule sending e-mail messages and downloading prevented the employees from conversing union-related information onto the com- about the union during their non-working pany computer. After finding that the em- time. Accordingly, this is as unlawful as a ployer violated the NLRA by disparately no-solicitation rule that bans solicitation and discriminatorily enforcing its policy during non-working time.

B. Recent Cases 30. Flexsteel Indus. Inc., 311 NLRB 2547 (1993). For an overview of the union-related issues sur- In an NLRB general counsel case, TXU rounding e-mail, Internet usage, and electronic moni- Electric,32 the employer adopted this e-mail toring in the workplace, see Frederick D. Rapone Jr., This Is Not Your Grandfather’s Labor Union—Or Is policy: It? Exercising Section 7 Rights in the Cyberspace Internet, Intranet and E-mail are provided Age, 39 DUQ. L. REV. 657 (2001); Gwynne A. Wilcox, Section 7 Rights of Employees and Union by the Company for business-related use. Access to Employees: Cyberorganizing, 16 LAB. Any personal use by Users must be kept to a LAW. 253 (2000). minimum (no more than five (5) User I.D.’s 31. 1998 WL 1112978 (NLRB General Counsel, per E-mail), must comply with all Company February 23, 1999). 32. 2001 WL 1792852 (NLRB General Counsel, policies, and must not involve sending or February 7, 2001). storing files which consume large amounts Monitoring the Electronic Workplace Page 73

of computer storage space. Personal E-mail including e-mail and the Internet. An em- should not exceed one-half (1/2) page in ployee named Scully was disciplined after length or contain photographs, video or file he forwarded an e-mail from a former em- attachments. Additionally, sending chain E- ployee regarding working conditions at mail or non-business related bulk E-mail is Sitel. It was well-known at Sitel among prohibited. Users may not use Company re- both management and employees that em- sources to create a personal home page, web page, or computer programs. ployees commonly used the computer system, the Internet, and e-mail for numerous The union contended that the employer’s non-work-related purposes. e-mail unlawfully restricted employees and Scully won a Pyrrhic victory. The gen- union representatives from the exercise of eral counsel determined that the company’s their rights under the NLRA. The general e-mail policy was unlawfully overbroad counsel disagreed, concluding that the and that the company unlawfully disci- policy was facially lawful because it per- plined Scully for criticizing the working mitted employees to use the e-mail system conditions.35 The opinion went on, how- for personal use but only limited the length ever, to note that the company eventually of the message and the number of employ- —and lawfully—discharged Scully for ees to which a particular e-mail may be viewing pornographic web sites on his sent. The opinion held that the policy nar- computer. This case highlights the impor- rowly addressed the employer’s legitimate tance of monitoring employee Internet ac- business concerns—to forestall significant tivity. interference with its use of the e-mail system—while adequately balancing employ- C. Observations and Unanswered ees’ Section 7 rights and the employer’s Questions managerial interests. Such limitations are lawful, according to The NLRB general counsel’s advice the general counsel, as there was sufficient memoranda raise, but do not answer, sev- evidence demonstrating a substantial busi- eral questions about the scope of the tradi- ness justification that unfettered personal tional no-solicitation and no-distribution use would impair the effectiveness of the rules. Under the well-established no-distri- e-mail system significantly. Because there bution rule, an employer can ban distribu- was no restriction on the number of e-mails tion of materials in work areas at any time; that employees could send (as opposed to an employer may not ban solicitation that size the e-mail messages), employees still occurs on non-work time regardless of had the opportunity to communicate effec- where the solicitation occurs. If an em- tively throughout the bargaining unit. ployee does not have set break times, it is In IRIS-USA,33 the general counsel up- difficult to draw the line between non-work held a ban on all personal e-mail where the and work time. If the employee sends an e- computers were not part of the employees’ mail to all fellow employees about working work area. Because the employees did not conditions and the employees read the e- use computer or e-mail as part of their regular work, a work area “did not exist for 33. 2000 WL 257107 (NLRB General Counsel, them.” February 2, 2000). See also Emcompass Services Sitel Corp.34 highlights the fact that em- Corp., 2001 WL 310613 (NLRB General Counsel, January 18, 2001). ployees’ right to concerted activity guaran- 34. 2000 WL 33252020 (NLRB General Coun- teed by the NLRA applies in both the sel, October 5, 2000). union and non-union workplace. The e- 35. See also Timekeeping Sys., 323 NLRB 244 (1997) (employee who sent e-mail to other employ- mail policy in question restricted the use of ees critical of company’s vacation policy was en- the employer’s computer and e-mail sys- gaged in “concerted activity,” which is protected by tem to work-related purposes. The employ- the NLRA; company president’s termination of employee because employee refused to publicly apolo- ees, who were not represented by a union, gize for sending e-mail was unlawful; employee re- had regular access to a computer network, instated with back pay). Page 74 DEFENSE COUNSEL JOURNAL—January 2003 mail while at their desks, is that e-mail a break a case. Electronic evidence that can “solicitation” or a “distribution”? If an em- be monitored includes not just e-mail and ployee with an established break time reads Internet usage, but it also includes com- the e-mail in his work area when he is not puter user files, applications, databases, on break, does the e-mail then become a spreadsheets, network log files, access prohibited distribution and solicitation? activities, back-up tapes, data remnants, What if the employee is on break but is in metadata, and deleted files. Rule 26(a) of his work area, is the e-mail a distribution the Federal Rules of Civil Procedure re- (material read in the work area) or a solici- quires parties disclose computer-based evi- tation (material read on non-work time)? dence that they may use to support their What happens if the employee prints out claims or defenses, and Rule 34 has been the e-mail and reads it in the break room? interpreted to mean that electronic docu- There are no easy answers to those and ments must be produced in their “native the myriad other scenarios that may arise format.”36 as e-mail use continues to proliferate. At Employers also must remember that this point, the NLRB general counsel has document destruction is not permitted sim- provided little guidance for employers. ply because no subpoena has been served One thing that is clear, as the above or because litigation has not commenced. cases point out, is that an employer gener- Some courts do not consider destruction of ally cannot discipline an employee because potential evidence before a lawsuit is filed of the content of the employee’s e-mail as spoliation, while others find that a duty message. Depending on the scope of the e- to preserve documents arises when a party mail policy, however, the employer may be should reasonably know that litigation is able to discipline an employee because the imminent. Some courts presume that docu- employee violated the e-mail policy, for ment destruction under a company policy example, by sending pornographic images is innocent, while others question whether or file attachments that are too large, or by a duty to preserve was triggered regardless sending the e-mail to too many recipients. of such a policy. The traditional approach to reducing the NAVIGATIONAL AIDS FOR legal risk with old e-mail messages is to THE ELECTRONIC WORKPLACE create written policies that define the “useful life” of different document types and Once the employer begins to monitor thereby limit the spread of information. employees’ e-mail and Internet usage, what Moreover, various state and federal admin- happens to all the saved e-mails and istrative agencies require certain docu- Internet history logs? How long is that in- ments to be preserved for periods of time. formation saved? How long should it be For example, Title VII of the Civil Rights saved? What should the employer do with Act generally requires that any personnel all the information it has logged through its or employment record be preserved for one electronic monitoring efforts? year after the date the record was made or the undertaking of the personnel action in- A. Electronic Discovery volved, whichever is later. If an employee First and foremost, employers (and em- is involuntarily terminated, such records ployees) must remember that e-mail is not must be kept for one year following the necessarily gone when “deleted.” The in- date of termination.37 formality of e-mail and the mistaken belief Hand-in-hand with monitored informa- that it can be erased easily often result in tion is deciding how long to retain it. Cur- the creation of evidence that can make or rent storage media make it easy and inexpensive to save almost everything indefinitely. Of course, this also makes it 36. United States v. Microsoft Corp., 1998 WL 699028 (D. D.C.). easy to “forget” that the information is 37. 29 C.F.R. §§ 1602.14; 29 C.F.R. § 1627.3(b). there. The most telling example of docu- Monitoring the Electronic Workplace Page 75 ment retention and destruction problems is chooses an electronic storage method, the the Arthur Andersen trial resulting from necessity for a retrieval program or method the Enron bankruptcy. The Andersen is an ordinary and foreseeable risk.”41 policy called for the retention of important Litigation is costly in any event. Elec- company documents but the destruction of tronic discovery battles can be even more extraneous records. Andersen lawyer costly.42 Nancy Temple sent an e-mail on October 12, just five days before the Securities and B. Electronic Monitoring Policies Exchange Commission opened an informal Employers considering monitoring their inquiry into Enron, reminding workers of electronic workplace are well advised to the policy.38 David Duncan, the former create a monitoring policy detailing the Andersen lead auditor for Enron and the types of monitoring used and why, explain- government’s chief witness in the case, tes- ing what kinds of e-mail or Internet usage tified during the trial that he “obstructed is allowed and what is not. Included in the justice” by “instruct[ing]people on the policy should be the actions that will be team to follow the document retention taken if the policy is violated. Employers policy, which I knew would result in the must notify employees of the monitoring destruction of documents.”39 and should ensure that the employees re- Destruction of documents can be costly turn a signed acknowledgment of their unin more ways than one. In one case, a court derstanding of the policy and of the ramifi- fined Prudential Insurance $1 million for cations for violating it. its “haphazard and uncoordinated approach Like other policies, the electronic moni- to document retention” in face of a court toring policy should be re-evaluated peri- order requiring retention, even though odically, and any revisions should be redis- there was no proof that Prudential intended tributed, signed and returned by the to thwart discovery. The court also in- employees. Employers also should update structed the jury that it could draw an ad- their anti-harassment policies to include verse inference that destroyed documents specific references to inappropriate e-mail were relevant and unfavorable to Pruden- and Internet usage. Finally, employers tial.40 must train and periodically remind manag- Courts have upheld requests for produc- ers and employees of the policy.43 tion of documents that required companies Employers can take computer monitor- to spend thousands, and even tens of thou- ing a step further than merely looking sands, of dollars to retrieve “deleted” infor- through computer files; they can use the mation or information stored on back-up computer itself to help by employing a tapes and servers. In one case, the defen- plethora of software designed specifically dants were ordered to bear the cost of to monitor computer activity. One manu- searching through 30 million pages of e- facturer of monitoring software even mail despite their estimate that it would claims to be able to detect potential work- cost between $50,000 and $70,000. It is place violence from monitoring employ- notable that the court stated, “If a party ees’ e-mail.44

38. Jonathan Weil et al., Andersen Win Lifts U.S. Over, ABA J. July 2002, at 49; Kevin L. Carr, Elec- Enron Case, WALL ST. J. June 17, 2002, at A1. tronic Data: The Legal and Practical Aspects of Re- 39. Milton Lawson, Duncan Testifies about trieving Electronic Data in Discovery, ABA Labor Shredding, WASH. TIMES, May 14, 2002 (online at and Employment Law Section (Midyear Meeting, http://www.washtimes.com/upi-breaking/14052002- March 2001). 023744-292lr.htm). 43. See Torianne Florentino, Employee Privacy 40. In re Prudential Ins. Co. Sales Practices in the Ever-Evolving Workplace, 701 PRAC. L. INST. Litig., 169 F.R.D. 598, 617 (D. N.J. 1997). 679, 702-704 (2002). 41. In re Brand Name Prescription Drugs Anti- 44. See John C. Dvorak, Monitoring the Emo- trust Litig., 1995 U.S.Dist. Lexis 8281 (N.D. Ill.). tional State, Forbes.com, May 5, 2001 (online at 42. See Jason Krause, Electronic Documents Are www.forbes.com/2001/05/14/0514dvorak.html (dis- Vital to Building a Case, So Don’t Get Papered cussing Stroz Associates). Page 76 DEFENSE COUNSEL JOURNAL—January 2003

Monitoring software generally falls into computer idle time. This software can even the following categories: recreate “deleted” documents because the • Blocking software. This type of soft- keystrokes are logged and stored even if ware filters virtually anything on the deleted. See, for example, www.adavi.com. Internet that the employer deems inappro- The Program Investigator from www.win priate for employees to access while at whatwhere.com also monitors every instant work. When employees type in question- message. able words or search inappropriate sites, Electronic usage policies are effective which have been predetermined by the em- only if utilized consistently, regularly and ployer, not only are they prevented from fairly. To reduce legal risk effectively, em- entering, but they may be directed auto- ployers must enforce these policies consis- matically to the company’s electronic com- tently, without imposing undue burdens on munications policy. The software also can employees or its computer staff. Ideally, alert employers when an off-limits site is the system must support time- and event- visited. The main features of this software based destruction of old messages and include www.cybersitter.com, www.net must allow a company to halt scheduled shepherd.com, www.xstop.com, and www. deletion of messages selectively in order to surfwatch.com. respond to preservation orders and discov- • Direct surveillance. This software ery requests. Finally, the electronic moni- takes a picture of an employee’s screen at toring policy must be coordinated with periodic intervals, which enables the em- other records management systems so that ployer to see the sites employees are visit- computer administrators can apply reten- ing or the messages they are e-mailing. An tion rules to different types of records. example is www.spectersoft.com. • Flagging. This software not only CONCLUSION monitors employees’ Internet use but also screens their e-mail for potentially offen- • Dow Chemical fired 74 employees, sive or inappropriate messages. This soft- including executives, and punished 435 ware scans employee e-mails for question- others for distributing and viewing sexu- able keywords pre-determined by the ally explicit and graphically violent materi- employer. For example, an employer con- als via company e-mail in 2000. One cerned with the theft of its trade secrets can worker commented that he didn’t think the list the names of its primary competitors as e-mail “jokes” he sent were offensive be- keywords. This software also can automati- cause “most of the people in his depart- cally e-mail “flagged” messages to a comment were either receiving or sending simi- pany representative. An example is www. lar messages.”45 cybersitter.com. • Xerox fired more than 40 employees • Keystroke logging. This software for wasting up to eight hours a day surfing maintains a record of keystrokes and tracks pornographic websites in 1999.46 The U.S. Supreme Court has held that “an employer can be liable [for workplace 45. Brenda Rios, Dow’s Audit of Workers’ E-mail co=-worker harassment] where its own Ends in Firings, DETROIT FREE PRESS, July 27, 2000 negligence is a cause of the harassment. An (online at www.freep.com/money/business/doww employer is negligent with respect to 27_20000727.htm); Dow Chemical Fires 50 over E- sexual harassment if it knew of or should Mail Abuse, USA TODAY, July 28, 2000 (online at www.usatoday.com/life/cyber/tech/cti298.htm); Dow have known about the conduct and failed Chemical Fires Another 24 over E-Mail, USA TO- to stop it. Negligence sets a minimum stan- DAY, September 14, 2000 (online at www.usatoday. com/life/cyber/tech/cti530.htm). dard for employer liability under Title 46. Bloomberg News, Xerox Fires 40 for Online VII.”47 Pornography on Clock (online at http://news.com. Employers therefore may be considered com/2102-1001-231058.html?legacy=cnet). 47. Burlington Indus. v. Ellerth, 524 U.S. 742, negligent if they do not monitor their elec- 758-59 (1998). tronic workplace, just like they may be Monitoring the Electronic Workplace Page 77 considered negligent for failing to monitor petitors or pornographic e-mails to co- their physical workplace. Employers may workers, both of which are violations of avail themselves of the affirmative defense the company policies. The employer then if they take prompt and effective remedial raises the after-acquired evidence defense action to end harassment once they know in reliance on this information. To be ef- or should have known of it. If the employer fective, the employer’s electronic commu- fails to do so, “the combined knowledge nications policy must specifically prohibit and inaction may be seen to demonstrate the usage that would subject the employee negligence.”48 to discipline. Another reason to monitor employee e- It is still too early to draw conclusions mail and Internet usage is to gather support about what course the courts will chart on for an after-acquired evidence defense to monitoring the electronic workplace. By an adverse employment action. This de- tracking and monitoring employee usage, fense generally enables an employer to the employer may be storing information avoid some (or even all) liability where it that might later be used against it. By not could show, after terminating an employee monitoring, given the prevailing notion even for unlawful reasons, that it learned that most workers engage in at least some the employee previously had engaged in form of personal use of their workplace conduct that, if discovered, would have led computers, employers may be complicit in to termination. With respect to federal anti- maintaining a hostile work environment. discrimination laws, the Supreme Court has held that after-acquired evidence cannot operate to bar all relief, but it can limit 48. Faragher v. City of Boca Raton, 524 U.S. damages award and generally will render 775, 789 (1998). reinstatement and front pay inappropriate.49 49. See McKenna v. Nashville Banner Pub. Co., 513 U.S. 352, 363 (1995) (“Where an employer For example, suppose a terminated em- seeks to rely upon after-acquired evidence of wrong- ployee sues for discrimination. After cull- doing, it must first establish that the wrongdoing was ing through the employee’s e-mails, the of such severity that the employee in fact would have been terminated on those grounds alone if the employer learns that the employee was employer had known of it at the time of the dis- sending confidential information to com- charge.”). The Privacy Project Romantic Relationships at Work: Does Privacy Trump the Dating Police?

Courts generally have upheld fraternization policies that balance employer and interests carefully and that are administered impartially

By Rebecca J. Wilson, Christine Filosa IADC member Rebecca J. Wilson is a By and Alex Fennel partner in the Boston office of Peabody & Arnold LLP and vice chair of the litigation N TODAY’S work-oriented culture, of department, where she concentrates in fice romances and the related topics of employment law and works with employ- I ers to develop procedures and policies to sex and privacy have become important is- prevent employment-related claims. She sues confronted by most employers. With received her undergraduate degree from more employees working longer days and Trinity College in Washington, D.C., and spending so much of their time on-the-job, her law degree from Boston College in romantic relationships at work are develop- 1979. ing more frequently.1 Workplace romance Christine Filosa, a former associate at may be the only option for employees Peabody & Arnold, is now associate legal whose workload limits their outside activi- counsel at the Education Development ties; but for employers, this trend may Center Inc. prove problematic as the potential liability Alex Fennel was a summer associate in associated with these relationships rises.2 2002 at Peabody & Arnold and is a third- year law student at Boston University. A 1998 survey by the Society for Hu- man Resource Management predicted that 55 percent of office romances would likely result in marriage, but that 28 percent of As protection from litigation and poten- these office relationships may result in tial liability, some employers adopt poli- complaints of favoritism from coworkers, cies directly addressing dating in the work- 24 percent in sexual harassment claims, place. These policies range from the very and another 24 percent in the decreased strict, such as a comprehensive prohibition productivity of the employees involved.3 of dating between employees, to the more Statistics such as these have motivated em- lenient, such as a policy that actively dis- ployers to adopt prophylactic policies in an courages, but ultimately allows, employees effort to avoid the potentially complicated to fraternize.4 Even a simple policy requir- and unsavory outcomes of office affairs ing employees to notify management when and to maintain a strictly professional work coworkers are romantically involved pro- environment. vides documentation of a consensual rela-

1. Davan Maharaj, The Birds and the Bees—and 20797623/print.jhtml (July 1998). the Workplace, L.A. TIMES, available at http:// 3. Cupid’s Arrows Sometimes Compete with cgi.latimes.com/class/employ/career/birdsbees Work Objectives—SHRM Survey Finds Office Ro- 991121.htm (March 1, 2002) mances Are Often Frowned upon by Employers, 2. Harvey R. Meyer, When Cupid Aims at the available at www.shrm.org/press/releases/980128- Workplace; Romances Between Coworkers Can 3.htm (January 28, 1998). Cause Problems for a Company; Be Prepared to 4. Jennifer L. Dean, Employer Regulation of Em- Handle Such Situations, NATION’S BUSINESS, avail- ployee Personal Relationships, 76 B.U.L. REV. able at www.findarticles.com/cf_0/m1154/n7_v86/ 1051, 1052-53 (1996). Does Privacy Trump the Dating Police? Page 79 tionship that could be helpful to an mantic relationship between a manager or employer’s defense against a sexual ha- supervisor and his or her subordinate may rassment claim, should one arise.5 result in allegations of favoritism, with co- Perhaps daunted by problems of imple- workers claiming that the subordinate has mentation and enforcement, other employ- received preferential treatment as a result ers have avoided adopting any formal of the relationship. For example, the subor- policy explicitly addressing the issue of ro- dinate may receive longer breaks, be given mance in the workplace, choosing instead preferred shifts or receive unfairly favor- to rely on unwritten rules or other policies able reviews. Over time, this perception of already in place. Studies indicate that some favoritism could lower employee morale employers choose to “rely on a quiet form and productivity—two business elements of persuasion . . . [b]elieving that despite that employers have a vested interest in having no written rules, their employees protecting.11 understand that as a matter of corporate These complaints also may trigger a culture or implied policy . . . supervisor- sexual harassment claim against an em- subordinate relationships” will be discour- ployer under Title VII of the Civil Rights aged or simply not tolerated.6 Act, 42 U.S.C. § 2000e, which enables em- Although employers generally enjoy the ployees to base claims of sexual harass- right to promulgate rules and regulations ment on, first, a “quid pro quo” argument restricting dating on the job as they deem where an employer conditions benefits, necessary, this right must be weighed promotions or even employment itself on against the countervailing privacy rights of the receipt of sexual favors, or, second, an their employees.7 Courts considering these argument that sexual harassment has pro- issues have balanced the employer’s legiti- duced a hostile work environment.12 Title mate business interests in avoiding unnec- VII further holds an employer vicariously essary litigation and potential legal liability liable for “actionable discrimination caused and in maintaining a fair and professional by a supervisor but subject to an affirma- work environment, against the privacy tive defense looking to the reasonableness rights of employees.8 of the employer’s conduct as well as that of the plaintiff victim,” to quote the U.S. Su- EMPLOYERS’ BUSINESS preme Court in Faragher v. City of Boca INTERESTS Raton.13 The U.S. Court of Appeals for the Fifth Many employers adopt anti-fraterniza- Circuit took guidance from the Supreme tion policies in an effort to avoid the nu- Court in Defenbaugh-Williams v. Wal- merous types of liability they might other- Mart Stores when it held that employers wise confront.9 Liability may attach to an could be vicariously liable for sexual ha- employer confronted with an office ro- rassment committed by supervisors.14 One mance in a variety of ways.10 First, a ro-

5. Gary M. Kramer, Limited License to Fish off ERNMENT EXECUTIVE, October 1, 1998, available at the Company Pier: Toward Express Employer Poli- www.govexec.com/features/1098/1098s4.htm (de- cies On Supervisor-subordinate Fraternization, 22 scribing dating between supervisors and sub- W. NEW ENG. L. REV. 77, 143 (2002). ordinates as “supervisory suicide”); LABOR & EM- 6. Dean, supra note 4, at 1053; Kramer, supra PLOYMENT IN MASSACHUSETTS: A GUIDE TO note 5, at 143. EMPLOYMENT LAWS, REGULATIONS AND PRAC- 7. Kramer, supra note 5, at 105. Cf. Shuman v. TICES, §§ 5-6 (Matthew Bender and Co. 2001). City of Philadelphia, 470 F.Supp. 449, 459 (E.D. Pa. 11. Dean, supra note 4, at 1055 and n.23. 1979) (individual’s private sexual activities fall 12. Id. at 1054. See also Lisa Mann, Resolving within “zone of privacy” protected by Constitution Gender Conflict in the Workplace: Consensual and so long as they do not substantially impact Nonconsensual Conduct, available at website of individual’s ability to perform job). Modrall Sperling—www.modrall.com/articles/ 8. Dean, supra note 4, at 1053. article_44.html (October 27, 1994). 9. Kramer, supra note 5, at 77-79. 13. 524 U.S. 775, 780 (1998). 10. Mary Stanton, Courting Disaster, from GOV- 14. 188 F.3d 278, 280 (5th Cir. 1999). Page 80 DEFENSE COUNSEL JOURNAL—January 2003 of Wal-Mart’s district managers stated dur- tion that the association was unwelcome, ing a meeting with other employees that a even coerced. This situation presents at certain female, the plaintiff employee, least two problems unique to workplace re- “would never move up with the company lationships between managers or supervi- being associated with a black man.” The sors and their subordinates, because of the manager later became the plaintiff’s super- unequal bargaining power of the parties. visor and instituted a series of discipli- First, if the subordinate is disciplined, de- nary actions against her on what she al- moted or terminated, he or she may allege leged were “fabricated workplace-policy retaliation. Second, the party who ended grounds,” which culminated in her termi- the relationship may bring a sexual harass- nation. She sued on a theory of sexual ha- ment claim based on allegations that the rassment. other party is forcing him or her to stay in The court held that Wal-Mart was vicari- the relationship, stalking or continuing to ously liable for the sexual harassment com- make unwanted sexual advances, thus submitted by the supervisor. Concluding that jecting the complainer to sexual harass- the Supreme Court intended to extend prin- ment. Even if the relationship does not ter- ciples of agency liability to “all vicarious minate, co-workers may attempt to make a liability inquiries [brought] under Title VII claim against the employer for sexual ha- for acts of supervisors,” the court con- rassment. That claim may be viable if the cluded that Wal-Mart was liable for dam- employees involved in the relationship re- ages based on evidence that the manager peatedly display sexual favoritism or other had acted with malice or reckless indiffer- inappropriate sexual behavior in the work- ence by terminating the plaintiff for having place that results in the creation of a hostile been involved in an interracial relationship. work environment.16 Such a ruling exposes employers to in- Even when the relationship does not increased liability for the acts of supervisors volve a manager-supervisor and a subordi- in various contexts, which may include the nate, employers still face potential litiga- enforcement of anti-fraternization policies. tion and liability stemming from the This strict liability under Title VII provides romance.17 Problems can arise, for ex- yet another reason for employers to imple- ample, when an employer decides to disci- ment these policies with great care and to pline, demote or terminate a party to a ensure that their staff is well trained in en- workplace romance even for unrelated rea- forcing the policies.15 sons. Employees who previously com- Another danger is that while two em- plained of sexual harassment may allege ployees are romantically involved in a con- that the disciplinary action was retaliatory. sensual relationship, neither will claim ha- That is, the employee may bring a claim rassment, but after the romance ends, one against the employer.18 They then may also party may come forward with the conten- bring a gender discrimination claim, alleging that the employer’s action was motivated by favoritism of one gender over another.19 15. Kramer, supra note 5, at 120; Tara Kaesebier (Comment), Employer Liability in Supervisor Sexual Based on this potential legal liability and Harassment Cases: The Supreme Court Finally a reasonable desire to maintain a produc- Speaks, 31 ARIZ. ST. L.J. 203, 223 (1999). tive staff, an employer has a legitimate 16. See for this paragraph Kramer, supra note 9, at 87-94; Stanton, supra note 10; Mann, supra note business interest in drafting rules and regu- 12; Dean, supra note 4, at 1054. lations that will help it to avoid the myriad 17. Meyer, supra note 2. of problems that office romances can cre- 18. Kramer, supra note 9, at 96. 20 19. See Sanguinetti v. United Parcel Service, 114 ate. For instance, if an employer prohibits F.Supp.2d 1313 (S.D. Fla. 2000) (male supervisor its supervisors from dating their subordi- terminated for violating employer’s no-dating policy nates, it may be less likely to face a quid sued for gender discrimination where female manager who violated policy was not terminated). pro quo sexual harassment charge. Simi- 20. Kramer, supra note 9, at 79. larly, if a company requires its employees Does Privacy Trump the Dating Police? Page 81 to sign acknowledgement or consent forms tion.24 The right to privacy also protects the when they enter into a romantic relation- right of individuals to be free from govern- ship with a coworker, they will have docu- mental surveillance and intrusion in their mentation on file to defend themselves private affairs.25 from liability if a claim against them is Every state in the United States now rec- later brought.21 However, these rules, in- ognizes “some general form of common tended to shield employers from litigation, law protection for privacy.”26 Public sector may, ironically, give rise to other forms of employees in several states also enjoy state liability when an employer enforces them. constitutional protection of a general pri- When an employee is subjected to an ad- vacy right.27 Florida’s Constitution limits verse action in connection with their job the ability of government employers to infor a violation of an anti-fraternization vade the privacy of their employees.28 policy, the employee may challenge the Texas courts have held that the Texas Bill employer’s rules regarding employee rela- of Rights protects “personal privacy from tionships, arguing that the regulations con- unreasonable intrusion” and have extended stitute an invasion of privacy.22 this protection to the rights of public sector employees.29 In California, employees may EMPLOYEES’ PRIVACY INTERESTS invoke a public policy exception to at-will employment termination by asserting a At the heart of employees’ interests in violation of their privacy right under the engaging in consensual workplace relation- state constitution.30 ships lies their rights to privacy. In its In addition to these more conventional original form, the constitutional right to forms of protection, more than half the privacy protected individuals from im- states have legislation protecting employee proper acts of government officials.23 Since privacy with regard to activities conducted its recognition in the 1950s, however, the outside the workplace.31 In Colorado, constitutional right to privacy has grown to North Dakota and New York these laws encompass the autonomy individuals enjoy are general enough to protect almost all le- in making certain kinds of decisions, espe- gal activities not related to an individual’s cially those of a particularly personal na- employment. New York’s, for instance, ex- ture. Personal decisions likely to be pro- tends quite broadly to protect the “legal tected by this right to privacy include recreational” activities of employees.32 issues surrounding marriage, procreation, Colorado’s states that it is an unfair em- contraception, child- rearing and educa- ployment practice to discriminate against

21. Maharaj, supra note 1. 25. Bruce L. Watson, Disclosure of Computer- 22. Dean, supra note 4, at 1058; Kramer, supra ized Health Care Information: Provider Privacy note 9, at 105. Rights Under Supply Side Competition, 7 AM. J. L. 23. William M. Beaney, The Constitutional Right AND MED. 265, 269 (1981), citing Roe. to Privacy in the Supreme Court, 1962 SUP. CT. 26. Michael Z. Green, A 2002 Employment Law REV. 212 (1963) (discussing the meaning of the con- Odyssey: The Invasion of Privacy Tort Takes Flight stitutional right to privacy). in the Florida Workplace, 3 FLA. COASTAL L.J. 1, 9 24. Pierce v. Soc’y of Sisters, 268 U.S. 510 (2001). (1925) (extending constitutional right of privacy to 27. Helen M. Richards, Is Employee Privacy an child rearing and education); Prince v. Massachu- Oxymoron? 15 DELAWARE LAW. 20, 20-21 (1997). setts, 321 U.S. 158 (1944) (extending constitutional 28. Green, supra note 26, at 14. right of privacy to decisions regarding family rela- 29. Texas State Employees Union v. Texas Dep’t tionships); Skinner v. Oklahoma ex. rel. Williamson, of Mental Health and Mental Retardation, 746 316 U.S. 535 (1942) (extending constitutional right S.W.2d 203 (Tex. 1987). of privacy to procreation); Loving v. Virginia, 388 30. Semore v. Pool, 1990 Cal.App. LEXIS 94. U.S. 1 (1967) (extending constitutional right of pri- 31. Alison J. Chen (Note), Are Consensual Rela- vacy to marriage); Griswold v. Connecticut, 381 tionship Agreements a Solution to Sexual Harass- U.S. 479 (1965) (extending constitutional right of ment in the Workplace, 17 HOFSTRA LAB. & EMP. privacy to contraception); Roe v. Wade, 410 U.S. L.J. 165, 188 (1999). 113 (1973) (extending constitutional right of privacy 32. N.Y. LABOR LAW § 201-d (2002). to abortion). Page 82 DEFENSE COUNSEL JOURNAL—January 2003 employees for engaging in “lawful activi- these issues, the U.S. District Court for the ties,” either outside of the office or while Eastern District of Missouri opined in working.33 North Dakota’s makes it unlaw- Wieland v. City of Arnold that it was “un- ful to hire or fire an employee for engaging comfortable” adopting a general rule that in a “lawful activity outside work” that all dating relationships are constitutionally does not interfere with the employer’s protected, especially for government em- business interests.34 ployees working in “sensitive areas” of law enforcement.38 In that case, a police officer ANTI-FRATERNIZATION POLICIES: challenged a city’s police department regu- BALANCING COMPETING lation prohibiting unbecoming conduct vio- INTERESTS lated, among other things, his right to privacy. A. Public Sector Employees The chief of police had ordered the The liberty that employers have to limit plaintiff to end his relationship with a the activities of employees varies depend- woman who was on probation for a felony ing on whether they operate in the public offense. The plaintiff had appeared at a city or private sector. There are significant dif- ribbon-cutting ceremony with the woman, ferences between these two arenas as they and a picture of the two at the ceremony relate to the regulation of romantic in- appeared in a local paper. The chief volvement in the workplace. thought that this public appearance both State and federal constitutional provi- embarrassed the city and violated a general sions that explicitly protect individual pri- order of the department “forbidding as un- vacy rights apply only to state actions.35 becoming conduct . . . [k]nowingly associ- When the state is the employer, it may not, ating, on or off duty, with convicted crimi- without substantial justification, condition nals or lawbreakers under circumstances employment on the relinquishment of con- which could bring discredit upon the de- stitutional rights, but it nevertheless has partment or impair an officer in the perfor- greater latitude in restricting the activities mance of his duty.” of its employees than it has in regard to the The court held that although the plain- activities of its citizens at large.36 Accord- tiff’s relationship with a convicted felon ingly, public sector employees generally did not impact his job performance, it was enjoy a more rigorously protected right of not “unreasonable to assume a very real privacy than do employees in the private likelihood that it could affect the chain of sector. The courts must carefully consider command as well as the public image of both the interests of the individual and the the department.” The court ultimately con- interests of the government when deter- cluded that while such “looser socialties” mining whether the private activities of a as dating may be protected, they receive public employee constitute valid grounds less stringent protection from privacy laws for action.37 than other, more formal associations might Apparently aware of the intricacies of enjoy. In Shawgo v. Spradlin,39 the Fifth Circuit specifically noted that the right to privacy does not come without qualification and 33. COLO. REV. STAT. ANN. § 24-34-402.5. that the state has a greater interest in regu- 34. N.D. CENT. CODE § 14-02.4-0.8 (1997). 35. Born v. Blockbuster Video Inc., 941 F.Supp. lating the activities of its employees than it 868, 870 (S.D. Iowa 1996). has in regulating the activities of the gen- 36. Briggs v. North Muskegon Police Dep’t, 563 eral population. In Shawgo, two former po- F.Supp. 585, 587 (W.D. Mich. 1983) (citations omitted). lice officers sued a city and others for an 37. Dean, supra note 4, at 1058; Kramer, supra alleged invasion of privacy resulting from note 9, at 106. the disciplinary action taken against them 38. 100 F.Supp.2d 984, 988 (E.D. Mo. 2000). 39. 701 F.2d 470, 482-83 (5th Cir. 1983). 1 Id. at for dating and allegedly cohabitating in 472. violation of department regulations. One Does Privacy Trump the Dating Police? Page 83 officer was a patrolwoman and the other a law indicates that courts will evaluate sergeant. The patrolwoman did not report anti-fraternization policies of government directly to the sergeant, so the problems employers relative to the type of work in- common to romantic relationships between volved, the existence of superior-subordi- managers or supervisors and their subordinate relationships and whether one of the nates did not arise. two employees directly reported to the Finding a rational connection between other. the “exigencies of department discipline and [the rule] forbidding members of a B. Private Sector Employees quasi-military unit, especially those differ- Private sector employees receive protec- ent in rank, to share an apartment or to tion from invasions of privacy under state cohabit” the court nevertheless concluded legislation and common law. Several states that the policy did not offend the plaintiffs’ have adopted laws protecting all legal off- privacy rights. It went on to hold that the duty activities, provided they do not di- investigatory surveillance of the employ- rectly conflict with an employer’s legiti- ees’ off-duty association in violation of de- mate business interest.44 Private sector partment regulations did not impinge upon employees, however, have very few pri- the right to privacy. vacy rights that protect them within the Similar cases have reached consistent workplace. To prevail on an invasion of outcomes where the relationship is be- privacy claim, there must exist a reason- tween a government employee and a non- able expectation of privacy in the matter at government employee. For example, in issue. Under this standard, if employees City of Sherman v. Henry, the Texas Court have advance notice of a company anti- of Appeals determined that a police fraternization rule, their claim is substan- officer’s right to privacy was violated tially weakened.45 An employee who when he was denied a promotion because knowingly violates an anti-fraternization of a personal relationship with a fellow po- rule cannot be said to have had a reason- lice officer’s wife.40 In Briggs v. North able expectation of privacy in the matter. Muskegon Police Department, the federal In Rogers v. International Business Ma- district court for the Western District of chines Co.,46 the employer dismissed a Michigan applied like reasoning to con- manager for having an alleged relationship clude that a city violated a police officer’s with a subordinate that “exceeded normal privacy rights when it dismissed him for or reasonable business associations, [and] cohabitating with a woman while separated negatively affected the duties of his em- from his wife.41 ployment.” The employer had no policy or A police officer’s right to privacy also rule prohibiting such relationships, and the was violated in Shuman v. City of Philadel- manager claimed that his termination was phia when the police department fired him improper because it was predicated on an for living with a married woman who was investigation of a personal matter, which not his wife.42 In contrast, however, recall invaded his right of privacy. that Wieland held that a city’s order to a The U.S. District Court for the Western police officer to terminate his relationship District of Pennsylvania concluded that the with a known felon pursuant to a policy forbidding association with a convicted criminal did not violate the police officer’s 40. 910 S.W.2d 542, 556 (Tex.App. 1995). right to privacy. 41. 563 F.Supp. 585 (W.D. Mich. 1983). Since their employees possess somewhat 42. 470 F.Supp. 449 (E.D. Pa. 1979). 43. Dean, supra note 4, at 1058. stronger rights of privacy in the workplace 44. Ann H. Zgrodnik (Comment), Smoking Dis- than do their counterparts in the private crimination: Invading an Individual’s Right to Pri- sector, employers in the public sector vacy in the Home and Outside the Workplace? 21 OHIO N.U.L. REV. 1227, 1244-45 (1998). should exercise caution when structuring 45. Kramer, supra note 9, at 120, 129. anti-fraternization policies.43 Relevant case 46. 500 F.Supp. 867, 868 (W.D. Pa. 1980). Page 84 DEFENSE COUNSEL JOURNAL—January 2003 employer acted reasonably, noting that tionship” with a female co-worker. The nothing on the record indicated any impro- plaintiff responded by saying that he did priety and that in fact the manager had par- not socialize while working and that he ticipated in the investigation and had re- would continue to see the co-worker during ceived timely notice of his termination. In his own time. The supervisor later told the support of its decision, the court cited what plaintiff that his job performance was not it described as the employer’s legitimate satisfactory and that he would be fired if interest in “preserving harmony among its his performance did not improve. The employees and . . . preserving normal op- plaintiff employee asked to be transferred erational procedures from disruption.”47 to another department, but the supervisor The court also rejected the plaintiffs’ tort denied his request, and he ultimately was claim for invasion of privacy. It under- terminated for unsatisfactory job perfor- scored the fact that the employer had lim- mance. ited its investigation to interviews with em- In affirming the lower court’s judgment ployees and to an examination of company for the employer, the Oregon Supreme records, and it concluded that the employer Court held that the dismissal did not vio- had not intruded on the plaintiff’s “seclu- late public policy and did not amount to sion or private life.” “outrageous” conduct. Similarly, in Watkins v. United Parcel In a similar case, Sarsha v. Sears Roe- Service,48 the employer fired a manager for buck & Co.,50 the plaintiff employee, a su- violating the company’s anti-fraternization pervisor, was fired for dating a subordinate policy by having a romantic relationship employee, who, however, was not fired. with a U.P.S. truck driver. The manager The plaintiff sued, alleging age discrimina- claimed the company’s conduct was tion in violation of the Age Discrimination “highly offensive” because his personal re- in Employment Act, and a gender discrimi- lationship with the driver did not concern nation claim in violation of Title VII. In the company because it occurred primarily rejecting the claims, the Seventh Circuit off the job. He also alleged that he and the ruled that the employer was “entitled to en- co-worker had contemplated marriage and force a non-dating policy . . . against [its] that his discharge prevented that marriage supervisors, who by virtue of their mana- from coming to fruition. gerial positions are expected to know bet- The U.S. District Court for the Southern ter.” District of Mississippi rejected the claims Nevertheless, to be upheld, an em- and found at least partial support for its ployer’s anti-fraternizations policies must decision in the manager’s failure to pro- be enforced consistently and in a gender- vide, or even allege, an “utterly reckless” neutral manner. For instance, in Zentiska v. invasion by the company, such as snooping Pooler Motel Ltd.,51 the employer ordered in his bedroom or electronically wiring his one of its supervisors either to quit his job workspace. or fire the plaintiff employee the supervisor In Patton v. J.C. Penney Co.,49 a former was dating. The supervisor removed the employee sued for wrongful discharge and plaintiff employee’s name from the work intentional infliction of emotional distress schedule. One of the employer’s area di- after being terminated for dating a co- rectors, however, had dated and ultimately worker. One of the employer’s supervisors married a co-worker. The employer had had told the plaintiff to end his “social rela- not enforced its anti-fraternization policy with respect to that situation. The area director not penalized was male; the plain- 47. Quoting Geary v. U.S. Steel Corp., 319 A.2d tiff who was fired was female. The federal 174, 178 (Pa. 1974). district court in Georgia found the defen- 48. 797 F.Supp. 1349, 1351 (S.D. Miss. 1992). dant liable for sex discrimination on the 49. 719 P.2d 854 (Or. 1986). 50. 3 F.3d 1035, 1037 (7th Cir. 1993). ground that it had treated the female plain- 51. 708 F.Supp. 1321, 1322-25 (S.D. Ga. 1988). tiff differently from a similarly situ- Does Privacy Trump the Dating Police? Page 85 ated male employee. cases involving romantic relationships at Courts that have encountered these is- work centers around the highly controver- sues have consistently decided in favor of sial idea that employers have the ability the proposition that employers must act and also the right to regulate the activities reasonably and consistently, both in the of their employees outside the workplace. implementation and the execution of anti- The best-known case on this issue involves fraternization policies.52 For instance, in two former employees of Wal-Mart, New Watkins, the plaintiff did not argue that the York v. Wal-Mart Stores.55 Both were ter- anti-fraternization policy itself constituted minated for violating the company’s frater- an invasion of privacy, but rather that the nization policy, which prohibited a “dating investigation into the relationship violated relationship” between a married employee his privacy rights. As that case demon- and another employee, other than his or her strates, the manner in which a company en- own spouse. forces its anti-fraternization policy is In an action seeking the re-instatement equally important to an employer seeking of the terminated employees, the New to avoid litigation as the policy itself. York Attorney General argued that the fir- Employers who adopt anti-fraternization ing violated a New York statute that made policies appear to be fairly well protected it unlawful for any employer to “refuse to from liability on invasion of privacy hire, employ, or license or to discharge grounds, so long as the policy and its from employment or otherwise discrimi- implementation are reasonable.53 Courts nate against an individual . . . because of have demonstrated sympathy for the plight . . . an individual’s legal recreational activi- of employers facing problems arising from ties outside work hours, off the employer’s fraternization between employees. They premises and without use of the employer’s recognize that workplace romances can equipment or property.”56 have a tangible and often negative impact The outcomes of cases interpreting this on a company’s ability to achieve legiti- statute have hinged almost entirely on the mate business objectives. At the same time, courts’ interpretation of the phrase “recre- however, courts maintain a clear respect ational activities.” In the Wal-Mart case, for the individual privacy rights of employ- the trial court had found that the employees ees and will not allow those rights to be may have engaged in recreational activities abrogated beyond reason.54 while dating and that the fact that they en- To arm themselves against various kinds gaged in these “protected leisure activities of liability, employers should craft policies . . . together did not vitiate their statutory that are reasonable in scope and degree and protection.” The Appellate Division, how- that can be fairly and consistently en- ever, reversed, holding that “dating” is dis- forced. A reasonable policy will focus on tinct from and, in fact, bears no resem- the effect the relationship has on the busi- blance to “recreational activity.” The ness interests of the employer. For ex- employees could not receive protection un- ample, there should be some correlation der the statute. between the romantic relationship and the Critics of the court’s reasoning, how- employees’ performance on the job. It ever, have argued that this interpretation of likely will be more difficult to defend an anti-fraternization policy relating to the activities of employees outside the workplace 52. See Sanguinetti v. United Parcel Serv., 114 F.Supp.2d 1313 (S.D. N.Y. 2000) (dismissing inva- if the policy does not require that the out- sion of privacy claim brought by employee fired for side activity impact a legitimate business violating no-dating rule). objective or interest. 53. Kramer, supra note 9, at 78, 96. 54. Michael Dworkin, It’s My Life—Leave Me Alone: Off-the-Job Employee Associational Privacy C. Off-duty Conduct Rights, 35 AM. BUS. L.J. 47, 95 (1997). 55. 621 N.Y.S.2d 158 (App.Div. 3d Dep’t 1995). Another important issue that arises in 56. N.Y. LABOR LAW § 201-d. Page 86 DEFENSE COUNSEL JOURNAL—January 2003 the statute “overlooks [its] essential pur- reasonable expectation of privacy regard- pose, which is to protect employees’ off- ing e-mails sent and received at work and the-job activities so long as they [do not that, therefore, an employer did not violate bear]” on one’s job performance.57 In con- the state wiretapping law when it stored trast, a New York federal district court’s and reviewed messages from a company interpretation of the same language con- server. cluded that cohabitation qualified as a rec- More recently, the U.S. District Court reational activity under the statutory for the District of Massachusetts held that scheme.58 The court relied on the statute’s even where employees may have a reason- legislative history, which it held reflected a able expectation of privacy in their office “general policy of protecting employees e-mail, the legitimate business interests of from discrimination” against employees their employers will likely trump employee who happen to engage in activities after privacy interests. In Garrity v. John work that their employer does not like. Hancock Mutual Life Insurance Co.,61 that Many states have adopted these off-the- court noted that both Title VII and state job privacy laws in some shape or form, law require employers take proactive steps indicating that this type of statute will re- to eliminate harassment from their offices main a force to be reckoned with as em- and to investigate any potentially harassing ployers confront the issue of romantic rela- conduct when this conduct is brought to tionships in the workplace and draft their attention. anti-fraternization policies.59 Ultimately, it Similarly, in Smyth v. Pillsbury Co.,62 appears that the outcome of these cases the federal district court in the Eastern Dis- will depend on the legislative history of the trict of Pennsylvania held that pursuant to statutes involved and how courts decide to Pennsylvania law, an employee fired for interpret the relevant statutory language. making disparaging comments on an e- mail written at work did not have an expec- D. Privacy on the Internet tation of privacy in this communication. In 63 Another related issue is whether em- McLauren v. Microsoft Corp. a Texas ployees have an expectation of privacy Court of Appeals held that an employee with regard to e-mails sent or received on did not have a reasonable expectation of an office computer system. For instance, an privacy in the contents of an e-mail mes- employer might discover that its employ- sage that he had saved to a “personal” file. ees are fraternizing in violation of a com- Thus, it appears that an employer who pany policy by intercepting a related e-mail discovers a violation of its fraternization message. In Restuccia v. Burk Technology policy by intercepting an e-mail sent on an Inc.,60 the Massachusetts Superior Court office system does not violate the privacy held in 1996 that employees do not have a rights of the employees involved in acting on knowledge acquired via the intercepted message.

57. Dworkin, supra note 54, at 53-54. CRAFTING ANTI- 58. Pasch v. Katz Media Corp., 1995 WL 469710 FRATERNIZATION POLICIES (S.D. N.Y.). 59. Dworkin, supra note 54, at 55; Dean, supra A well-drafted, carefully implemented note 4, at 1067 nn. 114-115. 60. 1996 Mass.Super. Lexis 367 (1996). and widely disseminated corporate policy 61. 2002 U.S.Dist. Lexis 8343 (D. Mass.). regarding fraternization among employees 62. 914 F.Supp. 97, 101 n.3 (E.D. Pa. 1996). can provide substantial legal protection to 63. No. 05-97-00824-CV (Tex.App. 1999), un- 64 published but available at http://www.5thcoa. employers. The employer must first de- courts.state.tx.us/cgi-bin/as_web.exe?c05_99.ask+ termine the nature of the limitation desired D+10706510. and then decide how it will enforce the 64. For references to this section, see Kramer, supra note 9, at 78, 120; Dean, supra note 4, at 1073; policy. The policy should provide a precise Meyer, supra note 2. definition of the discouraged, limited or Does Privacy Trump the Dating Police? Page 87 prohibited conduct. For example, an em- weaker their argument that they had a rea- ployer may define the phrase “personal re- sonable expectation of privacy regarding lationships” to encompass romantic rela- the romantic relationship. tionships as well as family relationships or An advising attorney drafting a policy relationships with the potential for con- should pay close attention to any guidance flicts of interest. offered by the courts in the applicable ju- The employer also must determine the risdiction and, given the uncertainty of the extent to which the policy will limit such law in this area, should craft the policy in relationships. One might choose to adopt a light of the factors that these courts have comprehensive policy prohibiting all rela- found persuasive. Employers also should tionships between co-workers. Another, ensure that the policy is clearly conveyed believing this too restrictive, might opt to to all employees and understood by all em- limit the prohibition to personal relation- ployees. ships between a manager and a subordi- At the end of this article are two sample nate, with or without providing various fraternization policies. other qualifications such as whether the subordinate reports directly to the supervi- CONCLUSION sor. An even less restrictive option would The privacy rights of employees typi- be a limitation on a manager’s ability to cally do not prohibit employers from acting have a “personal relationship” with a sub- as the dating police by implementing or en- ordinate within his or her chain of com- forcing a policy against romantic relation- mand. ships in the workplace. In many, if not Finally, the employer must consider the most instances, the employer’s legitimate types of consequences it will apply to em- business interests in maintaining a peaceful ployees who violate the policy. These may and productive work environment and include transfers to another department, avoiding liability outweigh an employee’s termination, reprimand or demotion. Em- right to privacy. This has proved to be es- ployers should carefully consider not only pecially true in the context of an employ- the potential reaction of its employees to ment relationship in the private sector. the policy, but also the practicality and dif- If an employer decides to promulgate ficulty of enforcing it, given its business rules and regulations regarding office ro- circumstances. In the end, for an anti-frat- mances, the policy should not intrude on ernization policy to survive claims brought employees’ private affairs unreasonably on privacy grounds it must strike a reason- and should display respect for the personal able balance between the interests of the lives of employees, while also protecting employer and the interests of the employ- the employer’s interest in avoiding the ees. many problems that can result from these An employer or advising attorney wish- romances. The policy should be stated ing to avoid claims that a policy violates clearly and tailored narrowly to protect the the privacy rights of its employees should employer’s legitimate business interests. structure the policy around the impact po- Consideration may be given to restricting tential romantic relationships at work may only relationships between supervisors and have on job performance. This will in- subordinates since in the past these rela- crease the likelihood that a court will find a tionships have been the most likely to lead rational connection between the policy and to litigation because of the imbalance of the achievement of legitimate business ob- power between the two parties, as well as jectives. The more specific the policy is in being the most likely to affect job perfor- defining its prohibitions and the scope of mance. Most critically, whatever form of their application, the more notice employ- policy an employer chooses to adopt, it ees will be seen to have had. The more must enforce the policy in a uniform and notice employees have regarding their non-discriminatory manner. employer’s anti-fraternization policy, the Page 88 DEFENSE COUNSEL JOURNAL—January 2003

SAMPLE ANTI-FRATERNIZATION fronted and unless they are willing to ter- POLICIES minate the relationship, management will ask the supervisor to leave the company. Following are sample policies that em- This policy does not apply to employees ployers may find helpful when drafting not in management. If, however, a relation- their own fraternization rules. Please note, ship not covered by this policy causes dis- however, that these are only suggested ruption within the workplace or any other models. Employers should tailor their spe- performance problems, discipline may be cific policies to the needs of their business imposed. and should get legal advice regarding the legal climate in this area of employment DISCLOSURE OF CONSENSUAL law within their jurisdictions. RELATIONSHIP POLICY NO FRATERNIZATION POLICY XYZ Company Inc. requires that any employee who becomes involved in a ro- XYZ Company Inc. prohibits supervi- mantic relationship with another employee sors or managers from engaging in roman- of the company to report this relationship tic relationships with their subordinates to Ms. Need T. Know, Director of Human within the company. Relationships be- Resources. Employees of XYZ Company tween management personnel and employ- Inc. who choose to engage in a romantic ees raise issues of equity, fairness, favorit- relationship with a co-worker are required ism and potential legal liability for the to sign a statement that they have chosen to company and, therefore, will not be permit- do so voluntarily and that as such, the related. If management becomes aware of any tionship is consensual. such relationship, both parties will be con- The Privacy Project Privacy Issues from the Judicial Perspective: Requirements for Protective Orders

The frequency with which courts employ protective orders should influence counsel to draft the application with detailed statements

By Mark D. Fox and Chris E. Forte Since 1991, Mark D. Fox has been a magistrate judge in the U.S. District Court N THE context of litigation, the antici- for the Southern District of New York, Ipated threshold issue—should the court White Plains. He is a 1967 graduate of require disclosure to an adversary of pri- Brooklyn Law School and a member of the New York bar since 1968. vate or sensitive information—most often A career law clerk, Chris E. Forte is a becomes how and to whom the court will 1980 graduate of the State University of permit disclosure of that information. Prac- New York at Buffalo Law School and a titioners may need to explain to clients the member of the New York bar since 1981. breach of privacy consequences of raising certain issues in a lawsuit, particularly with respect to damages. They also should be sure also should consider the impact of the aware of the necessity of raising privacy amendment to Rule 5(d), which now ex- issues early in the proceedings so as to cludes from the requirement of filing with avoid a waiver. the clerk (and thereby renders unavailable to the public) disclosures made under Rule MANDATORY DISCLOSURE 26(a)(1) and (2) until they are used in the AND PROTECTIVE ORDERS proceeding or filing is ordered by the court. Once such discovery materials are used in In the United States, concerns may arise the action, for example, as an exhibit in from a consideration of the mandatory dis- support of a motion, they may become closure requirements of Rule 16(a)(1)(A) available to the public. For that reason, and (B) of the Federal Rules of Civil Pro- protective orders entered under Rule 26(c) cedure, which, within 14 days of the Rule are becoming more routine. 26(f) scheduling conference require dis- An April 1996 study by the Federal Ju- closure of the identities of witnesses and dicial Center, Protective Order Activity in documents “that the disclosing party may Three Federal Judicial Districts, Report to use to support its claims or defenses.” the Advisory Committee on Civil Rules, by There are exceptions to the disclosure re- Elizabeth C. Wiggins, Melissa J. Pecherska quirement, but absent a stipulation between and George Cort, revealed that in the Dis- the parties, the prudent practitioner should trict of Columbia in 1990 through 1992, act to avoid the potential for preclusion protective order activity occurred in be- pursuant to Rule 37(c)(1) by bringing any tween 8 and 10 percent of all the civil objections to the attention of the court be- cases on the docket. While the numbers fore the Rule 26(f) conference or by stating were lower (approximately 5 percent) in the objection in the Rule 26(f) discovery the other districts studied, the number of plan. cases affected was still significant. The au- Parties with privacy concerns about the thors’ experience in the Southern District contents of material required to be proof New York confirms the findings in the duced as part of mandatory initial disclo- three districts in the study that of all appli- Page 90 DEFENSE COUNSEL JOURNAL—January 2003 cations for protective orders between 17 “Relevant evidence” means evidence hav- and 26 percent are submitted by stipulation ing any tendency to make the existence of of the parties. any fact that is of consequence to the determination of the action more probable or less APPLICATIONS FOR probable than it would be without the evi- PROTECTIVE ORDERS dence. The relevance of evidence, however, is A. General Provisions not the yardstick by which a court mea- The frequency with which courts em- sures privacy concerns. Rule 26(b)(1) ploy protective orders should influence broadens the scope of potential disclosures counsel to draft the application with a de- as follows: tailed statement of: Parties may obtain discovery regarding • the categories of information that any matter, not privileged, that is relevant to would be subject to the order; the claim or defense of any party. . . . Rel- • the procedures proposed for determin- evant information need not be admissible at ing which information falls within the pro- trial if the discovery appears reasonably cal- tected categories; culated to lead to the discovery of admis- • the procedure for designating material sible evidence. subject to the order; Rule 26(c) potentially narrows the scope • the persons who may have access to of disclosure by authorizing the court, for the material protected by the order; good cause shown, to enter any order • the extent to which protected materi- which justice requires to protect a party or als may be used in related litigation; person from annoyance, embarrassment, • the procedures for maintaining secu- oppression or undue burden or expense. rity; The options, which are not exclusive, in- • the procedures for challenging par- clude: ticular claims of confidentiality; 1. Precluding the discovery. • the exceptions, if any, to the order’s 2. Specifying the terms and conditions general prohibitions against disclosure; of the discovery. For example, in cases that • the termination of the order after the involve incarcerated plaintiffs, courts, conclusion of the litigation or at another largely as a housekeeping matter, often time; have directed that a deposition be con- • the return or destruction of materials ducted by telephone conference call or received pursuant to the order; and solely on written questions. The same con- • the court’s authority to modify the or- siderations may apply when the witness is der, both during and after the conclusion of located at a distance that does not justify the litigation.1 the travel expense of attorneys. The provisions of the Federal Rules of Courts also may adjourn ongoing dis- Civil Procedure governing the issuance of covery proceedings to the courthouse, not protective orders are in Rule 26(c) and merely to maintain control over obstreper- were formulated to deter any improper use ous lawyers, the most common reason, but of the broad range of discovery options au- to even the playing field. In one case, a thorized by the Federal Rules. relatively small municipal police depart- Rule 402 of the Federal Rules of Evi- ment wanted depositions of armed and uni- dence provides in substance that all rel- formed defendant-officers conducted at the evant evidence is admissible except as oth- precinct so that coverage could be main- erwise provided by law, and that evidence tained. The plaintiff complained that he felt which is not relevant is not admiss intimidated by the presence of the guns in ible. Under Evidence Rule 401: the deposition room, so the depositions were adjourned to the federal courthouse, 1. MANUAL FOR COMPLEX LITIGATION (THIRD) where all those who enter are required to at 67-69 (Federal Judicial Center 1995). check weapons at the door. Judicial Perspective: Requirements for Protective Orders Page 91

3. Specifying and limiting the means or quested disclosure. For example, plaintiffs methods of discovery. For example, unless who allege physical injuries caused by a the court orders otherwise, Local Rule 33.3 defendant have placed their medical condi- of the Southern District of New York re- tions in issue and thereby have waived the stricts the categories of information that privilege and privacy rights concerning may be the subject of interrogatories at the medical records and information that other- beginning of discovery to the names of wise might have shielded the records from witnesses with knowledge of information disclosure. When a plaintiff seeks recovery relevant to the subject matter of the action, for emotional distress and the costs of psy- the computation of each category of dam- chiatric and other mental health treatment age alleged, and the existence, custodian, alleged to have been necessitated by the location and general description of relevant action of a defendant, that defendant often documents or information of a similar na- demands all records of all treatment the ture. plaintiff may have received. The demand 4. Limiting the scope of discovery to may reach back for many years or even the specified matters and excluding inquiry plaintiff’s entire life. into others. In support of the demand, the defendant 5. Limiting the persons present during asserts that some prior incident of psychiat- the taking of discovery. Issues in this area ric trauma, and not the alleged act or omis- abound. In almost every case involving ex- sion, may have caused the injury. Typi- pert evidence, counsel want their expert cally, the plaintiff will oppose the demands present at most depositions and especially because the treatment was too remote in at the deposition of the opposing expert. time to be relevant. On an in camera re- 6. Opening of sealed depositions only view, the court usually lacks the expertise on order of the court. in the field of mental health to determine 7. Limiting or specifying how trade the relevance of the requested information secret or other confidential research, devel- or whether it is likely to lead to admissible opment or commercial information will be evidence. revealed. When commercially valuable in- While a court may conclude that plain- formation is in issue, as in cases of alleged tiffs have placed their entire mental health theft of trade secrets, courts often appoint history in issue merely by suing, a more an independent expert to examine the for- thoughtful approach recognizes that what mula or process of each side’s product and has actually been placed in issue is infor- render an opinion. This procedure protects mation about the injuries that are alleged to each party’s confidential material from the have resulted from the defendant’s act or other. acts and the related treatment. Of course, 8. The simultaneous filing of specified the defendant is entitled to explore other documents in sealed envelopes to be causes of the claimed injuries, while plain- opened only as directed by the court. tiffs have the right to maintain the confi- In fashioning a protective order, or in- dentiality of unrelated conditions and treat- deed in determining whether to enter one, ment. the court will balance the movant’s legiti- A helpful solution, one that balances mate concerns about confidentiality against these competing interests, permits defense the needs of the litigation, protecting indi- counsel and a retained expert in the field of vidual privacy or the commercial value of mental health to examine the plaintiff’s the information, while making it available records under a confidentiality order that for legitimate litigation use.2 initially limits disclosure to counsel and the expert, and that specifically precludes them from disclosing any of the information to B. Sensitive Health Information Applications for protective orders often are made by parties who seek to avoid re- 2. Id. at 69. Page 92 DEFENSE COUNSEL JOURNAL—January 2003 anyone, including the client, without a fur- lihood that the court will order the discov- ther order of the court. Neither may use nor ery. The key, therefore, is to evaluate care- copy any of the information for any pur- fully exactly what information is necessary pose except to evaluate its relevance to the and relevant for the litigant’s purposes and issues in the litigation. to explore means of providing it to the par- After that evaluation defense counsel ties, while protecting all other information will advise plaintiff’s counsel if any infor- from disclosure. mation in the contested records has been For example, in a recent case before the deemed relevant to the litigation. If the in- authors, a plaintiff, who was employed as a formation is deemed relevant, and if the social worker at a medical facility, alleged plaintiff’s counsel, after having consulted that she had been terminated in retaliation its own expert, disagrees, the court will for her complaints that patients in certain conduct a hearing, take the testimony of diagnostic categories were being trans- both experts and determine the issue. This ferred to nursing homes without their con- procedure protects both the plaintiff’s right sent and without the appointment of com- to privacy in unrelated information and the mittees as required by New York law.3 defendant’s right to explore other causes of The information genuinely relevant to the alleged injuries. the issues in the suit was the existence and The situation changes when a non-party diagnoses of the patients on which the asserts a privacy interest. In that circum- plaintiff was relying as the factual predi- stance, the court should require that notice cate for her allegations of retaliation. Dis- be provided to the interested individual or closure of the actual identities of those pa- entities whose privacy interests may be tients was neither necessary nor desirable. compromised by disclosure. The parties, with some assistance from the In a form approved by the court, the no- court, agreed to a method for separating the tice should provide basic information about needed information while maintaining the the nature of the litigation, the parties, the confidential aspect of the records. relief sought in the lawsuit, the information Counsel for the defendant medical facil- sought that affects the non-party’s privacy ity created a list of the names of the pa- rights and information about how to con- tients affected and their diagnoses. The vey, by telephone or in writing, the non- plaintiff’s counsel then inspected the files party’s position concerning disclosure. It under a “counsel’s-eyes-only” confidenti- should also set a date when the non-party ality order to verify that all the patients may appear in person to express directly its known by his client to have been the sub- view concerning disclosure so as to assist ject of her complaints were included. Each the court in balancing privacy concerns patient was then assigned a code number, against the need for disclosure. and all identifying data was redacted from Counsel for a party seeking such disclo- the documents that were to be used in the sure should limit the scope of the informa- litigation. The court was provided, in cam- tion sought to that necessary to pursue any era, with both the patient list and the iden- claim or defense in the litigation, and no tifying code numbers. more. The more circumspect the intrusion Counsel then stipulated to identify pa- into privacy rights, the less likely the pro- tients during the depositions and at trial by test from the non-party. Absence of re- code number only. With the cooperation of sponse from a non-party increases the like- counsel, the litigants had full access to all required information, while the privacy 3. The decision in this matter and others men- rights of the patients were protected. tioned in this discussion were set forth in an unpub- lished order or orally on the record, a procedure which facilitates the disposition of discovery dis- C. Statutory Considerations putes and efficient case administration. Unfortu- nately, oral rulings on the record complicate In some cases, a statute controls the counsel’s search for specific precedent. terms of disclosure. The Family Education Judicial Perspective: Requirements for Protective Orders Page 93

Rights and Privacy Act of 1974 (FERPA), the order. In Securities and Exchange 20 U.S.C. § 1232(g), also known as the Commission v. TheStreet.com,6 the U.S. Buckley/Pell Amendment, which creates Court of Appeals for the Second Circuit no right to sue for unauthorized disclo- affirmed a decision in which Judge Rakoff sure,4 allows access by parents to the of the Southern District of New York had school records of their children in order to unsealed portions of depositions previously challenge entries in those records but re- designated as confidential by the parties in stricts third-party access absent consent of a so-ordered stipulation. Judge Rakoff the parents or of the student, if the student found that the presence at the depositions is over the age of 18. FERPA’s provisions of interested third parties who had not condo not create a bar to disclosure, but they sented to the stipulation waived any claim allow an education institution to release to the confidentiality of the material. Nev- records and information only in compli- ertheless, the particularly sensitive nature ance with a validly issued subpoena or a of the information in the deposition, which court order and only after notification to concerned an allegedly illegal stock trading the parents and students whose records are scheme, warranted a new protective order. to be disclosed. A school district that fails When the plaintiff, TheStreet.com, an to comply with the provisions of FERPA online business news service, applied for by enforcing standards relating to access to access to the information, Judge Rakoff educational records may jeopardize its fed- found that the media (and thus the pub- erally funded programs. lic’s) interest in disclosure outweighed the All of the previously discussed concerns risk of harm that the disclosure might regarding the limiting of the scope of dis- cause and granted the motion for access. closure apply and should be considered in While the Second Circuit recognized the seeking such disclosure. In considering strong presumption that protective orders FERPA applications, the court will balance will remain in force, with the exception of the need of the requesting party for the in- the presumption of access to the narrow formation against the privacy interests of category of “judicial documents” estab- the student. In cases in which information lished in United States v. Amodeo,7 it also concerning the test scores of large numbers recognized that the public should not be of students may be relevant, counsel denied access to documents filed with the should consider a summary, chart or calcu- court that are relevant to the performance lation reflecting the information. A sum- of the court’s judicial function.8 mary, admissible under Federal Evidence Accordingly, courts should weigh the Rule 1006, provides the necessary informa- significance of the material in issue against tion without disclosing the identities of in- the risk of harm to the privacy interest of dividuals. While the rule requires that the those opposing disclosure. In determining files or documents summarized be made applications to modify a protective order, available to the adverse party, stipulations courts will balance the continuing need for or a confidentiality order tailored to the enforcement of the order and the continuity needs of the particular situation may be appropriate.5

ENSURING PRIVACY 4. Gonzaga University v. Doe, 122 S.Ct. 2268 (2002), rev’g and remanding 24 P.3d 390 (Wash. A. General 2001), decision below, 992 P.2d 545 (Wash.App. 2000). Given their relatively high immutability, 5. See Zayre Corp. v. S.M. & R. Co., 882 F.2d 1145, 1149 (7th Cir. 1989); Colorado v. McDonald, counsel should ensure that the client and 15 P.3d 788 (Colo.App. 2000). all personnel in counsel’s office understand 6. 273 F.3d 222 (2d Cir. 2001). the specific terms of any protective order 7. 44 F.3d 141, 145 (2d Cir. 1995). 8. See Michael C. Silverberg, Federal Discovery, and that everyone maintains full compli- N.Y. L.J., January 3, 2002, at 3, for a thorough and ance with both the letter and the spirit of enlightening discussion of the case. Page 94 DEFENSE COUNSEL JOURNAL—January 2003 of the necessity for it against whatever fac- claims for alleged violations of his federal tors warrant its discontinuance. civil rights arose from a direction by the probation department of a state court to B. Sanctions submit to an evaluation by penile plethys- mograph at a sexual behavior clinic. The Courts’ efforts to ensure that private in- device measures and records the subject’s formation remains relatively undisclosed reaction to erotic stimulus. would be futile if not for the availability of Pursuant to a stipulated confidentiality sanctions, the range of which is set forth in order, which forbade any copying or in- Civil Practice Rule 37.9 Significantly, Rule spection of these materials outside the law- 37(a)(3) provides that “an evasive or in- suit, the plaintiff’s counsel obtained files of complete disclosure, answer or response is other clients that had been referred to the to be treated as a failure to disclose, answer clinic. About six months after the stipula- or respond.” Under Rule 37(a)(4), on a motion and during a taped segment of a local tion to compel discovery, the court may or- news broadcast, a reporter displayed on der full disclosure and award reasonable camera some of the material furnished pur- attorney’s fees and expenses to either side, suant to the stipulation. The plaintiff’s depending on the outcome of the motion. counsel offered an assortment of after-the- In response to non-compliance the court fact and unpersuasive excuses, the least of should impose the least harsh or serious which may have been that identifying in- sanction commensurate with the recalci- formation about the clients had been re- trance and designed primarily to bring dacted from the files before the reporter about or influence compliance. saw them. None of the excuses justified the Rule 37(b)(2) provides the following breach of confidentiality. non-exclusive list: The court reminded the plaintiff’s coun- the subject information or other desig- • sel of the following principle, which no nated facts will be deemed established; litigator should forget: “When counsel preclude the offending party from op- • willingly accedes to the entry of a stipu- posing or supporting designated claims or lated protective order, the court will be defenses or introducing designated matters hesitant to relieve that party of its obliga- into evidence; tions, particularly when the other party strike pleadings or parts of pleadings, • produced discovery in reliance on their dismiss the action or parts of it, enter a agreement.”11 The sanctions were a fine default judgment, or stay all proceedings payable to the court, a sum payable to the until compliance with the discovery order defendants’ attorney for having had to has been accomplished; bring the application, a direction to return impose contempt for failure to obey a • all the originals and copies to defense court order except an order to submit to a counsel and a limitation on future access to physical or mental examination. confidential records only during regular In Drought v. Parisi,10 I addressed a business hours at the clinic’s office. There troubling violation of a confidentiality or- was no appeal. der. An adolescent (minor) plaintiff’s Although ultimately the district judge assigned to Drought dismissed the case on summary judgment, the incident concern- 9. Lest the obvious be overlooked, he who has already revealed publicly information similar to that ing the violation of the confidentiality or- revealed in violation of a confidentiality order will der illustrates the options and flexibility have no cause for complaint. See Gordy Co. v. Mary available to a court. Noteworthy, however, Jane Girls, Inc., 1989 Westlaw 28477, at *7-*8 (U.S.D.C. S.D. N.Y.). despite the egregious nature of the viola- 10. 92 Civ. 2188 (GLG)(MDF), U.S.D.C. S.D. tion, a preclusion order was not issued, and N.Y., January 24, 1994. no claims were dismissed. 11. Parkway Gallery Furniture Inc. v. Kittinger/ Pennsylvania House Group Inc. 121 F.R.D. 264, 267 Violations of a confidentiality order or (M.D. N.C. 1988). other unauthorized revelations of private or Judicial Perspective: Requirements for Protective Orders Page 95 sensitive information may result in the in- or limiting disclosures of information.13 fliction of significant harm or injury. De- Apart from public policy enactments, how- spite the current era of reality television, ever, should the common law provide re- the average male adolescent would un- course for the victims of errant disclosers? doubtedly be mortified to learn that the For a creative plaintiff’s attorney with a mere fact of his examination by penile pl- case that compels the granting of relief, the ethysmography, let alone his arousal pat- answer may be that it should and that it tern, had been broadcast on television. To already does. A suggestion follows for the be sure, that event did not occur, but what pleading of a cause of action for the if it had? More significantly, what if infor- wrongful disclosure of private genetic in- mation of an intensely personal, intimate formation. and individual nature were revealed without justification or authorization, and the 1. Federal revelation resulted in serious conse- From the federal perspective, neither the quences? federal courts nor Congress is likely to recognize this claim. As the U.S. Supreme C. Public Policy Court has observed, through Justice and A fundamental function of the judiciary now Chief Justice Rehnquist: “While there in our society is to preserve and protect the is no ‘right of privacy’ found in any spe- rights and interests of individuals and enti- cific guarantee of the Constitution, the ties. Research developments in the area of Court has recognized that ‘zones of pri- genetics and the human genome have led vacy’ may be created by more specific to the extrapolation that information en- constitutional guarantees and thereby im- coded on DNA provides previously un- pose limits upon government power.”14 known revelations about how stimuli may While Congress may regulate the distri- affect an individual. Although this infor- bution of private information pursuant to mation has extraordinary commercial po- its power to regulate interstate commerce15 tential, an individual who produces the or as part of its power to regulate the con- DNA may wish to preserve the integrity duct of the federal government,16 the fed- and secrecy of true identity, so to speak, to eral courts have relied on the Fourth avoid being the victim of embarrassment, a Amendment17 and the due process clause of stereotype, or the scientific trend of the the 14th Amendment to find limitations on era.12 governmental power to affect private mat- In many circumstances, society has an ters. obligation to preserve that choice through The Supreme Court stated in Whalen v. the enactment of public policy forbidding Roe:

12. See Taylor v. Kurapati, 600 N.W.2d 670 to deny or disparage others retained by the people” (Mich.App. 1999) (discussing the potential social does not confer “substantive rights in addition to consequences of information derived from DNA those conferred by other portions of our governing analysis); Rhode Island v. Morel, 676 A.2d 1347, law. The Ninth Amendment ‘was added to the Bill of 1356 (R.I. 1996). Rights to ensure that the maxim expressio unius est 13. E.g., N.Y. PUB. HEALTH LAW § 2780 et seq. exclusio alterius would not be used at a later time to (HIV and AIDS related information); N.Y. PUB. deny fundamental rights merely because they were OFF. LAW § 91 et seq. (Personal Privacy Protection not specifically enumerated in the Constitution.’” Law). 15. E.g., Reno v. Condon, 528 U.S. 141, 148-49 14. Paul v. Davis, 424 U.S. 693, 712-13 (1976), (2000) (Driver’s Privacy Protection Act of 1994). accord Katz v. United States, 389 U.S. 347, 350-51 16. E.g., 5 U.S.C. § 552(b)(6) (Freedom of Infor- (1967); Griswold v. Connecticut, 381 U.S. 479, 484 mation Act does not apply to “personnel and medical (1965) (stating “various [constitutional] guarantees files and similar files the disclosure of which would create zones of privacy”). constitute a clearly unwarranted invasion of personal In Gibson v. Mathews, 926 F.2d 532, 537 (6th privacy”). Cir. 1991), the Sixth Circuit stated that the language 17. E.g., Chandler v. Miller, 520 U.S. 305, 313 of the Ninth Amendment, “The enumeration in the (1997). Constitution, of certain rights, shall not be construed Page 96 DEFENSE COUNSEL JOURNAL—January 2003

The cases sometimes characterized as specific recognition of privacy has sub- protecting “privacy” have in fact involved at jected enactments to “strict scrutiny.”23 least two different kinds of interests. One is In California, the same recognition has the individual interest in avoiding disclosure spawned a cause of action similar in plead- of personal matters, and another is the inter- ing and proof to a federal claim of employ- est in independence in making certain kinds ment discrimination premised on Title VII. of important decisions.18 The plaintiff must establish a legally pro- It is ironic that if Congress were to rely tected privacy interest, a reasonable expec- on Section 1 of the 14th Amendment as tation of privacy in the circumstances and authority to create a cause of action for conduct that constitutes a serious invasion violating federal public policy concerning of privacy. The defendant may negate any a state’s handling or disclosure of private of these elements, or as an affirmative de- information, in the absence of a waiver, the fense may demonstrate that the invasion is effort would probably be stymied by the justified because it substantively furthers state’s 11th Amendment immunity from one or more countervailing interests. If the suit in federal court.19 Similarly, the recog- defendant succeeds, the plaintiff then may nition of an individual’s interest in nondis- rebut the countervailing interest by show- closure is likely to evaporate in a scheme ing that feasible and effective alternatives that balances the government’s interest in have a lesser impact on the privacy inter- disseminating the information against the est.24 individual’s interest in keeping the genetic As these examples illustrate, state courts profile private.20 have experience in handling and analyzing The limited reach of the federal zone of privacy claims premised on state constitu- privacy compels the practitioner to look tional law. Constitutional provisions, how- elsewhere for a theory of recovery. ever, usually authorize or limit the power of government and its agencies. They do 2. State not restrict the conduct of non-governmen- Some state constitutions specifically ac- tal individuals and entities involved in the knowledge a citizen’s right to privacy.21 collection of samples and their DNA analy- Other states have found privacy rights from ses and the disclosure or nondisclosure of the body of existing law, which includes the results. Like any interest group, those the state’s statutory and constitutional pro- involved in this enterprise or industry may visions.22 With respect to a limitation on organize to lobby the state legislature so as legislative power, a state constitution’s to affect or even thwart the enactment of

18. 429 U.S. 589, 598-99 (1977) (footnotes omit- of having committed a crime, nevertheless be able to ted), rev’g 403 F.Supp. 931 (S.D. N.Y. 1975). For regain it after the proverbial debt to society has been earlier proceedings below, see 480 F.2d 102 (2d Cir. paid? 1973), rev’g 357 F.Supp. 1217 (S.D. N.Y. 1973). 21. E.g., CAL. CONST. Art. I § 1 (“All people are 19. See Kimel v. Florida Bd. of Regents, 528 by nature free and independent and have inalienable U.S. 62, 81 (2000). rights. Among these are . . . privacy.”); MONT. 20. See Roe v. Marcotte, 193 F.3d 72, 80 (2d Cir. CONST. Art. II § 10 (“The right of individual privacy 1999); cf. Powell v. Schriver, 175 F.3d 107, 111 (2d is essential to the well-being of a free society and Cir. 1999) (interest in privacy of medical informa- shall not be infringed without the showing of a com- tion contained in record will vary with condition). pelling state interest.”); WASH. CONST. Art. I § 7 These cases and Schlicher v. (NFN) Peters I & I, (“No person shall be disturbed in his private affairs, 103 F.3d 940 (10th Cir. 1996), involve the state’s or his home invaded, without authority of law.”) use of individuals in custody to establish a DNA data 22. See, e.g., Jegley v. Picado, 80 S.W.3d 332 bank to deal more effectively with recidivism. (Ark. 2002). Courts allow the collection of this information be- 23. Gryczan v. Montana, 942 P.2d 112, 122 cause the governmental interest in solving crime ef- (1997) (legislation must be justified by compelling ficiently is legitimate and the intrusion to obtain the state interest and must be narrowly tailored to effec- DNA is minimal. These cases raise an issue that has tuate only that compelling interest). not been addressed judicially: Should an individual, 24. Am. Academy of Pediatrics v. Lungren, 940 who apparently has lost the right to privacy by virtue P.2d 797, 811 (Cal. 1997). Judicial Perspective: Requirements for Protective Orders Page 97 public policy that would regulate their ac- “[A] trade secret is ‘any formula, pattern, tivities. Given the formalities of the pro- device or compilation of information which cess of judicial review, organized lobbying is used in one’s business, and which gives has far less impact on a lawsuit grounded [the owner] an opportunity to obtain an ad- in a common law cause of action. vantage over competitors who do not know or use it.’” In determining whether information constitutes a trade secret, New York D. Framework for a Remedy courts have considered the following fac- The potential application of the results tors: of an individual’s DNA analysis requires a (1) the extent to which the information is framework that protects one from commer- known outside of the business; (2) the extent to which it is known by employees and oth- cial exploitation and respects the prefer- ers involved in the business; (3) the extent ence for maintaining privacy. of measures taken by the business to guard Traditional “privacy” torts were devel- the secrecy of the information; (4) the value oped before our level of knowledge about of the information to the business and its the human genome. With the exception of competitors; (5) the amount of effort or the public disclosure of private facts, those money expended by the business in develop- torts focus on commercial exploitation. In ing the information; (6) the ease or difficulty New York state, statutory enactments have with which the information could be prop- 27 limited their scope in a manner that does erly acquired or duplicated by others. not favor an analogy between the rights DNA analysis is a compilation of infor- protected by the statutes and an indivi- mation that undeniably gives the owner an dual’s interest in maintaining the privacy opportunity to obtain an advantage over of DNA information.25 The concepts of competitors who do not know or use it. If property involved in commercial exploita- insurance companies, health care providers tion also limit the reach of the tort of con- and purveyors of goods and services intend version. to rely on this information to determine For instance, in a California case, al- whether to accept customers and how to though the result may be fact specific, the market their products, the information is allegations that a physician had removed priceless. It cannot be duplicated or ac- organ tissue from a patient with a rare quired without cooperation or compulsion. blood type for research purposes without Perhaps most important, the owner must telling the patient about the intended use maintain the secrecy of the information in and future prospects for profit-making en- order to emphasize the privacy interest in deavors did not fit neatly into the require- it. In sum, the results of DNA analysis ar- ments for conversion, although they did guably qualify for trade secrets protection state a claim for breach of the physician’s under the traditional theory. fiduciary responsibility premised on the The desire to keep private information patient’s lack of informed consent to the private arises from something more than treatment.26 the avoidance of commercial exploitation. The framework for a remedy lies in the The interest is personal and as a result, a concepts of trade secrets and prima facie tort. The U.S. Court of Appeals for the Second Circuit has declared: 25. N.Y. CIV. RIGHTS LAW §§ 50 through 52. 26. Moore v. Regents of Univ. of California, 793 To succeed on a claim for the misappro- P.2d 479, 487-96 (Cal. 1990). priation of trade secrets under New York 27. North Atlantic Instruments Inc. v. Haber, 188 F.3d 38, 43-44 (2d Cir. 1999), quoting Ashland law, a party must demonstrate: (1) that it Management Inc. v. Jamien, 624 N.E.2d 1007, 1013 possessed a trade secret, and (2) that the de- (1993) (citations omitted). In order to establish fed- fendants used that trade secret in breach of eral jurisdiction, the parties would have to satisfy the an agreement, confidential relationship or diversity of citizenship requirements, or the claim will have to qualify for supplemental or pendent ju- duty, or as a result of discovery by improper risdiction. See Kirschner v. Klemons, 225 F.3d 227, means. . . . 239 (2d Cir. 2000). Page 98 DEFENSE COUNSEL JOURNAL—January 2003 court may be understandably reluctant to special damages may vary with the con- analogize the wrongful disclosure of per- text.31 sonal information to a tort that protects in- The combination of elements of trade se- terests in business activity. To separate and crets and prima facie tort results in a cause emphasize the personal nature of the inter- of action suited to protecting an indivi- est protected, the claim may require proof dual’s interest in maintaining the privacy of an additional element or elements. of DNA test results. To recover, plaintiffs Recovery for prima facie tort requires would be required to show that the secrecy proof of “(1) intentional infliction of harm, or confidentiality of their DNA had been (2) causing special damages, (3) without maintained. For that reason, the careless excuse or justification, (4) by an act or deposit of DNA, or substances which con- series of acts that would otherwise be law- tain it, would provide a court with less in- ful.”28 Its distinguishing feature is that ma- centive to protect the privacy interest in levolence is the sole motive for the defen- nondisclosure.32 The privacy interest, how- dant’s otherwise lawful act.29 Comment to ever, should inhere in the circumstances. A Section 870 of the Restatement (Second) of plaintiff should not be required to engage Torts refers to New York’s enumeration of in a ceremony or provide a document to the elements as an effort to set forth the establish that DNA voluntarily given is to requirements with more rigidity. The Re- be used only for the purpose that has been statement employs language intended as a revealed or agreed on. general principle rather than setting forth Inclusion of the elements of the inten- specific rules: tional infliction of harm and special damages reduces the likelihood that this cause One who intentionally causes injury to another is subject to liability to the other for of action could be used to seek redress for that injury, if his conduct is generally cul- de minimis or inconsequential revela- pable and not justifiable under the circum- tions.33 Traditionally, courts have subjected stances. This liability may be imposed al- intentional conduct to judicial scrutiny and though the actor’s conduct does not come should be open to the concept of compen- within a traditional category of tort liability. sating a plaintiff who can demonstrate loss, New York’s concept of “special dam- economic or personal, as a result of the dis- ages” may be narrower than in other juris- closure of private DNA information. dictions,30 although the requirements for

28. Curiano v. Suozzi, 469 N.E.2d 1324, 1327 injury not ordinarily result in all civil actions) (N.Y. 1984), aff’g 477 N.Y.S.2d 13 (App.Div. 1st (Mayland and Virginia law); Moore v. Boating In- Dep’t 1984). If the means are illegal and corrupt the dustry Ass’ns, 754 F.2d 698, 716 (7th Cir. 1985) claim is referred to as “intentional tort.” Chen v. (Illinois law); Patten Corp. v. Canadian Lakes Dev. United States, 854 F.2d 622, 628 (2d Cir. 1988) Corp., 788 F.Supp. 975, 979 (W.D. Mich. 1991) (N.Y. law). (special damages are those that actually but not nec- 29. Burns Jackson Miller Summit & Spitzer v. essarily result from alleged injury) (Michigan law); Lindner, 451 N.E.2d 459 (N.Y. 1983), aff’g 452 In re Hawaii Fed. Asbestos Cases, 734 F.Supp. 1563, N.Y.S.2d 80 (App.Div. 2d Dep’t 1982). 1567 (D. Hawaii 1990) (special damages compen- 30. Wahlstrom v. Metro-North Commuter R.R. sate for specific out-of-pocket financial expenses and Co., 89 F.Supp.2d 506, 532 (S.D. N.Y. 2000) (spe- losses) (personal injury; Hawaii law); RESTATEMENT cial damages must be pleaded fully and accurately so (SECOND) OF TORTS § 904 (1979). as to relate causally actual losses to allegedly tor- 32. See Lavalle v. State of New York, 696 tious act or acts. N.Y.S.2d 670, 671 (Sup.Ct. Duchess County 1999). 31. See Tomai-Minogue v. State Farm Mut. Auto 33. See Webb v. Goldstein, 117 F.Supp.2d 289, Ins. Co., 770 F.2d 1228, 1237 (4th Cir. 1985) (in 298 (E.D. N.Y. 2000); D’Andrea v. Rafla-Deme- malicious prosecution action, special damages entail trious, 972 F.Supp. 154, 157 (E.D. N.Y. 1997), aff’d, some arrest of person, seizure of property, or other 146 F.3d 64 (2d Cir. 1998) (per curiam). The Privacy Project Protection of Personal Data: The United Kingdom Perspective

The U.K.’s new Data Protection Act sets up a comprehensive and detailed regime to which multinationals must conform for the transfer of personal data

By Laurel J. Harbour, IADC member Laurel J. Harbour is co- By Ian D. MacDonald and Eleni Gill managing partner in the London office of Shook, Hardy & Bacon, where she con- HE EXPLOSION of information centrates in commercial litigation, in par- power has become a fundamental fea- ticular product liability claims against T pharmaceutical companies and other ture of business worldwide. The opera- manufacturers. She is a graduate of the tional and commercial success of many University of Iowa (B.A. 1969, M.A. 1971, organisations depends on their ability to J.D. 1974). obtain, process and store vast quantities of Ian D. MacDonald, formerly a partner information about employees, customers in the Canadian law firm Davies Ward and the general public. The same techno- Philips & Vineburg, is also a co-managing logical progress that has made this possible partner in the London office of Shook, has, however, brought with it a growing Hardy & Bacon and concentrates in com- concern on the part of European law mak- mercial transactions relating to intellec- ers that its use might weaken or undermine tual property. He has a B.A. (1983) from individual human rights, particularly the Simon Fraser University in Vancouver, and M.A. (1987) from the University of right to privacy. North Carolina, and an LL.B. from The Data Protection Act 1998 (DPA), Dalhousie University in Nova Scotia. which came into effect on March 1, 2000, An English solicitor, Eleni Gill also is is the latest piece of United Kingdom legis- located at Shook, Hardy & Bacon, Lon- lation to regulate the use of personal data.1 don. She concentrates in product liability The DPA implements the Directive 95/ litigation, employment law and data pro- 46/EC 24 October 1995 of the European tection issues. She was educated at Parliament and the Council of the Euro- Manchester Metropolitan University (LPC pean Union on the Protection of Individu- 1994) and the University of Sheffield als with Regard to the Processing of Per- (LL.B. 1993). sonal Data and the Free Movement of Such Data.2 The European data protection re- small and regardless of the nature of their gime is an attempt to balance the interests operations. of the freedom of the individual, the free The provisions of the DPA are imple- movement of information and the freedom mented and enforced by the Information to trade. Commission, an independent supervisory The U.K. approach to data protection is one of the more liberal in Europe, yet the DPA nonetheless imposes wide-ranging 1. 1998 c. 29. Available at http://www.dataprotection.gov.uk/dpr/dpdoc.nsf. Written answers with obligations on organisations in relation to respect to the DPA from 10 June 1998 are available their use of personal data. These obliga- at http://www.publications.parliament.uk/cgi-bin/ tions are far-reaching and, with a few ex- lds98/text/80616w02.htm#80616w02_wqn1 2. 1995 O.J. (L 281) 31-50. Available at http:// ceptions, apply to all organisations, both europa.eu.int/servlet/portail/RenderServlet?search public and private, no matter how big or =DocNumber&lg=en&nb_docs=25 Page 100 DEFENSE COUNSEL JOURNAL—January 2003 body appointed by the Crown. Richard data and any other information which is in Thomas has been appointed Information the possession of, or is likely to come into Commissioner effective 1 October 2002, to the possession of, the data controller.” This succeed Elizabeth France, the first com- concept is interpreted broadly. It covers in- missioner. The DPA gives the commis- formation concerning an individual in both sioner investigative powers, including the a personal and business capacity (as in the power to obtain search warrants and to take case of a sole trader) and also includes any action against organisations in breach of expression of opinion or intention about the statutory regulations. The commis- the data subject, which is clearly relevant sioner’s office has traditionally viewed it- in the personnel context. self as more of an educator than a regulator Contact names and addresses, e-mail ad- and pursued enforcement procedures only dresses and clinical data, for example, are in cases of flagrant breach. In 2002, how- all considered personal data. An additional ever, it launched a high-profile advertising category of “sensitive” personal data under campaign informing individuals of their the DPA includes, among other things, data rights under the DPA, and it is currently relating to the racial or ethnic origin, politi- reviewing its enforcement procedures. cal opinions, religious beliefs and physical This article summarizes the key provi- or mental health of an individual. More sions of the U.K. data protection regime, stringent regulations apply to the process- including the central statutory definitions, ing of personal data categorized as “sensi- the main duties imposed on organisations tive.” that process personal data (“data control- The DPA applies to personal data that lers”), the rights of individuals about are “processed.” This is an extremely whom personal information is being pro- broad provision, so broad, in fact, that the cessed (“data subjects”), and the regulation commissioner in a legal guidance has of transborder data flows. stated that “it is difficult to envisage any action involving data which does not SCOPE OF THE DPA amount to processing within this definition.” The statute defines “processing” as The DPA regulates the “processing” of “personal data.” “Data” is defined as com- obtaining, recording or holding the informa- puterized information as well as personal tion or data or carrying out any operation or set of operations on the information or data, data in manual files, provided the data are including (a) organisation, adaptation or “recorded as part of a relevant filing sys- alteration of the information or data, (b) re- tem.” A “relevant filing system” is defined trieval, consultation or use of the informa- as “any set of information relating to indi- tion or data, (c) disclosure of the informa- viduals to the extent that, although the in- tion or data by transmission, dissemination formation is not processed by means of or otherwise making it available, or (d) equipment operating automatically in re- alignment, combination, blocking, erasure or sponse to instructions given for that pur- destruction of the information or data. pose, the set is structured, either by refer- Under this definition, processing includes ence to individuals or by reference to virtually any activity performed on data criteria relating to individuals, in such a from holding personal data, to pulling up way that specific information relating to a information on a computer screen, to stor- particular individual is readily accessible.” ing personal data on a computer hard drive. This would include, for example, paper files or card indexes that permit ready ac- DPA DATA PROTECTION cess to specific information relating to par- PRINCIPLES ticular individuals. Personal data are any “data which relate A. The Principles to a living individual who can be identi- The DPA imposes an obligation on data fied—(a) from those data, or (b) from those controllers to comply with statutory prin- Protection of Personal Data: The UK Perspective Page 101 ciples of good information handling, Paragraphs 1 to 4 of Part II of Schedule known as the Data Protection Principles 1 of the DPA contain interpretive provi- (DPP), of which there are eight: sions relating to fairness, which are re- • First, personal data shall be processed ferred to as the “fair processing require- fairly and lawfully and, in particular, shall ments.” not be processed unless (a) at least one of Compliance with the fair processing re- the conditions in Schedule 2 of the DPA is quirements in itself will not ensure that met, and (b) in the case of sensitive per- processing is fair; it is to be seen as a mini- sonal data, at least one of the conditions in mum standard of compliance. The fair pro- Schedule 3 also is met. cessing requirements include consideration • Second, personal data shall be ob- of the method by which the data are obtained only for one or more specified and tained, including whether any person from lawful purposes and shall not be further whom they are obtained is misled about the processed in any manner incompatible with purpose for which they are to be processed. that purpose or those purposes. Furthermore and subject to certain excep- • Third, personal data shall be ad- tions, data are not to be regarded as pro- equate, relevant and not excessive in rela- cessed fairly unless the individual about tion to the purpose or purposes for which whom personal data are to be processed is they are processed. told the identity of the data controller, the • Fourth, personal data shall be accurate purpose for which the data are to be pro- and, where necessary, kept up to date. cessed and any other information which is • Fifth, personal data processed for any necessary for processing to be fair. purpose or purposes shall not be kept for There is no statutory definition of lawful longer than is necessary for that purpose or processing, but the commissioner’s guid- those purposes. ance considers that it includes compliance • Sixth, personal data shall be pro- with all relevant rules of law, both statu- cessed in accordance with the rights of data tory and common law, that relate to the subjects under the DPA. purpose and ways in which the data con- • Seventh, appropriate technical and troller processes personal data. This would organisational measures shall be taken include compliance with the DPA itself against unauthorised or unlawful process- and compliance with common law rules— ing of personal data and against accidental for example, those relating to confidential- loss or destruction of, or damage to, per- ity. sonal data. Furthermore, the first principle states • Eighth, personal data shall not be that personal data may not be processed transferred to a country or territory outside unless at least one of a list of statutory con- the European Economic Area unless that ditions is satisfied. These are known as the country or territory ensures an adequate Schedule 2 conditions and include that the level of protection for the rights and free- individual has given consent to the pro- doms of the data subjects in relation to the cessing or that the processing is necessary processing of personal data. for the purposes of the legitimate interests pursued by the data controller, except B. Interpretation of the Principles where the processing is unwarranted in any particular case by reason of prejudice to These principles, which are the back- the rights and freedoms or legitimate in- bone of the data protection legislation, im- terests of the data subject . In the case of pose significant obligations on data con- sensitive personal data, in addition to com- trollers in the way they obtain, use, store pliance with one of the conditions of and transfer personal data. Not least is the Schedule 2, the data controller must also requirement for data controllers in the first comply with at least one of the conditions principle to ensure that data is processed set out in Schedule 3, which include a re- “fairly and lawfully.” quirement for explicit consent from the Page 102 DEFENSE COUNSEL JOURNAL—January 2003 data subject or a requirement that process- tain exceptions, which include processing ing is necessary for one or more permis- for the purpose of staff administration, ad- sible purposes, such as performance of em- vertising, marketing, public relations and ployment law obligations or the exercise or accounts and records. For the most part, defence of legal rights. there is no requirement to notify the com- The second principle requires, further- missioner about manual processing, again more, that personal data may be processed subject to some exceptions, although the only for lawful and specified purposes, remaining provisions of the DPA still ap- which are notifiable to the commissioner or ply, including the data protection prin- directly to the data subject. Personal data ciples. may not be processed in a way that is in- The notification procedure requires the consistent with those purposes. data controller to provide certain informa- Organisations should ensure that per- tion to the commissioner annually, to- sonal data are adequate, relevant and not gether with a fee, which was set at £35 as excessive given the purposes for which of the fall of 2002. This information, which they are processed. In other words, under can be supplied by post, telephone or the third principle organisations should Internet, is entered onto a public register, identify the least amount of information re- named the Data Protection Register. The quired to fulfill that purpose properly. data controller must specify the (a) “regis- The fourth and fifth principles require trable particulars” and (b) a general de- that personal data must be kept accurate scription of the measures to be taken to and up to date and should not be kept ensure compliance with the Seventh Prin- longer than necessary for the purposes for ciple, which relates to security measures to which they are being processed. In addi- protect data. tion, under the seventh principle, appropri- The “registrable particulars” include (a) ate steps should be taken to guard against the data controller’s name and address, (b) unlawful or unauthorized processing of a description of the personal data being or personal data or against accidental loss or to be processed and the category of data destruction. subjects to which they relate, (c) a descrip- Measures such as controlling access to tion of the purpose of processing, (d) a de- personal data by the provision of secure ar- scription of any intended recipients of the eas and passwords, staff selection and data, and (e) a list of the countries outside training procedures and policies for detect- the European Economic Area that will or ing and dealing with breaches of security might receive the data from the data con- may be appropriate, depending on the cir- troller. Other than the description of secu- cumstances. rity measures taken to protect data, all the information provided by the data controller NOTIFICATION TO appears on the public register. COMMISSIONER TRANSFERS OUTSIDE THE E.E.A. A significant aspect of the U.K. data protection regime is the requirement that A. General data controllers inform the commissioner A noteworthy aspect of the U.K data that they are processing personal data, a protection regime, particularly for organi- procedure referred to as “notification.” The sations with global interests, is the prohibi- processing of personal data without notifi- tion on transfers of personal data to coun- cation is a criminal offence, subject to cer- tries outside the European Economic Area that do not ensure an “adequate level of protection of the rights and freedoms of data subjects in relation to the processing 3. The European Economic Area consists of the 15 member states of the European Union, plus Ice- of personal data,” to quote the eighth prin- land, Liechtenstein and Norway. ciple.3 Protection of Personal Data: The UK Perspective Page 103

B. Exceptions manner as to ensure adequate safeguards for the rights and freedoms of data sub- There are certain important statutory ex- jects. ceptions to the prohibition on the transfer In addition to the statutory exceptions, of personal data, which are set out in the European Commission has determined Schedule 4 of the DPA: that transfers to certain countries, including The data subject has given consent to • Hungary, Switzerland and Canada (for cer- the transfer. tain transfers), are “safe” because their do- The transfer is necessary for the per- • mestic law ensures an adequate level of formance of a contract between the data protection for the rights and freedoms of subject and the data controller or for the data subjects in relation to the processing taking of steps at the request of data sub- of personal data. The effect of the Euro- jects with a view to their entering into a pean Commission’s formal findings is that contract with the data controller. personal data may be freely transferred to The transfer is necessary (a) for the • these countries. conclusion of a contract between the data It is significant that the United States, controller and a person other than the data with its mixture of self-regulation and sec- subject which (i) is entered into at the re- tor-specific rules, is not considered by the quest of the data subject or (ii) is in the European Union to be a country that pro- interests of the data subject, or (b) for the vides an adequate level of protection for performance of such a contract. personal data. As a result, and after consid- The transfer is necessary for reasons • erable discussion, the U.S. Department of of substantial public interest. Commerce and the European Commission The transfer (a) is necessary for the • negotiated a scheme referred to as the “safe purpose of or in connection with any legal harbour” agreement. proceedings, including prospective legal This is a voluntary scheme, administered proceedings; (b) is necessary for the pur- by the U.S. Department of Commerce re- pose of obtaining legal advice; or (c) is quiring companies to declare publicly their otherwise necessary for the purposes of es- membership in the safe harbour and abide tablishing, exercising or defending legal by rules similar to those in force in Europe rights. governing the use of personal data. The The transfer is necessary in order to • rules include notification to individuals as protect the vital interests of the data sub- to the purpose and use for which data is ject. collected, adequate security measures and The transfer is of part of the personal • restrictions on data transfers to third par- data on a public register and any conditions ties. U.K. data controllers may make a pre- subject to which the register is open to in- sumption of adequacy for data transferred spection are complied with by any person to U.S. organisations that have signed up to to whom the data are or may be disclosed the terms of the safe harbour agreement. after the transfer. The transfer is of part of the personal • C. Assessing “Adequacy” data on a public register and any conditions subject to which the register is open to in- It is the responsibility of the data con- spection are complied with by any person troller to determine whether there is an ad- to whom the data are or may be disclosed equate level of protection in the non- after the transfer. E.E.A. country to which the data is being • The transfer is made on terms of a transferred. In practical terms, an adequacy kind approved by the commissioner as en- assessment must be undertaken where the suring adequate safeguards for the rights transfer is not covered by a Schedule 4 ex- and freedoms of data subjects. emption or where the third country to • The transfer has been authorised by which the data is being transferred has not the commissioner as being made in such a been designated as “adequate” by the Euro- Page 104 DEFENSE COUNSEL JOURNAL—January 2003 pean Commission. In these circumstances, On written request and payment of a fee, data controllers should consider whether data controllers must tell individuals the third country has data protection provi- whether their personal data are being pro- sions similar to those afforded to individu- cessed and, if so, give them a description als by the E.U. directive. of the data, the purposes for which data are The DPA suggests various factors that being processed and those to whom the data controllers should consider in assess- data are or may be disclosed. In addition, ing adequacy, including the nature of the the data controller must communicate, in personal data; the country of final destina- an intelligible form, the information to re- tion of the information; the law, relevant questers and any information available to codes of conduct and international obliga- the data controller about the source of tions of the third country; and security those data. measures taken regarding data in the third There are some exceptions to the right to country. The commissioner has issued de- access, including an exemption for infor- tailed guidance for assessing adequacy, mation subject to legal professional privi- which is available on the commission lege, processing undertaken for the “spe- website.4 cial purposes” (journalistic, literary or As an alternative to an adequacy assess- artistic) and the prevention or detection of ment, the data controller in the U.K. may crime. enter into a contract with the recipient of Data subjects also have several options data in the third country requiring adher- open to them to control the activities of ence to certain principles of data protec- organisations that process their personal tion. The European Commission recently data. First, they may request the data con- approved model terms that can be incorpo- troller not to process personal data where rated into such a contract. Data controllers to do so would result in unwarranted and who enter into contracts based on the substantial damage or distress to the data model clauses can transfer personal data to subject or to another. This does not apply the other party in a third country without where the data subject has consented to the the need to make an assessment of ad- processing or where the processing is nec- equacy. The standard contractual clauses essary for the performance of a contract to provide for compliance by the data im- which the data subject is a party, for com- porter with “Mandatory Data Protection pliance with a non-contractual legal obliga- Principles” concerning, for example, secu- tion or for the protection of the vital inter- rity and confidentiality, rights of access, ests of the data subject. rectification of data, and restrictions on on- Second, data subjects may prevent pro- ward transfers. cessing for the purpose of direct marketing, which includes sending mail to individuals RIGHTS OF DATA SUBJECTS promoting a certain product or service and also targeting an individual’s e-mail ac- Concern for the individual’s right to pri- count. vacy is evidenced in the provisions of the Third, under Section 14 of the DPA, DPA enabling data subjects to obtain infor- where a court is satisfied that personal data mation about the processing of personal being processed by the data controller are data and to prevent certain types of pro- inaccurate, the court may order rectifica- cessing from taking place. tion, blocking, erasure or destruction of the data. 4. The Eighth Data Protection Principle and Fourth, the data controller can be pre- Transborder Data Flows, available at http:// www.dataprotection.gov.uk. The guidance is stated vented from making decisions about an in- to be the preliminary view of the Information Com- dividual by automated means alone. missioner and “reflects the current state of thinking” Fifth, individuals who believe that they and that the commissioner’s “views have been (and will be) informed by continuing international nego- are being directly affected by the process- tiations and discussions.” ing of personal data may request the com- Protection of Personal Data: The UK Perspective Page 105 missioner to assess the processing to deter- or contravention; to inspect, examine, op- mine whether it adheres to the provisions erate and test equipment used for process- of the DPA. Such assessments may result ing personal data; and to inspect and seize in the issuing of an information notice or any documents or other material that may an enforcement notice. be evidence of an offence or contravention Data subjects are entitled to claim com- of the DPPs. pensation for any damage suffered as a result of a breach of the DPA by a data con- PRACTICAL TIPS troller and also may claim compensation The DPA is still a relatively new piece for distress. It is a defence to a claim for of legislation and it is still unclear how the compensation for a data controller to show courts will apply the data protection provi- it took reasonable care, given all the cir- sions in practice. The commissioner, how- cumstances, to comply with the provision ever, has issued a useful guidance docu- in question. ment with interpretations of the statutory provisions. The commissioner also has pro- ENFORCEMENT vided advice on a range of subjects, includ- The Information Commissioner is re- ing transborder data flows, notification, the sponsible for enforcing the provisions of Internet and the use of personal data in em- the DPA. The commissioner has the power ployer-employee relationships. to serve information notices and enforce- Organisations currently based in the ment notices. A data controller served with U.K., planning to locate a branch there or an information notice must supply infor- considering transferring data from the U.K. mation to the commissioner that is suf- should ensure that their internal data pro- ficient for a determination whether the tection policies and procedures comply processing breaches the DPA. The com- with the statutory regime. The following missioner may serve an enforcement notice are examples of some issues that an when satisfied that a data controller is con- organisation may want to consider: travening the provisions of the DPA. An • Implement a data protection compli- enforcement notice requires the data con- ance program. troller to take certain specified steps to rec- • Appoint a data compliance represen- tify the breach, including rectifying, block- tative, whose role it is to monitor the pro- ing, erasing or destroying personal data. cessing of personal data to ensure compli- Failure to respond appropriately to a notice ance with the DPA. served by the commissioner is a criminal • Review the organisation’s annual no- offence, although a data controller is ex- tification requirements. empt from complying with an information • Implement training programs for all notice if the required information is subject relevant personnel. to legal privilege. It is a defence for the • Implement technological and organi- data controller to show that it exercised sational measures to protect personal data due diligence to comply with an enforce- from unlawful or unauthorized processing, ment notice. damage, loss or destruction. The commissioner also has the power to • Obtain the consent of data subjects to apply to a circuit judge for a warrant to processing of personal data. enter and search premises when there are • Obtain the consent of data subjects to reasonable grounds for suspecting that the transfers of personal data to countries out- DPA is being violated or an offence com- side the E.E.A. Otherwise, consider mitted. With a warrant, the commissioner whether the transfer satisfies the commis- has wide-ranging powers to enter and sioner’s “good practice approach” to search premises for evidence of the offence transborder data flows. The Privacy Project Protection of Personal Data: The Australian Perspective

New legislation has applied the information privacy principles of 1988 to the private sector through national privacy principles

By Steven Klimt, Narelle Symthe, Steven Klimt is a partner in the Sydney By S. Stuart Clark and Jason Shailer office of the Australian national law firm Clayton Utz, where he concentrates his HE MAIN data protection law in Aus- practice in electronic commerce and retail tralia in relation to privacy is the Pri- banking. He holds B.A., LL.B. and LL.M. T degrees from Sydney University. vacy Act 1988 (Cth). It has been amended Also a partner in the same office, by the Privacy Amendment (Private Sec- Narelle Symthe has experience in elec- tor) Act 2000 (Private Sector Act), which tronic commerce and information technol- came into operation in December 2001 and ogy litigation. She was educated at the effectively extends the operation of the University of New South Wales (B.Com. 1988 act to the private sector. and LL.B.). The regime introduced by the Private IADC member S. Stuart Clark, a mem- Sector Act has far-reaching consequences ber of the IADC Executive Committee, for both the business community and con- also is a partner in the firm and heads the sumers in Australia. The stated aim is to product liability group. He concentrates in reduce obstacles to the development, take- the defense of complex litigation and class actions. He received his B.A. and LL.B. up and use of electronic commerce and degrees from Macquarie University in other new technologies resulting from con- Sydney, and is admitted to practice in New cerns about the possible mishandling of South Wales, Victoria, South Australia personal information by the private sector, and the Australian Capital Territory. while at the same time avoiding excessive A graduate of Sydney University (B.A. red tape and minimising the cost of com- and LL.B.), Jason Shailer is an associate pliance on business. at Clayton Utz. The 2000 Act creates a co-regulatory legislative framework through the development of self-regulatory codes of practice The requirements of the Private Sector by organisations that must achieve certain Act have affected, directly or indirectly, all minimum standards of privacy protection businesses in Australia. Organisations subset out in 10 National Privacy Principles ject to regulation under the act have been (NPPs) in the act. The NPPs are the core of required to implement changes to trans- the private sector regime and establish actional documents, internal and external minimum standards in relation to the col- information handling and security proce- lection, holding, use, disclosure, manage- dures, information technology requirement, access, correction and disposal of ments, customer communications and personal information about natural persons. training of staff in order to comply with the The NPPs also include special measures new regime. Maintaining compliant infor- with regard to certain types of personal in- mation-handling practices is a continuing formation defined as sensitive. In the ab- challenge. sence of a relevant self-regulatory code, It is important to note that the Private the NPPs themselves will apply. Sector Act does not stand alone. Regula- Protection of Personal Data: The Australian Perspective Page 107 tion of information-handling practices in formation and credit reporting practices in Australia intended to protect individuals’ place. privacy has existed in a number of forms prior to the Private Sector Act, although A. What Is Regulated? these existing regimes will not be considered in any detail in this article. 1. Personal Information A number of state and territory govern- The handling of “personal information” ments have enacted legislation affecting is regulated. Personal information is de- their governments’ dealings with individu- fined in Section 6 as: als’ personal information—for example, the Privacy and Personal Information Act Information or an opinion (including in- 1998 in New South Wales. Other exist- formation or an opinion forming part of a ing forms of regulation of information- database), whether true or not, and whether recorded in a material form or not, about an handling practices affecting the private individual whose identity is apparent, or can sector include (1) common law obligations reasonably be ascertained, from the informa- of confidentiality; (2) a number of statutory tion or an opinion. mechanisms affecting specific industry sectors; and (3) voluntary codes of conduct By way of example, this is not personal adopted by industry groups—for example, information, if this information alone is the Insurance Council of Australia, the collected by an organisation: “male, 180 Australian Direct Marketing Association, cm tall, blue eyes.” The identity of the in- and the Australian Bankers Association. dividual is not apparent, nor can it reason- The 1988 Act required federal govern- ably be ascertained from the information, ment agencies to act in accordance with 11 even if, when combined with other infor- Information Privacy Principles (IPPs), mation, the identity of an individual could which are broadly similar to the NPPs. The be ascertained. However, this is personal Privacy Act applies these to private sector information: “[name] male, 180cm tall, organizations (1) in relation to the collec- blue eyes.” From this information the iden- tion, storage, use and security of tax file tity of an individual could reasonably be number information; and (2) in relation to ascertained. the information-handling practices of credit reporting agencies, credit providers and as- 2. Sensitive Information sociated persons. The private sector regime imposes additional requirements on an organisation with SCOPE OF PRIVATE respect to “sensitive information.” Sensi- SECTOR REGIME tive information is defined in Section 6(1) The Private Sector Act introduced a new as: regime, termed the “the private sector re- Information or an opinion about an gime,” which operates within the existing individual’s: structure of the 1988 Privacy Act. Refer- • racial or ethnic origin; or ences in this paper to sections are, unless • political opinions; or otherwise stated, references to sections of • membership of a political association; the Privacy Act 1988, as amended by the or Private Sector Act. • religious beliefs or affiliations; or The 2000 act extends regulation of han- • philosophical beliefs; or dling of all forms of personal information • membership of a professional or trade across the private sector, and it introduces association; or • membership of a trade union; or new provisions and modifies a number of • sexual preferences or practices; or existing provisions, while leaving the pre- • criminal record; existing obligations on private sector that is also personal information; or organisations regarding tax file number in- • health information about an individual. Page 108 DEFENSE COUNSEL JOURNAL—January 2003

Essentially, an organisation is not per- of personal information in their possession, mitted to collect sensitive information ex- even if that information was collected be- cept (1) with the consent of the individual; fore commencement of the private sector (2) where required by law; (3) in limited regime. circumstances, associated with a non-profit organisation’s1 dealings with its members 1. Who Is Affected? (or individuals in regular contact with that The private sector regime applies to the organisation in the course of its activities); acts and practices of “organizations,” a or (4) where collection is necessary for the term that includes bodies corporate, unin- establishment, exercise or defence of a le- corporated associations, partnerships, trusts gal or equitable claim. and individuals. Section 6C. However, In limited circumstances, sensitive infor- some entities are excluded from the defini- mation that is health information may be tion of organization—for example, small collected if it is necessary to provide a business operators. Certain acts and prac- health service to an individual or for re- tices—for example, employee records—are search purposes, where it is not possible to exempt. These exclusions and exemptions use de-identified information. are dealt with below. B. Commencement and Application 2. Who and What Are Excluded? The Private Sector Act commenced on a. Private Affairs 21 December 2001. However, special provision was made for certain small busi- Individuals may be subject to regulation nesses, which will benefit from a delayed under the act as an “organisation” in rela- application period of up to 12 months after tion to their business activities. Acts and 21 December 2001. practices of individuals which are organi- The NPPs regulating collection, use and sations other than in the course of a busi- disclosure of personal information apply to ness carried on by the individual are ex- personal information collected only on or empt. Section 7B(1). Moreover, Section after 21 December 2001. Personal informa- 16E expressly excludes the collection, tion collected before that date may be used holding, use or disclosure or transfer of or disclosed by an organisation without ref- personal information by an individual, or erence to the requirements of the second personal information held by an individual NPP, which regulates use and disclosure of for the purposes of, or in connection with, personal information. However, in many his or her personal, family or household cases it is not practical for organisations to affairs. have separate procedures for use and dis- The term “personal, family or household closure of personal information they hold, affairs” is not defined. Existing case law depending on whether that information was defining “in the course of a business” may collected before or after the commence- provide a guide to determining the circum- ment of the private sector regime. stances that fall within this exemption. In any event, organisations have obligations under the NPPs with respect to the b. Employee Records accuracy and completeness, security and The act provides an exemption for the disposal, policies for management, access collection, use or disclosure of information and correction,2 and transborder movement contained in employee records in the context of employment relationships. Section 1. Defined to mean a non-profit organization that 7B(3) states that an act done, or practice has only racial, ethnic, political, religious, philo- engaged in, by an organisation that is or sophical, trade or trade union aims. was an employer of an individual, is ex- 2. Except to extent that compliance places an unreasonable administrative burden on the organisation empt if the act or practice is directly related or causes the organisation unreasonable expense. to (1) a current or former employment rela- Protection of Personal Data: The Australian Perspective Page 109 tionship between the employer and the in- practices with respect to personal informa- dividual; and (2) an employee record held tion about prospective employees or job by the organisation and relating to the indi- candidates do not fall within the exemption vidual. unless those individuals happen also to Employee records are defined broadly to have been former employees. Organisa- include, for example, a record containing tions may need to use forms of disclosure information about the engagement, train- or consent for any personal information ing, disciplining or resignation of an collected from job candidates. If the infor- employee; the terms and conditions of mation, once collected, is held in an em- employment of an employee; or an employee record about that individual and an ployee’s performance or conduct. Section employment relationship is established, 6. The rationale for the exemption is that then, if the other requirements of the ex- handling of employee records is an issue emption are satisfied, use and disclosure of best dealt with under workplace relations that information may fall within the ex- legislation.3 emption. The requirement that the act or practice • “Record” is defined to include a data- be related to a current or former employ- base, however kept. The breadth of the ment relationship and an employee record definition of employee record (a record of held by the organisation and relating to the personal information relating to the em- individual means that once information ployment of the employee) may mean that, contained on an employment record is dis- for example, a daily back up tape or disk closed by the current or former employer, holding copies of e-mails is an “employee the use and disclosure by the persons to record” and thus subject to the exemption. whom it is disclosed is not be exempted, The federal government has foreshad- unless they too are an employer of the indi- owed that a review of existing state and vidual and their use or disclosure is di- territory laws affecting employee records rectly related to an employee record held will be carried out by the Attorney by them. General’s Department and the Department By way of example, if an employer dis- of Employment, Work Place Relations and closes records containing personal infor- Small Business, in consultation with state mation of an employee to the employee’s and territory governments, the Privacy insurer for the purposes of workers’ com- Commissioner and other key stakeholders. pensation, the insurance company will not The government has stated that this review enjoy the exemption provided by Section will be completed in time to assist the Pri- 7B(3) and would be subject to the NPPs in vacy Commissioner to conduct a more gen- collecting, using and disclosing that infor- eral review of the act after 22 December mation.4 2003, two years after it commenced opera- The further requirement that the act or tion. practice be directly related to the employment relationship and an employee record c. Related Bodies Corporate held by the organisation prevents an em- Section 13B provides that each of the ployer organisation from selling personal following acts or practices of an organisa- information about an employee to a third tion that is a body corporate is not an “in- party, which would be considered not “di- terference with the privacy” of an indirectly related” to the current or former em- vidual: (1) the collection of personal ployment relationship. A number of issues arise from the employee records exemption, including the 3. Revised Explanatory Memorandum circulated following: by Attorney General (“Revised EM”), Item 109, The exemption attaches only to cir- hereinafter Revised EM. • 4. Set out in “Employee Records,” a fact sheet cumstances where a current or former em- released by the Attorney General, 22 December ployment relationship exists. Acts and 2000. Page 110 DEFENSE COUNSEL JOURNAL—January 2003 information (other than sensitive informa- the cause of journalism); (3) or A is com- tion) about the individual by the body cor- pelled to make the disclosure to B under an porate from a related body corporate; or (2) applicable law of a foreign country. the disclosure of personal information Where personal information is collected (other than sensitive information) about the by body corporate B from body corporate individual by the body corporate to a re- A (A being a related body corporate of B) lated body corporate. the primary purpose of collection of body Related body corporate is defined by ref- corporate A will be taken to be the primary erence to Section 50 of the Corporations purpose of collection of B.5 In other words Act, which is Commonwealth of Australia “the primary purpose is transferred with legislation. The exemption with respect to the personal information when it is shared related bodies corporate extends to the col- around the group of related bodies corpo- lection of information from and disclosure rate.”6 of personal information only to related bodies corporate. The use and disclosure d. Changes to Partnerships by the organisation that collects personal information from a related body corporate Section 13C ensures that where a part- remains subject to the requirements of NPP nership which is an organisation is dis- 2 and 10. The related body corporate ex- solved and a new partnership is immedi- emption does not apply to acts or practices ately established to carry on the same of contracted service providers for the business, with at least one partner who was commonwealth that may be interferences also a partner of the dissolved partnership, with privacy. the passage of personal information about The related body corporate exemption an individual from the old partnership to does not provide organisations with a the new partnership does not constitute an means of avoiding the requirements of interference with the privacy of the indi- NPP 1 with respect to collection of per- vidual where it is necessary for the new sonal information. For example, if an ex- partnership to hold the information imme- empt entity such as a media organisation diately after its formation. acting in the course of journalism collects This provision avoids the obvious diffi- personal information and then discloses it culties that might arise in the ordinary to a related body corporate subject to the course of changes to the composition of act, the exemption does not allow the body partnerships. corporate collecting the personal information from the exempt entity to avoid its ob- e. Small Business Operators ligations under the NPPs. This is because (i) Scope of the Exclusion the related body corporate exception does not apply to the act of collection by body The act excludes small business opera- corporate B from body corporate A, even if tors from the definition of organisation. A and B are related bodies corporate, if: This means they are effectively exempt (1) A is not an organisation as defined in from the operation of the act. The defini- the act (for example, if A is a registered tion of small business operator is not political party); or (2) A is an organisation straightforward and contains several com- but the disclosure of the personal informa- plex exemptions. tion by A will be an exempt act or practice Section 6B of the act defines both a (for example, media organisation acting in “small business” and a “small business operator.” A small business is defined with respect to an annual turnover figure. A 5. “Primary purpose” is not defined in the act, but small business operator is then defined as it appears that it will be the “main purpose for which an entity that carries on one or more small the information was originally collected.” Revised EM, Item 141. businesses and does not carry on a business 6. Revised EM, Item 142. that is not a small business. Protection of Personal Data: The Australian Perspective Page 111

(ii) Turnover Calculations closed or collected as required or authorised by or under legislation; or (3) the in- Section 6D defines a small business by formation is disclosed or collected other- reference to a “test time” in a financial year wise than in the course of a business (and, and the annual turnover of the business for where the entity is an individual, the infor- the previous financial year, which must be mation is disclosed or collected only for A$3 million or less. Broadly, the annual personal, family or household affairs). turnover is the sum of the business’s income and proceeds of sales. (v) Small Businesses as Service If the business was not carried on in the Providers for previous financial year, it is still consid- Commonwealth Contract ered a small business if its annual turnover for the current year is A$3 million or less. An entity is not a small business opera- In order to determine the annual turnover tor if it is a contracted service provider for for a current year, Section 6DA(2) of the a Commonwealth of Australia contract. act provides a formula that takes the This applies whether or not the entity itself business’s actual turnover for that part of is a party to a contract with the Common- the year already passed and extrapolates it wealth. This means that sub-contractors to over a full year. Commonwealth contractors are not small An entity is not considered a small busi- business operators. ness operator if any business it conducts However, to the extent that an entity has an annual turnover exceeding A$3 mil- would otherwise be a small business opera- lion in any financial year ending after the tor, Section 7B(2) ensures that the activi- commencement of the act. ties of that entity not carried out in the performance of their obligations under the (iii) Small Businesses Dealing in Commonwealth contract are exempt from Health Information the act. Regardless of whether its annual turn- (vi) Small Business Operators over is less than the threshold, Paragraph Can Opt In 6D(4)(b) of the act provides that an entity is not a small business operator if it pro- Under Section 6EA, small business op- vides a health services and holds any erators can elect to be treated as though health information, unless (1) the health in- they were an organisation covered by the formation is only held in an employee act. The choice is required to be made in record; or (2) the health information is held writing to the Privacy Commissioner, as a only otherwise than in the course of a busi- result of which the Privacy Commissioner ness (and, where the entity is an individual, is required to enter details about the small the health information is held only for per- business operator into a register. The small sonal, family or household affairs). business operator is then treated as an organisation covered by the act for as long (iv) Small Business Trading in as its choice is registered. The choice can Personal Information be revoked by notice to the Privacy Com- missioner in writing, in which case the Pri- Paragraph 6D(4)(c) and (d) provide that vacy Commissioner must remove the small an entity is not a small business operator if business operator from the register. it discloses personal information about an If a small business chooses to opt in and individual to someone else for a benefit or then later revokes its choice, it follows that provides a benefit to someone else to col- the acts and practices that it engaged in lect personal information about another in- while its choice was registered may still be dividual, unless (1) the information is dis- investigated and dealt with by the Privacy closed or collected with the consent of the Commissioner. This ensures that the Pri- other individual; (2) the information is dis- vacy Commissioner’s jurisdiction to inves- Page 112 DEFENSE COUNSEL JOURNAL—January 2003 tigate complaints is not defeated by a busi- (viii) Power to Prescribe ness reasserting exempt status after the act Certain Small Businesses or practice complained of occurred. Section 6E(4) allows the Attorney Gen- eral, if it is in the public interest and after (vii) Delayed Application of consultation with the Privacy Commis- NPPs sioner, to prescribe small business opera- The act provides for delayed application tors as organisations for the purposes of the of the NPPs to entities that satisfy the react. When consulting the Privacy Commis- quirements to be to small businesses but sioner, the Attorney General must consider are not small business operators. An ex- the views of other interested people, such ample would be an entity that carries on a as the Minister for Small Business and the small business involving the disclosure of Privacy Advisory Committee, to which a personal information about individuals to small business representative has been ap- other persons for reward, where the disclo- pointed. sure is not made with the individuals’ consents or as required or authorised by legis- (ix) Related body corporate lation. exemption The effect of the delayed application period for these small businesses is that: Section 6D(9) makes it clear that a body • Until the delayed application period corporate is not a small business operator if has ended, collection of personal informa- it is related to a body corporate that carries tion will not be subject to NPPs 1, 3 and on a business that is not a small business. 10. In other words, the related body corporate • NPPs 3, 4, 5, 7 and 9 will apply only exception, which is described above, does to the use and disclosure of personal infor- not provide a means by which a large mation taking place after the delayed appli- organisation may circumvent the require- cation period has ended. ments of the NPPs by collecting personal • Once the delayed application period information through a related body corpo- has ended, NPPs 3, 4, 5, 7 and 9 will apply rate that is a small business operator. to personal information held by the organization, whether it was collected before, f. Media Organisations Acting in during or after that period. Course of Journalism • NPP 2 will only affect the use and Section 7B(4) provides that acts or prac- disclosure of information collected after tices engaged in by a media organisation in the delayed application period ends. NPP the course of journalism are exempt from 6, which sets out obligations with respect the act. The policy imperatives behind this to access and correction, apply only to per- exemption are reasonably clear—there is a sonal information collected after the de- public interest in the “free flow of informa- layed application period ends. tion through the media.”7 An organisation’s obligation wherever Media organisations are defined in Sec- lawful and practicable to provide individu- tion 6 as organisations whose activities als with the opportunity of not identifying consist of or include collection, preparation themselves when entering a transaction un- for dissemination or dissemination to the der NPP 8 apply only to transactions en- public of material having the character of tered into after the delayed application pe- news, current affairs, information or a riod ends. documentary or commentary or opinion on or analysis of news, current affairs, information or a documentary. Journalism itself is not defined. 7. “Privacy and the Media,” a fact sheet released The definition of media organisation is by the Attorney General, 22 December 2000. relatively broad—the activities of the or- Protection of Personal Data: The Australian Perspective Page 113 ganisation need include only those de- NPPs, mainly in relation to the use and dis- scribed above. The question arises whether closure of personal information. the exemption might be abused. However, Section 6A(2) provides that an act or Section 7B(4)(b) provides that for the act practice of an organisation that is a con- or practice to be exempt, the media tracted service provider under a Common- organisation at the time must have been wealth contract (a contract under which “publicly committed to observe standards services are provided to a Commonwealth that . . . deal with privacy in the context of agency) and which is done for the purposes activities of a media organisation (whether of meeting an obligation under that con- or not the standards also deal with other tract does not breach the NPPs, provided matters),” and which have been published that the act or practice is authorised by a in writing by the organisation or a person provision of the contract inconsistent with or body representing a class of media the particular NPP. Section 6B(2) applies organisations. This provides a safeguard similarly in relation to the requirements of against organisations seeking to exploit the an approved privacy code. exemption. What this essentially means is that gov- The acts or practices of employees of a ernment contractors can engage in acts and media organisation in the course of their practices that are inconsistent with the employment are treated as acts and prac- NPPs or an approved code, provided that tices of the organization; the employees are those acts or practices are required to fulfil not themselves treated as “organisations.” their obligations under their contract with This provision, Section 8, is of general ap- the government. Section 95B provides that plication to organisations under the act. government agencies entering into a commonwealth contract must ensure that they g. Registered Political Parties and take contractual measures to ensure that a Political Representatives contract service provider does not do an act, or engage in a practice, that would be a A registered political party is expressly breach of an IPP if it had been done by the excluded from the definition of “organisa- agency. The agency also must ensure that tion.” The act also provides a limited ex- the contract prevents any subcontracts emption for certain acts and practices of from authorising a breach of the IPPs. (1) members of Parliament; (2) local gov- Individuals cannot enforce the contrac- ernment councillors; (3) the contractors of tual obligations placed on government con- members of Parliament, local government tractors to comply with the IPPs, as they councillors and political parties; (4) the will not be a party to the contract. How- subcontractors of these contractors; and (5) ever, Section 13A(1)(c) of the act extends volunteers working for political parties; the definition of an “interference with the when the acts and practices are carried out privacy of an individual” to cover situa- in connection with an election under an tions where contracted service providers electoral law, a state, territory or common- breach any contractual obligations that im- wealth referendum or in connection with pinge on the NPPs. participation of the member, counsellor or The result of this is that there is an inter- political party in another aspect of the po- ference with the privacy of an individual litical process. where (1) an organisation engages in an act or practice that relates to the personal in- h. Commonwealth Government formation of an individual, (2) the organi- Agencies sation is a contracted service provider for a Most Commonwealth Government agen- commonwealth contract, (3) because a pro- cies are regulated by the IPPs in Part III, vision of that contract is inconsistent with Division 1, of the 1988 Act. Although they the NPPs or an approved privacy code a are substantially similar, there are some particular act or practice is, under Section slight differences between the IPPs and the 6A(2), not a breach of the NPPs or the Page 114 DEFENSE COUNSEL JOURNAL—January 2003 code, (4) the act or practice is done in a NEW RULES FOR manner that is contrary to, or inconsistent PRIVATE SECTOR with, the relevant provision of the com- A. NPPs monwealth contract, Section 16F expressly prohibits a con- The standards by which acts and prac- tracted service provider for the Common- tices of private sector organisations affect- wealth from using or disclosing personal ing personal information handling are information collected for the purpose of judged for the purposes of the act are found meeting obligations under a common- in the NPPs. Other provisions essentially wealth contract for direct marketing when provide a means of giving effect to and en- that use or disclosure is necessary to meet, forcing those standards. Following is a directly or indirectly, obligations under the summary of the NPPs. commonwealth contract. The provision expressly overrides NPP 2.1, which provides 1. Principle 1—Collection an exception to the restrictions on the use An organisation is prohibited from col- and disclosure of personal information for lecting personal information unless the in- secondary purposes where that secondary formation is necessary for one or more of purpose is direct marketing. its functions. An organisation must not col- An individual may make a complaint to lect personal information other than in a the Privacy Commissioner in respect of the lawful, fair and not unreasonably obtrusive above matters under Section 36(1C). Addi- way and must disclose certain information tionally, Section 40A requires an adjudica- at or before the time it collects personal tor of an approved privacy code to refer a information, including its identity and the code complaint to the Privacy Commis- purpose for which the information is col- sioner if the complaint is about an act or lected. Subject to some exceptions, organi- practice of a contracted service provider sations should collect personal information under a commonwealth contract. about individuals only from the individuals As noted above, contracted service pro- themselves. viders that are otherwise small business operators are in the same position as a small 2. Principle 2—Use and Disclosure business operator for the purposes of the act in respect of any of their activities that The essence of this principle is that, gen- do not relate to the commonwealth con- erally speaking, an organisation is prohib- tract. ited from using or disclosing information for a purpose other than the primary pur- i. State and Territory Government pose for which the information was col- Agencies lected. There are a number of exceptions, including (1) where the individual has con- State and territory government agencies sented; (2) where the secondary purpose and organisations are not regulated by the for which the personal information will be act, so in the absence of specific state or used is related (or, in the case of sensitive territory legislation, they are not required information, directly related) to the pri- to comply with the NPPs or similar privacy mary purpose and a person would reason- principles. A number of states and territo- ably expect the personal information to be ries have privacy legislation that imposes used or disclosed in that way; (3) the use of protection principles similar to the NPPs “non-sensitive” personal information in di- on their respective agencies and instrumen- rect marketing, subject to conditions, talities. For example, in New South Wales, which include a right for the individual to the Privacy Personal Information Act 1998 opt out of further direct marketing after the (NSW), and in Victoria, the Information first contact). Privacy Act (Vic) 2000. Protection of Personal Data: The Australian Perspective Page 115

3. Principle 3—Data Quality 9. Principle 9—Transborder Data Flows An organisation must take reasonable steps to ensure the accuracy and currency Essentially, this principle applies to of personal information in its possession. transfers of information outside Australia, the intention being that effective privacy 4. Principle 4—Data Security protection must be ensured in respect of such transfers, subject to limited excep- An organisation must take reasonable tions, including where the individual has steps to secure the personal information in consented or where there is evidence of its possession from misuse and loss and reasonable steps undertaken by the organi- from unauthorised access, modification or sation to ensure that any information trans- disclosure, and must destroy or de-identify ferred will not be held, used or disclosed the information if it is no longer needed. inconsistently with the NPPs. 5. Principle 5—Openness 10. Principle 10—Sensitive An organisation must have documented Information and accessible policies with regard to the Other than in exceptional circumstances, management of personal information and an organisation is not permitted to collect must also inform a person, upon request, of sensitive information. Exceptional circum- the sort of personal information that it stances include where the individual has holds, the purposes for which it is held and consented or where the collection is neces- how the information is collected, held, sary for the protection of an individual who used and disclosed. is physically incapable of giving or com- municating consent. There are a number of 6. Principle 6—Access and exceptions in relation to health services Correction provision and public health and safety. An organisation must provide individuals with access to personal information B. Approved Privacy Codes held about the individual, other than in ex- Under the act, organisations have the op- ceptional circumstances, and incorporate tion of either (1) developing a self-regula- processes for the correction of the informa- tory code approved by the Privacy Com- tion on the request of the individual, or if missioner and which does not include a there is some disagreement as to the cor- complaints resolution process, in which rection, allow a statement to be associated case the organisation is subject to a com- with the information noting that the indi- plaints resolution process operated by the vidual desires a correction. commissioner; (2) developing a self-regulatory code including a complaints resolu- 7. Principle 7—Identifiers tion mechanism, again subject to approval In general terms, there is a prohibition by the commissioner); or (3) complying on the use by organisations for their own with the NPPs and being directly subject to purposes of identifiers assigned by govern- the complaints resolution process operated ment agencies (such as tax file numbers, by the commissioner. and Medicare numbers). A self-regulatory code may apply to an organisation, an industry sector or a profes- 8. Principle 8—Anonymity sion, or specified classes of industry sectors or professions, and may deal with all, Unless unlawful or impractical, indi- or a specified type, of personal informa- viduals must be given the option of not tion. If an industry body or organisation identifying themselves when transacting proposes to develop a self-regulatory code, with an organisation. before that code will be effective under the Page 116 DEFENSE COUNSEL JOURNAL—January 2003 act as an “approved privacy code,” it first dividual” if it breaches—that is, contrary to must be approved by the Privacy Commis- or inconsistent with—(1) an approved pri- sioner. vacy code that binds the organisation; or Section 18BB of the act mandates that (2) the NPPs, in circumstances where an the commissioner must be satisfied that (1) approved privacy code does not exist or the code incorporates all of the NPPs or does not apply; or (3) in the case of a con- sets out obligations that “overall, are at tracted service provider for a common- least the equivalent of the obligations” in wealth contract, a provision of that contract the NPPs; (2) the code specifies the which, in effect, imposes an alternative ob- organisations bound by the code or a way ligation on that contracted service provider of determining the organisations that are, to those specified in the NPPs (or any ap- or will be, bound by the code; (3) the code proved privacy code); and (4) the act or binds only organisations that consent to be practice relates to personal information that bound; (4) the code sets out a procedure by relates to the individual. which an organisation may cease to be Disclosures by organisations for the pur- bound by the code and when the cessation poses of enabling the National Archives of takes effect; (5) if the code includes a com- Australia to determine whether to accept or plaints resolution mechanism, that speci- arrange custody of a record for the pur- fied criteria (set out in Section 18(3)) of the poses of the Archives Act 1983 are exact are satisfied with regard to that mecha- cluded from the definition of a breach of nism; and (6) members of the public have the NPPs or an approved privacy code. been given adequate opportunity to com- Also exempted from the definition of a ment on a draft of the code. “breach” of the NPPs and approved pri- An industry peak body or individual vacy codes are acts or practices engaged in organisation that chooses to develop its outside Australia and the external territo- own privacy code can to some extent tailor ries that are required by the applicable law the content of the code to suit its specific of a foreign country. Sections 6A(4) and information handling acts and practices. 6B(4). Section 13D reinforces or duplicates However, the overriding requirement that the effect of these sections by providing an approved privacy code incorporate obli- that these acts or practices are not “inter- gations that, overall, are at least the equiva- ferences with privacy.” The private sector lent of the obligations set out in the NPPs, regime affects overseas acts and practices requires organisations to consider carefully of organisations with a “link” to Australia the precise form of any modifications in- and which relate to personal information corporated in the code. It is, of course, pos- about Australian citizens or persons whose sible that some industry or professional as- continued presence in Australia is not sub- sociations will wish to develop NPPs that ject to any time limit imposed by law. Sec- provide for more onerous obligations than tion 5B sets out the circumstances in which those of the NPPs.8 a link is established for the purposes of the extra-territorial operation of the private C. Breach of Approved Privacy Code sector regime. Sections 13A(2) and 13E of the act The trigger for the remedial and protec- make clear that: tive mechanisms provided under the pri- It is irrelevant to determining whether vate sector regime is an interference with • an act or practice of an organisation is an the privacy of an individual. interference with privacy that the organi- An act or practice of an organisation is sation is also a credit reporting agency, an “interference with the privacy of an in- credit provider or file number recipient. In other words, an act or practice of an organisation may be an interference with 8. The Revised EM cites the example of medical professionals who may wish to give effect to long- privacy both for the purposes of the Pri- standing obligations of client-doctor confidentiality. vacy Act regime and for the purposes of Protection of Personal Data: The Australian Perspective Page 117 the regime established by the Private Sec- complaints-handling process. Approved tor Act if the organisation is a credit report- privacy codes will themselves require that ing agency, credit provider, or file number individuals must first have attempted, with- recipient;9 and out success, to resolve their complaints di- • The exceptions from the scope of acts rectly with the organisation before they and practices which are “interferences with will be entitled to have their complaints in- privacy” provided in relation to related vestigated by a code adjudicator. bodies corporate, changes in partnerships, Code adjudicators must refer all com- and overseas acts in compliance with for- plaints about acts and practices by con- eign laws do not affect obligations appli- tracted service providers for common- cable to credit reporting agencies, credit wealth contracts to the Privacy Com- providers or file number recipients. missioner for investigation, regardless of any provision in the approved privacy code D. Complaints and Investigations which purports to give it power to deal with the matter. Presumably, a code that An act or practice which an individual included such a provision would not be ap- believes to be an interference with their proved by the commissioner. privacy may form the basis of a complaint. Section 36 of the act provides for a rep- Some complaints by individuals may be fi- resentative complaint to be made to the nally resolved directly between the indi- commissioner by an individual where an vidual and the organisation concerned. The act or practice may interfere with the pri- private sector regime positively encourages vacy of two or more persons, including the this approach, which means that many pri- individual making the complaint. It re- vacy complaints are dealt with without remains to be seen whether self-regulatory sort to any formal complaints resolution privacy codes submitted for approval to process. the commissioner will seek or will be required to accommodate representative 1. Complaint Resolution Process complaints. If individuals cannot resolve their com- Part V of the Privacy Act, as amended plaint directly with the organisation, they by the Private Sector Act, contains detailed can attempt to resolve the complaint provisions concerning the procedural obli- through a complaints resolution process es- gations and powers of the Privacy Com- tablished under an approved privacy code missioner with regard to the investigation (if any) or by referring their complaint to of complaints, as well as acts and practices the Privacy Commissioner for investiga- generally. These powers extend to requir- tion. ing the production of documents and to ex- If the organisation is bound by an ap- amining witnesses on oath. proved privacy code with a procedure for an adjudicator, the individual must first 2. When Commissioner Must pursue that procedure, unless the approved Investigate privacy code itself provides that the Pri- The threshold requirements before the vacy Commissioner is to be the adjudica- Privacy Commissioner must investigate an tor. The commissioner is not empowered to act or practice are (1) a complaint must investigate a complaint in the first instance have been made by an individual about an if the individual has not complained to the organisation concerned, unless the commissioner decides it was not appropriate 9. Section 6(7) also makes clear that a complaint for a complaint to be made to the organi- that an act or practice breaches an NPP may also be sation. a complaint that the same act or practice is a credit Apparently this provision applies regard- reporting infringement or a complaint in relation to handling of TFN information. An organisation ac- less of whether the organisation is bound cordingly might be the subject of more than one ad- by an approved privacy code including a verse finding. See Revised EM, Items 57-59. Page 118 DEFENSE COUNSEL JOURNAL—January 2003 act or practice, and (2) the commissioner dealt with the application, provided an must have decided that the act or practice individual’s interests will not be prejudiced may be an interference with the privacy of by the deferral. an individual. 6. “Guiding Principle” 3. When Commissioner May Section 29(a) of the act requires that the Investigate commissioner must have due regard in per- The commissioner also has the discre- forming functions and exercising powers tion to investigate an act or practice on his “for the protection of important human own initiative without a complaint having rights and social interests that compete been made if he thinks it is desirable. with privacy, including the general desir- There are reporting requirements when the ability of a free flow of information commissioner investigates in the absence (through the media and otherwise) and the of a complaint. In certain circumstances, recognition of the right of government and for example, if the commissioner forms the business to achieve their objectives in an view that a complaint can and could be efficient way.” dealt with more appropriately by the Hu- Section 18BB(3)(c) of the act requires man Rights and Equal Opportunity Com- that a complaints resolution process under mission, the commissioner may transfer the an approved privacy code also must oblige complaint. In other circumstances, the the code adjudicator to have regard to the commissioner must cease or discontinue in same matters. part an investigation and refer the matter to the Commissioner of Police or Director or E. Determinations Public Prosecutions. 1. The Determination 4. Terminating Investigations Following the completion of an investigation of a complaint by either the Privacy The commissioner may decide not to in- Commissioner or a code adjudicator, a de- vestigate or not to investigate further if the termination will be made. Section 18BB of commissioners decides the acts or practices the act provides that a complaints handling (1) are not interferences with privacy; or process under an approved privacy code (2) the complaints are frivolous vexatious must confer powers on the code adjudica- or lacking in substance; or (3) the com- tor with respect to determinations which plaints are being adequately dealt with by are the same as those conferred on the alternative remedies provided under com- commissioner and set out the means by monwealth, state or territory law; or (4) if which, under the approved privacy code, the commissioner decides that a complaint the organisation is bound to comply with has been dealt with adequately by an that determination. organisation or the organisation has not yet The determination includes a statement had an adequate opportunity to deal with of the findings of fact on which the deter- the complaint. mination is based, which is important in any subsequent review of the determina- 5. Public Interest Determinations tion. A determination results in either a dis- Section 72 of the act provides for appli- missal or a finding that the complaint is cations to be made by organisations for de- substantiated. When a complaint is found termination as to whether particular acts or to be substantiated, declarations can be practices breach the NPPs or an approved made that remedial steps should be taken, privacy code. If such an application has including payment of compensation for been made, the commissioner may defer an loss or damage, extending to injury to the investigation in relation to the particular complainant’s feelings or humiliation suf- act or practice until the commissioner has fered by the complainant. Section 52. Protection of Personal Data: The Australian Perspective Page 119

2. Review of Determination 1. Subject to Act? A person aggrieved by a determination A lawyer practising as a sole practitioner of a code adjudicator, except where the may be subject to regulation under the act code adjudicator is the commissioner, may as an organisation in relation to the con- apply to the commissioner to review the duct of his or her business activities as a determination. Section 18BI. The review lawyer, which would include acting for cli- includes any finding, declaration, order or ents in the course of litigation. It is likely direction included in the code adjudicator’s that many sole practitioners will fall within determination. A determination by the the small business exception and for that commissioner is a judicially reviewable de- reason may not be regulated under the act. cision. Partnerships, particularly the larger law Approved privacy codes must include firms, will generally not come within the reporting requirements in accordance with small business exception. Section 18BB(3)(h)-(l) of the act, which complement the supervisory function and 2. Conduct of Litigation powers conferred on the commissioner The process of litigation invariably in- with respect to approved privacy codes. volves aspects of collection, use, storage These powers extend to a review of out- and disclosure of personal information. comes of complaints dealt with by code ad- While the act contains a number of specific judicators appointed under approved pri- exemptions in relation to, for example, in- vacy codes. formation required by law or information related to legal proceedings, it does not F. Enforcement contain any sort of general exemption for No penalty attaches directly to a failure people or organizations—such as law firms to comply with a determination by a code and their clients—who may be acting in or adjudicator or the commissioner, which is otherwise engaged in the course of litiga- not binding or conclusive on the parties. If tion. a determination is not complied with by an In effect, this means that lawyers and organisation, the individual concerned, the their clients who may be engaged in the commissioner or the relevant code adjudi- preparation, investigation or conduct of le- cator may apply to the Federal Court or the gal proceeding in Australia, including any Federal Magistrates Court for enforcement persons engaged by lawyers or their of the determination. clients, such as process servers or private The court is required to deal with the investigators, are subject to the general re- matter by way of hearing de novo, and quirements of the act, subject to any appli- when conducting such a hearing, to have cable exceptions, including the NPPs. due regard to the “guiding principle” noted The practical effect of these require- above. The court may receive in evidence ments in the particular context of litigation copies of the commissioner’s or code remains somewhat unclear. The Privacy adjudicator’s reasons, documents that were Commissioner has not released any guide- before the commissioner or code adjudica- lines or information sheets on the subject. tor, and records of appearances before the However, the commissioner is considering commissioner or code adjudicator. the issue. In the interim, it is important for lawyers to be aware that a potentially vast array of personal information collected in KEY ISSUES the course of preparing or conducting liti- A. Legal Profession gation now needs to be managed in accordance with the requirements of the act. The act has some potentially far-reach- The act, or more precisely the NPPs, ing implications for the legal profession in contain a number of specific exceptions Australia. relevant to the conduct of litigation. For Page 120 DEFENSE COUNSEL JOURNAL—January 2003 example, an organisation can legitimately authorised by law (NPP 6.1(h)). Similarly, refuse an individual access to personal in- the assertion of the duty of confidentiality formation the organisation holds about owed by a lawyer to his client also should them, as set out in NPP 6(1) where the in- be sufficient to deny access on the same formation relates to existing or anticipated basis. legal proceedings between the organisation and the individual, and the information b. Use of Private Investigators would not be accessible by the process of It is reasonably common for lawyers in- discovery (NPP 6.1(e)); and (2) where de- volved in the preparation of certain types nying access is required or authorised by of litigation—for example, that arising law (NPP 6.1(h)). from insurance claims—to retain the ser- Similarly there is an exception to the vices of a private investigator to assist in general prohibition on the collection of the collection of background information sensitive information (NPP 10.1) where the and evidence. However, to the extent that collection is necessary for the establish- any of the information collected is personal ment, exercise or defence of a legal or information, this will give rise to a number equitable claim. There is no corresponding of specific obligations under NPP 1. It is exception in relation to the requirements of now necessary to ensure that the only per- NPP 1.3 (or, where applicable, NPP 1.5) to sonal information collected is that neces- ensure that individuals have been made sary for the purpose of the litigation (NPP aware of certain matters where personal in- 1.1). It is also necessary to ensure that the formation is collected about them. How- information is not collected in an unreason- ever, the obligation under NPP 1.3 is to ably intrusive way (NPP 1.2). take reasonable steps to make an individual One of the difficult issues is the extent to aware of the required matters at or before which a private investigator is obliged to the time of collection or, if that is not prac- take reasonable steps to ensure that the in- ticable, as soon as practicable after collec- dividual about whom the information is be- tion. What is practicable will depend on the ing collected is aware of, amongst other specific circumstances of each case. It may things, the identity of the private investiga- be that in some situations it will not be tor collecting the information, the fact that practicable to make a disclosure until well they can access the information, and the after the time the personal information was purpose for which the information is being collected or it may be that in certain cir- collected, in accordance with NPP 1.3. cumstances it is not practicable to make a The key question appears to be whether disclosure at all. it is impracticable in these circumstances Key issues for lawyers involved in the for the private investigator to make an NPP conduct of litigation in Australia include 1.3 disclosure at or before the time of col- the following. lection and when it will be practicable to make the disclosure after the collection. a. Client Legal Privilege Given that any disclosure prior to or during As a general rule, once privilege is lost, collection of information will in all likeli- it cannot be re-stated. Accordingly, one of hood frustrate the activities of the private the issues for lawyers that may arise under investigator, it may be possible to argue the act is the question of access to personal that it is not practicable to make a disclo- information that is or may be the subject of sure at or before the time of collection. a claim for privilege. There is no specific When it will be practicable to make a disclosure after collection will depend on the provision in the act for denying access on specific circumstances of each case. the basis of a claim for client legal privilege. However, client legal privilege B. Retail Banks and Credit Providers should provide a reasonable basis for asserting that a denial of access is required or For credit reporters and credit providers Protection of Personal Data: The Australian Perspective Page 121 subject to regulation under Part IIIA of the C. Health Industry act, the broad philosophy underlying the As stated above, the act creates a special private sector regime is not unfamiliar: cer- category of personal information, termed tain information must be handled only in a “sensitive information,” and it gives prescribed manner. greater protection to sensitive information Credit reporting agencies and credit pro- by placing stricter limits on how it is col- viders remain subject to Part IIIA of the lected and handled by private sector act. Moreover, the obligations of credit organisations. Health information is a form providers apart from the requirements of of sensitive information. the act will continue to apply. For example, The act defines “health information” as: in a particular case, a bank may not be prohibited by the NPPs from disclosing per- (a) information or opinion about: sonal information, but the bank’s duty of (i) the health or a disability (at any confidentiality at common law may still time) of an individual; or prevent the disclosure of the information. (ii) an individual’s expressed wishes However, the private sector regime im- about the future provision of health services pacts not just on a specific category of in- to him or her; or (iii) the health service provided, or to formation handled by credit reporters and be provided, to an individual; credit providers, but on all aspects of per- that is also personal information; or sonal information handling. A vast array of (b) other personal information collected personal information needs to be managed to provide, or in providing, a health service; in accordance with the private sector or regime’s requirements, and this will impact (c) other personal information about an both front and back-end operations of individual collected in connection with the credit providers. donation, or intended donation, by the indi- Key issues for retail banks and other vidual of his or her body parts, organs or credit providers arising from the private body substances. sector regime include: It should be noted that sub-paragraph (b) • the impact of dual sanctions for prac- of this definition means that some types of tices which are affected both by the credit personal information to be categorised as reporting regime under Part IIIA and the sensitive information if collected inciden- private sector regime; tally to the provision of a health service— • the interaction of the NPPs and any that is, the collection occurs “in providing” applicable codes of conduct, such as the a health service.” However, it is important Code of Banking Practice, which includes also to note the general provision under specific privacy requirements; Section 16B that the act applies only to the • protocols for cross-selling products collection of personal information if the in- and the implications of the related body formation is collected for inclusion in a corporate exemption across corporate record or a generally available publication groups; and only to personal information collected • relationships with authorised repre- by the organisation which is held in a sentatives, franchisees and contractors with record. whom personal information is exchanged; The act defines “health service” as: • account systems implications and the capacity for systems to accommodate ap- (a) an activity performed in relation to an individual that is intended or claimed (ex- propriate security measures for personal in- pressly or otherwise) by the individual or the formation, to flag sensitive information for person performing it: special protection and retrieve information (i) to assess, record or maintain or im- for access and correction purposes; and prove the individual’s health; or • the implications of mergers and ac- (ii) to diagnose the individual’s illness quisitions requiring combination of dis- or disability; or crete sets of personal information. (iii) to treat the individual’s illness or Page 122 DEFENSE COUNSEL JOURNAL—January 2003

disability or suspected illness or disability; information within treating teams which do or not impede efficiency. (b) the dispensing on prescription of a drug or medicine or preparation by a phar- D. Superannuation, Insurance and macist. Funds Management In addition to the special protection at- Financial services providers, such as taching to health information as “sensitive banks, insurers and superannuation funds, information,” the NPPs also deal specifi- hold a vast amount of personal information cally with health information in the context as a function of their business. Technologi- of its use and disclosure for research and in cal advances have given businesses the ca- the course of treatment of individuals, and pability to break down this customer infor- they include a number of measures in- mation into its components and then tended to balance the restrictions set out in recombine the information for other pur- the NPPs with the necessity for health ser- poses. An example of this is information vices and research in relation to health to provided to a bank in relation to a loan be conducted. application, such as age, address, marital Key issues for the health industry in re- and family status, which could be recom- lation to the private sector regime include: piled to propose new loans, investments, • the scope of the definition of “health life and general insurance and superannua- service”; how far does it extend beyond tion products. medical practitioners and pharmacists? • the impact of dual or multiple regula- 1. Superannuation tory regimes affecting health service providers; Superannuation trustees have limited • the effectiveness of existing practices privacy duties in respect of the personal infor procuring client/customer/patient con- formation of the members of the superan- sents; nuation fund outside of the act. Trustees • the adequacy of any existing proce- are in a fiduciary relationship with the dures guiding decisions about collection members of the fund and are subject to the where there is a serious threat to life or usual fiduciary duties, including to act in health of individuals (or other exceptional the best interests of members. If a trustee circumstances); breaches the privacy of a member of the • research guidelines and the circum- fund to the member’s damage, or the stances in which non-identifiable informa- trustee uses the breach to obtain a benefit, tion only should be collected; the trustee could be liable for a breach of • limitations on direct marketing spe- fiduciary duty. cifically applicable to sensitive informa- In addition to fiduciary duties, superan- tion, and the potential segmenting of data- nuation trustees are subject to detailed dis- bases of personal information this may closure and reporting rules under the Su- require; perannuation Industry (Supervision) Act • the implications of access require- 1993, which supplements the general law ments under the private sector regime for rights of beneficiaries in relation to infor- previous limitations on rights of patient ac- mation held by trustees. Superannuation cess to medical records;10 and trusts also are subject to the tax file number • procedures for exchange of personal privacy principles contained in the Privacy Act, which place restrictions on the collection, use and storage of tax file numbers by 10. See Breen v. Williams (1996) 186 C.L.R. 71. the superannuation industry. State and territory legislation also impacts on this Moreover, trustees could be liable for a issue, for example, Section 120A of the Mental breach of confidence where they have dis- Health Act 1986 (Vic), Health Records (Privacy and Access) Act 1997 (ACT), and the Health Records closed personal information of members to Act 2001 (Vic). third parties. The requirements to establish Protection of Personal Data: The Australian Perspective Page 123 a breach of the equitable duty of confi- because they typically are involved in the dence are: (1) The information must be of a collection of significant amounts of health confidential nature. (2) There must be a re- information, which falls within the defini- lationship of confidence. (3) There must be tion of sensitive information. an unauthorised use or disclosure of the in- The general insurance industry has formation to the detriment of the person recognised for some time the importance of who provided the information. As a result, privacy principles. It is the first group to the superannuation industry already had have a privacy code approved by the Pri- some experience in dealing with privacy is- vacy Commissioner under the act—the sues prior to the commencement of the Pri- General Insurance Privacy Code, approved vate Sector Act. 17 April 2002. Many of the issues impacting on retail Key issues for life and health insurers in credit providers also affect superannuation relation to the private sector regime in- entities. Other key issues include: clude: • reviewing relationships with employ- • the interaction of customer’s duties to ers which disclose information to entities disclose with requirements for consent un- where employers may be subject to the em- der the private sector regime where sensi- ployee records exemption; tive information is collected; • consideration of procedures to control • the specific limitations on the “rea- communications by trustees with spouses sonable expectation” qualification (NPP 2) or former spouses of members; and where sensitive information is used for a • controlling disclosures of personal in- secondary purpose (when will the second- formation to and collection of personal in- ary purpose be “directly related” to the pri- formation from advise acting in connection mary purpose?); with the operation of a superannuation • (in the future) the possible impact of fund. the scope of regulation of sensitive genetic information. This is a controversial issue 2. Insurance that will be subject to a review by the Aus- tralian Law Reform Commission and the Contracts between insurers and individu- Australian Health Ethics Committee. For als are contracts of utmost good faith. This this reason, genetic information was not means that the insured individual has a dealt with in the act, as the government duty to disclose to an insurer, before the preferred to wait for the publication of the contract is entered into, every matter recommendations of this inquiry.11 known to the insured, or that a reasonable person in the circumstances could be ex- 3. Funds Management pected to know, relevant to the insurer’s decision whether to accept the insurance As with superannuation trustees, the re- risk, and if so, on what terms. This obliga- lationship between funds managers and tion is reinforced by the Insurance Con- their members gives rise to fiduciary duties tracts Act 1984. on the part of the responsible entity of the One result of these obligations is that in- fund. The duties are supplemented by the surance companies are privy to vast amounts of personal information about in- 11. The Australian Compensation and Consumer Commission has granted authorisation to a proposed dividuals, and in many cases, particularly agreement by life insurers that they will not initiate in the life insurance and health insurance or induce applicants for life insurance to undergo areas, this information is of a highly sensi- genetic testing for a period of two years. This agreement does not deal expressly with the use of existing tive nature and which the individual in- genetic information. ACCC Authorises Life Insur- sured would not wish to be disclosed to ance Bar on Genetic Testing,” release by ACCC, 22 other parties. The impact of the private sec- November 2000, available at www.accc.gov.au/docs/ a30200_a30201.pdf. A press release is available at tor regime is felt more acutely by life in- http://www.accc.gov.au//fs-search.htm, then enter surance and health insurance companies key words “genetic,tsting.” Page 124 DEFENSE COUNSEL JOURNAL—January 2003

Corporations Law, and in particular Sec- practicable to make that disclosure; tion 601C(1)(c), which requires respon- • the scope of the obligations of organi- sible entities to act in the best interests of sations collecting data from market re- members, and Section 601FC(1)(e), which searchers and call centres to satisfy them- prohibits responsible entities from making selves that disclosures have been made for use of information acquired through being the purposes of NPP 1.5 (what are “reason- a responsible entity in order to gain an im- able steps”?); and proper advantage for itself or another per- • the responsibilities of organisations son or to cause detriment to the members which outsource some marketing and call of the scheme. centre functions to overseas agencies, Key issues for funds managers include: given the provisions of NPP 9, which af- • identifying means of regulating rela- fect transborder data flows. tionships with intermediaries who deal directly with investors; 2. Direct and Telemarketing assessing the implications of transi- • The use of personal information for the tions to fund structure, roll-overs, and ac- direct marketing of products to consumers quisitions of relevant entities; and has been specifically dealt with in the Act defining access and correction obliga- • under NPP 2.1(c), which requires organisations with respect to personal information tions to consider: and the scope of exemptions provided for amendments to written direct market- evaluative information generated in con- • ing communications to ensure appropriate nection with a commercially sensitive deci- opt-out notice and contact details; sion making process. • processes to honour opt-out requests of recipients of direct marketing communi- E. Marketing Activities cations; 1. General • the impact of the related body corporate exemption on direct marketing prac- Personal information is central to many tices; marketing activities, whether it is used for development and maintenance of pro- simple procedures, such as providing con- • cedures for excluding collection of sensi- tact details for businesses’ customers, or tive information from material collected in more complex activities, such as analysing the course of direct marketing; and customers’ spending and leisure habits in investigating the potential for call order more successfully to tailor products • centre contacts with individuals and point to the core market of a business. of sale forms to provide the means of ob- Key issues for marketing activities of taining consents. organisations include considering: The privacy principles contained in the the means by which call centres and • Australian Direct Marketing Association market research organisations comply with Code of Practice are based on the NPPs. disclosure requirements at the point of col- The association also has an independent lection, and the extent of their obligations code authority to deal with any complaints to disclose the identity of organisations to against its members, which it has indicated whom they disclose the results of their re- it will seek to have approved as a code ad- search and the purpose for which those judicator under the act. The association organisations use the data; also offers a service known as the “Do Not compliance issues where standard • Mail/Do Not Call” file, which apparently form scripts are used for the purpose of cleans the databases of member organisa- making disclosures and obtaining consent; tions of the names of consumers who have whether it is “practicable” to disclose • registered not to receive direct marketing purposes of use before collection of per- offers by mail or telephone. sonal information, and, if not, when it is Protection of Personal Data: The Australian Perspective Page 125

3. E-commerce and Online with the Privacy Commissioner’s NPPs. It also contains additional obligations in rela- One of the most commonly quoted im- tion to the protection of a user’s personal pediments to achieving the full potential of information. The IIA is currently in the online services, and in particular the full process of finalising a privacy code and development of electronic commerce, is will then seek to have that code approved the lack of consumer confidence in the pri- by the Privacy Commissioner. Its code re- vacy and integrity of communications lies on a seal program, which will, accord- online. ing to the IIA, be the first government- Personal information about consumers is backed, industry-developed privacy seal in of utmost importance for the business mod- the world. els of many online companies operating on Key issues affecting e-commerce and the Internet. The use of such personal in- online services include: formation is seen to be vital for the market- limits of the definition of personal in- ing of many products online, as well as for • formation: e-mail addresses, web bugs and the tailoring of those products to the spe- cookies,13 and the consequences of their cific preferences of individual consumers. combination with other sources of informa- Advertisers on the worldwide web, and in tion in databases or back up systems; particular those utilising click-through ban- the potential for implementation of a ners and pop-ups, rely on personal infor- • private sector compliance regime to assist mation collected by websites to customise in curbing online fraud and identity theft their marketing, placing pressure on by promoting more rigorous identification websites to enable them to collect personal processes and access controls; information collected when customers ac- apparently “anonymous” transactions cess their advertisements. Information as to • in which an individual’s identity is in fact the browsing habits and spending patterns recorded (this will be an acute issue for of consumers online also is valuable for organisations unfamiliar with their system both offline and online organisations. In functions and capability); fact, for many online companies their cus- the challenge of accommodating func- tomer database is one of their most valu- • tional and stylistic requirements in the able assets. course of developing privacy compliant An e-privacy report in 2000, which can- websites with adequate notices and provi- vassed 100 of the top websites visited by sion for obtaining consent; Australians, found that 72 percent of the hypertext links, their adequacy as a sites collected personal information from • means of displaying disclosure material consumers who visited the site, while only and disclaimers, and the “timing” of their 28 percent of those sites told users that spe- deployment; cific personal information was being collected. The survey found that 43 percent of the sites that collected personal information did so without users actively providing 12 it. This raises the thorny question of the 12. Andersen Legal/Arthur Andersen, Internet adequacy of “consents” obtained using Privacy Survey 2000—A Survey of the Privacy Prac- click-through processes or passive displays tices of Australia’s Most Popular Websites, 26 Octo- ber 2000, available through Google at http:// that may not adequately be brought to the www.google.com/search?q=cache:Vy5km9 qJv28C: attention of users. www.iia.net.au/aasurvey.PDF+internet+privacy+ One potential source of an applicable survey+2000&hl=en&ie=UTF-8. A press release from the Internet Industry Association is available at code for online businesses is the Internet http://www.iia.net.au/news/aasurvey.html. Industry Association (IIA) Internet Indus- 13. Issues arising from the use of cookies are dis- try Code of Practice. Section 8 of that cussed in some detail in Sections 2.33-2.57 of Cookie Monsters? Privacy in the Information Soci- code, entitled “Collection and Use of User ety, a report by the Senate Select Committee on In- Details,” commits signatories to complying formation Technologies, November 2000. Page 126 DEFENSE COUNSEL JOURNAL—January 2003

• the form and role of security state- tablished global standards for online secu- ments and privacy policies and the private rity; sector regime’s “opt-in” provision as com- • procedures for controlling offline han- pliance mechanisms and a means of dling of personal information obtained by “credentialing” an organisation; organisations through their online services; • the extent to which non-governmental • the viability of an online or partly organisations which provide privacy ac- online complaints resolution process; creditation services (for example, TRUSTe • determining the location of an organi- or the BBBOnline Privacy Program run by sation for the purposes of determining the Council of Better Business Bureaus) whether NPP 9 requirements with regard to will benefit from the implementation of the transborder data flows are attracted; and private sector regime; • the outcome of the pending review of • the significance of the “technology- the private sector regime by the European neutral” approach of the private sector re- Union, and the consequences for online gime in light of the absence of firmly es- business of an unfavourable finding. The Privacy Project The HIPAA Privacy Rule: An Overview of Compliance Initiatives and Requirements

The Privacy Rule contains a maze of mandates and exceptions requiring that entities covered by HIPAA need the best of health care counsel

By Nancy A. Lawson, Jennifer M. Orr IADC member Nancy A. Lawson is By and Doedy Sheehan Klar partner in Dinsmore & Shohl LLP in Cin- cinnati, where she concentrates in busi- HE Health Insurance Portability and ness litigation, products liability and gen- Accountability Act of 1996 (HIPAA) eral civil litigation. She has a B.A. from T Skidmore College (1970) an M.Ed. from (Pub.L. No. 104-191) was created and en- Boston University (1971) and a J.D. from acted in response to the health care the University of Toledo (1975). industry’s request for standardization, as a Jennifer M. Orr is an associate at remedy for increasingly frequent health Dinsmore & Shohl. She is a graduate of care privacy breaches, and as an effort to Miami University (B.A. 1995) and the halt steady increases in health care costs. It University of Akron (J.D. 1998), and she received bi-partisan Congressional and in- concentrates in litigation and health care dustry-wide approval and was signed into law. law on August 21, 1996. IADC member Doedy Sheehan Klar is HIPAA’s enactment was without much assistant general counsel of Alcon Labo- fanfare. Most attention focused on the fact ratories Inc. in Fort Worth, Texas, dealing with litigation and advertising and regula- that HIPAA (1) amended the Employees tory law. She earned a B.S. in 1977 from Retirement Income Security Act (ERISA) the University of Texas at Dallas and a to limit health plans’ ability to use pre- J.D. in 1990 from St. Mary’s University. existing condition coverage exclusions and (2) barred discrimination by health plans in a variety of areas. mulgation of national standards; give patients more control over and A. Privacy Rule • access to their medical information; More important for defense counsel, • protect individually identifiable health Title II of HIPAA, denominated “Adminis- information from real or potential threats trative Simplification,” required Congress of disclosure through the setting and en- to pass privacy, security and electronic forcing of standards; and health care transaction standards to regu- • improve efficiency in health care de- late the use of health information transmit- livery by standardizing electronic data in- ted electronically, which, by regulation, terchange (EDI). now has been expanded to encompass Title II stated that if by December 1999, health information in any form or medium. Congress failed to pass meaningful health In a nutshell, the HIPAA standards, privacy legislation, with the input of the when fully implemented, are expected to U.S. Department of Health and Human and will: Services (HHS), then HHS was required to • simplify the administration of health assume the responsibility. HHS’s recom- insurance claims and the costs associated mendations regarding federal privacy legis- with those claims by encouraging the pro- lation were submitted to Congress in 1997, Page 128 DEFENSE COUNSEL JOURNAL—January 2003 but Congress ultimately failed to act. As a with annual receipts of $5 million or less. result, HHS published the Standards for Privacy of Individually Identifiable Health B. Transactions and Code Sets Rule Information, known as the Privacy Rule, in The Privacy Rule represents only one 1 December 2000. portion of HIPAA Administrative Simplifi- In March 2002, after receiving, review- cation. In fact, well before the Privacy ing and responding to more than 60,000 Rule was finalized, HIPAA-covered enti- public comments on the rule, HHS issued ties and their business associates already proposed modifications. These changes were implementing the Standards for were intended to alleviate problems with Electronic Transactions, known as the the original “final” rule that unintentionally Transactions and Code Sets Rule, as com- impeded patient access to health care, pliance with that rule originally was re- while still maintaining the requirements for quired on or before October 16, 2002, ex- the privacy of individually identifiable cept for small health plans. In response to health information. Primarily, the changes requests from many sectors of the health included: (1) eliminating the patient “con- care industry, Congress passed the Admin- sent” requirement, (2) modifying the defi- istrative Simplification Compliance Act nition of “marketing,” (3) providing allow- (ASCA), which allows most covered enti- ances for “incidental uses and disclosures” ties to request a one-year extension until of protected health information, and (4) al- October 16, 2003. lowing additional time for compliance with If no ASCA compliance plan or exten- the cumbersome business associate provision request was submitted on or before sions. October 15, 2002, it is assumed that the Finally, in mid-August 2002, after an ad- covered entity is in compliance with the ditional comment period, HHS issued its Transactions and Code Sets Rule. HIPAA final version of the Privacy Rule and penalties for non-compliance can be as- thereby finalized the groundbreaking and sessed against entities that are not transmit- controversial federal privacy regulations. ting HIPAA standard transactions on Octo- For all intents and purposes, the proposed ber 16, 2002, including possible exclusion changes in the March 27, 2002, amend- from Medicare.2 ment were adopted. Covered entities are required to comply with the Privacy Rule’s C. Security Rule requirements on or before April 14, 2003, with the exception that small health plans HIPAA Administrative Simplification are given an additional year to comply. also calls for a Security Rule to be promul- Small health plans, by statute, are those gated. One difficulty with compliance is with fewer than 50 participants and/or plans that no final Security Rule had been issued as of the fall of 2002. Under HIPAA, and the proposed 1998 proposed Privacy Rule, 1. The Privacy Rule and its Comments are codi- fied at 45 C.F.R. Parts 160 and 164. The full text of certain security measures are required to be the regulations and guidance on HIPAA implementa- implemented. Fortunately, all indications tion are available at aspe.os.dhhs.gov/admnsimp/ and are that the final Security Rule will not be www.hhs.gov/ocr/hipaa. See also Richard L. Antognini, The Law of Unintended Consequences: significantly different from the proposed HIPAA and Liability Insurers, 69 DEF. COUNS. J. rule, so covered entities and their business 296 (2002). associates can and should use the proposed Federal and state statutes creating additional obligations for the handling of records and other infor- rule as a guide for complying with the Pri- mation pertaining to individually identifiable health vacy Rule’s security mandates. information, such as mental health information and AIDS, drug and/or alcohol treatment information, D. The Five Principles are beyond the scope of this article. 2. The model compliance plan promulgated by There are five principles of fair informa- the Center for Medicare and Medicaid Services (CMS) is available at www.cms.gov/hipaa/hipaa2/ tion practices that underlie all the HIPAA ASCAForm.asp. rules. The HIPAA Privacy Rule Page 129

First is the principle of openness, or no- sion, their business associates) are prohib- tice, which has as its focus assuring that ited from using or disclosing protected the existence and purposes of record-keep- health information (PHI) unless they fol- ing systems are publicly known. Second, low the Privacy Rule and strictly adhere to the principle of individual participation, or its requirements. 45 C.F.R. § 164.502 access, states that individuals should have states: “A covered entity may not use or the right to see their records and assure the disclose protected health information, ex- accuracy, completeness and timeliness. cept as permitted or required by this sub- Third, the security principle stands for the part or by subpart C of part 160 of this proposition that there should be reasonable chapter.” safeguards in place for protecting the con- What does this mean? As a starting fidentiality, integrity and availability of in- point, the Privacy Rule calls for the follow- formation. The fourth principle is that of ing: accountability, or enforcement, meaning • It limits the ability of covered entities that violations of the HIPAA rules should and their business associates to use or result in reasonable penalties, and mitiga- transmit PHI without specific advance notion should be permitted and encouraged. tification of the covered entity’s privacy Finally, with respect to fair information practices to the individual whose informa- practices, there should be limits placed on tion is at issue, and, in certain circum- collection, use and disclosure of informa- stances set out in the rule, the advance au- tion (or choice). Information should be col- thorization of the individual for a particular lected only with the knowledge of the indi- use or disclosure. vidual, it should be used only in ways that • It grants covered entities a variety of are relevant for the purposes for which it is exceptions from the advance authorization being collected, and it should be disclosed requirement, as explained below. only with consent/notice or authority.3 • It requires that, even when permitted to disclose protected health information, E. The Road Ahead covered entities make reasonable efforts to limit disclosure to the “minimum neces- It is within this regulatory landscape that sary” to accomplish the intended purpose the Privacy Rule was constructed. Compli- of the use or disclosure. The rule sets out a ance with the rule on or before April 14, variety of exceptions to the “minimum nec- 2003, will require covered entities and essary” standard. those who advise them to be intimately fa- • It allows individuals to inspect, copy miliar with the basic terminology and re- and amend their protected health informa- quirements of the rule and take the neces- tion, where specific criteria are satisfied, sary steps to implement its requirements and it also grants individuals the right to into their business practices. Covered enti- request an accounting of unauthorized uses ties would be wise to establish an inte- and disclosures of their protected health in- grated approach to HIPAA’s Administra- formation. tive Simplification rules for transactions, • It allows individuals to request re- privacy and security, as such integration strictions on the uses or disclosures of pro- and understanding is essential to success- tected health information for which the ful, cost-effective compliance initiatives.

PRIVACY RULE BASICS 3. These principles were discussed by William R. Braithwaite, M.D., Ph.D., colloquially referred to as A. What the Rule Does “Dr. HIPAA,” at the HIPAA Summit West in San Francisco on March 14, 2002. Dr. Braithwaite was The Privacy Rule is composed of two directly involved in the drafting of the Privacy Rule regulatory subparts (45 C.F.R. Parts 160 while working for the government. Now, as a private consultant with PriceWaterhouseCoopers, he advises and 164, and it is centered on one basic health care entities and assists with HIPAA compli- concept: covered entities (and by exten- ance. Page 130 DEFENSE COUNSEL JOURNAL—January 2003 covered entity may otherwise possess the retary may prescribe by regulation. right to use or disclose. The covered entity Under the Transactions and Codes Sets does not have to agree to the restriction. If Rule, standards have been established for the covered entity agrees, then it must all these transactions except for the first re- document compliance with the restriction. port of injury and health claims attachments. Standards for these two categories B. Application of the Rule of HIPAA transactions are expected to be proposed soon. As a result, it is necessary The Privacy Rule applies to all “covered for covered entities to consider relevant entities,” which under 45 C.F.R. § 160.102 portions of the Transactions and Code Sets include: (1) health plans, (2) health care Rule that may affect their implementation clearinghouses and (3) health care provid- of the Privacy Rule’s requirements. ers who transmit any health information in For example, the following electronic electronic form in connection with a trans- activities would likely not be considered action covered by HIPAA. It is worth not- HIPAA “transactions” in and of them- ing that health care providers who do not selves. Health care providers conducting submit HIPAA transactions in standard these activities, and only these activities, form become covered by this rule when may well fall outside of the definition of other entities, such as a billing service or a “covered entity:” hospital, transmit standard electronic trans- • Sending a facsimile to another treat- actions on their behalf. In addition, busi- ing physician that contains PHI; ness associates of covered entities who use, • Sending an e-mail to another physi- disclose or have access to protected health cian asking a question about a patient; information are indirectly affected by the • Saving a medical record to disk and Privacy Rule’s mandates. mailing it to another treating physician; Necessarily, then, the next logical in- and quiry is to determine what transactions are • Using the Internet to transmit required considered HIPAA transactions for pur- information to the government. poses of deciding whether a health care The Privacy Rule does not apply directly provider is a covered entity. “Transactions” other than to “covered entities” identified are the transmission of information be- above. The business associates of covered tween two parties to carry out financial or entities will necessarily, by contract, be ob- administrative activities related to health ligated to comply with certain aspects of care. 45 C.F.R. § 160.103. the Privacy Rule, but covered entities are The following types of information the only ones against which HIPAA penal- transmissions are considered HIPAA trans- ties may be levied for violation of and/or actions: non-compliance with the Privacy Rule. • Health care claims or equivalent en- The entities to which the Privacy Rule counter information; does not apply are: (1) non-covered entities • Health care payment and remittance and (2) health care providers who do not advice; electronically submit HIPAA transactions. • Coordination of benefits; For example, some solo practitioners and • Health care claim status; some small health plans that do not submit • Enrollment and disenrollment in a claims electronically and have obtained health plan; waivers for submitting Medicare claims in • Eligibility for a health plan; paper format arguably would not be con- • Health plan premium payments; sidered “covered entities.” • Referral certification and authoriza- The determination of “covered entity” tion; should be made on a case-by-case basis. • First report of injury; For instance, the final Security Rule, when • Health claims attachments; and issued, may well apply to health care pro- • Other transactions that the HHS Sec- viders not now considered “covered enti- The HIPAA Privacy Rule Page 131 ties” under the Privacy Rule. The services other than persons providing such treat- provided by health care providers should ment, except that such records can be per- be analyzed carefully to ensure that other sonally reviewed by a physician or other requirements and laws (such as “more appropriate professional of the student’s stringent” state laws) do not bring non-cov- choice”; and ered entities within the Privacy Rule. • Employment records held by a covered entity in its role as employer. C. What Is PHI? To comprehend fully what information is covered as PHI, it is necessary to under- The Privacy Rule protects “protected stand what types of information the Pri- health information” (PHI) from unautho- vacy Rule considers IIHI. By definition in rized uses or disclosures, and it is defined 45 C.F.R. § 164.501, “individually identifi- as “individually identifiable health infor- able health information” is information that mation” (IIHI) that is (1) transmitted by is a subset of health information, including electronic media, (2) maintained in any demographic information collected from an medium described in the definition of elec- individual, that is (1) created or received tronic media (the Transactions and Code by a health care provider, health plan, em- Sets Rule], or (3) transmitted or maintained ployer or health care clearinghouse; and (2) in any other form or medium. relates to the past, present or future physi- According to 45 C.F.R. § 162.103, cal or mental health or condition of an indi- “electronic media” means the mode of vidual; the provision of health care to an electronic transmission. It includes the individual; or the past, present or future Internet (wide open), Extranet (using payment for the provision of health care to Internet technology to link a business with an individual; and that identifies the indi- information only accessible to collaborat- vidual; or with respect to which there is a ing parties), leased lines, dial-up lines, pri- reasonable basis to believe the information vate networks, and those transmissions that can be used to identify the individual. are physically moved from one location to In addition, 45 C.F.R. § 160.103 pro- another using magnetic tape, disk or com- vides that “health information” means any pact disk media. information, whether oral or recorded in This definition of PHI clearly subjects any form or medium, that (1) is created or most individually identifiable health infor- received by a health care provider, health mation to its requirements, whether the in- plan, public health authority, employer, life formation is in electronic, paper or oral insurer, school or university or health care form. However, PHI specifically excludes clearinghouse; and (2) relates to the past, any IIHI in: present or future physical or mental health • Education records covered by the or condition of an individual; the provision Family Educational Right and Privacy Act of health care to an individual; or the past, (FERPA); present, or future payment for the provi- • Records described at 20 U.S.C. sion of health care to an individual. § 1232g(a)(4)(B)(iv) as “records on a stu- Once the analysis as to whether a health dent who is eighteen years of age or older, care entity is, in fact, a covered entity has or is attending an institution of postsecon- been conducted and the determination as to dary education, which are made or main- whether the covered entity uses or dis- tained by a physician, psychiatrist, psy- closes PHI has been made, a covered entity chologist, or other recognized professional can move forward into an analysis of the or paraprofessional acting in his profes- core elements of the Privacy Rule. sional or paraprofessional capacity, or as- Careful planning and Privacy Rule sisting in that capacity, and which are implementation efforts are critical for all made, maintained, or used only in connec- covered entities so that they are in compli- tion with the provision of treatment to the ance with the Privacy Rule on or before student, and are not available to anyone April 14, 2003. Page 132 DEFENSE COUNSEL JOURNAL—January 2003

CORE ELEMENTS OF care operations activities of the entity that PRIVACY RULE receives the information, if each entity either has or had a relationship with the indi- A. Permitted Uses and Disclosures of vidual who is the subject of the protected PHI health information being requested, the This section contains a sampling of the protected health information pertains to various uses and disclosures of PHI that such relationship, and the disclosure is (1) are generally permitted under the Privacy for certain quality assessment and im- Rule, but not each and every one. For the provement activities or for credentialing or most part, the permitted uses and disclo- CPE purposes or (2) for the purpose of sures outlined below are the embodiment health care fraud and abuse detection or of common sense privacy principles al- compliance. ready being followed in most states by A covered entity that participates in an most health care entities. These uses and “organized health care arrangement” may disclosures are, as part of the Privacy Rule disclose PHI about an individual without framework, technically considered excep- the individual’s authorization to another tions to the general rule that a covered en- covered entity that participates in the orga- tity may not use or disclose PHI. nized health care arrangement for any health care operations activities of the or- 1. Disclosure to Individual ganized health care arrangement. A covered entity may disclose protected 3. Use and Disclosure after health information to the individual who is Authorization the subject of the information. There are a number of circumstances, 2. Disclosures for Treatment, found at 45 C.F.R. § 164.508, in which a Payment and Health Care covered entity must acquire an authoriza- Operations tion from the individual before it may use or disclose PHI. Primarily, authorizations “Health care operations” include: quality are required for the following uses or dis- assessment and improvement activities, closures. conducting training programs, case management and care coordination, discussion (a) Psychotherapy Notes of treatment alternatives, credentialing or review of health care providers, business, “Psychotherapy notes” means “notes re- accreditation and licensing, underwriting corded (in any medium) by a health care and premium rating, legal services, audit- provider who is a mental health profes- ing, fraud and abuse compliance, case sional documenting or analyzing the con- management and planning-related analysis, tents of conversation during a private coun- customer service, internal grievance reso- seling session or a group, joint or family lution, sale/transfer/merger of covered enti- counseling session and that are separated ties and due diligence, de-identification of from the rest of the individual’s medical PHI, and fundraising. record.” The term excludes medication pre- A covered entity may use or disclose scription and monitoring, counseling ses- PHI sion start and stop times, the modalities • for its own treatment, payment or and frequencies of treatment furnished, re- health care operations (TPO); sults of clinical tests, and any summary of • for the treatment activities of a health the following items: diagnosis, functional care provider; status, the treatment plan, symptoms, prog- • to another covered entity or health nosis, and progress to date. care provider for the payment activities of “Psychotherapy notes,” as defined in the the entity that receives the information; Privacy Rule, does not include the entire • to another covered entity for health mental health record and is therefore less The HIPAA Privacy Rule Page 133 restrictive than many states’ laws with re- In addition, the information contained in spect to the protections afforded mental the directory may be disclosed only to health records. As a result, state law that is members of the clergy or, except for reli- more restrictive—that is, “more strin- gious affiliation, to other persons who ask gent”—than the Privacy Rule’s require- for the individual by name. This exception ments will control the use and disclosure of also permits a covered entity to disclose to such information, rather than the Privacy a family member, other relative, or a close Rule. personal friend of the individual, or any other person identified by the individual, (b) Marketing the PHI “directly relevant to such person’s involvement with the individual’s care or “Marketing” is a defined term under the payment related to the individual’s health Privacy Rule and does not include healthcare.” In both instances, the covered entity related communications from providers to must provide the individual with the oppor- individuals for which providers receive pay- tunity to object to the disclosure. (There ment from a third party—for example, a are some exceptions to this requirement set drug manufacturer. Rather, “marketing” is out in the Privacy Rule, which are not narrowly defined to include only those non- mentioned here.) health related communications for which a health care provider receives payment. If the 5. Potpourri of Uses and Disclosures effort does not constitute “marketing,” then the mandatory requirement for obtaining an (a) Required by Law authorization does not apply. 45 C.F.R. § 164.512(a), (c), (e) and (f) In addition, two activities that fall within cover a number of situations. the definition of “marketing” are exempted from the mandatory requirement for ob- (i) Domestic Violence taining an authorization: (1) a face-to-face communication made by a covered entity In order to disclose information regard- to an individual and (2) a promotional gift ing the victims of domestic violence, the of nominal value provided by the covered disclosure either must be required by law entity. If the “marketing” involves direct or or the individual must agree to the disclo- indirect payment to the covered entity from sure, or, if the disclosure is required by a third party—for example, drug manufac- law, the individual must be informed of the turer—the authorization must state that disclosure. (There are exceptions to the no- such a payment is involved. tification/agreement requirement.)

4. Facility Patient Directories and (ii) Court Orders Disclosures to Relatives and Situations in which a court order or Friends other legal document with the force of law This exception, stated in 45 C.F.R. has been obtained, there is no need to no- § 164.510, enables health care facilities to tify individuals of the disclosure or obtain maintain directories of patients under their their agreement. However, covered entities care and release information about the pa- must be careful to disclose only the PHI tient to the public. The information permit- required by the order and no more. Disclo- ted to be used and disclosed is restricted to sures beyond that ordered to be disclosed the individual’s (1) name, (2) location in would be considered to be in violation of the covered health care provider’s facility, the Privacy Rule. (3) condition described in general terms that do not communicate specific medical (iii) Other Requests information about the individual (for in- Subpoenas, discovery requests, etc. that stance, “fair,” “poor,” “stable”), and (4) re- are not accompanied by a court order are ligious affiliation. permitted, under certain circumstances. For Page 134 DEFENSE COUNSEL JOURNAL—January 2003 example, the covered entity (or business but only under very limited circumstances, associate disclosing the information on be- which are: (1) The health care provider dis- half of the covered entity) must obtain sat- closing the employee’s information is a isfactory assurances from the party seeking member of the employer’s workforce who the PHI that the party either has made rea- provides health care to the employee con- sonable efforts to notify the individual of cerning the conduct of workplace medical the subpoena or request or has made rea- surveillance or the existence of a work-re- sonable efforts to secure a qualified protec- lated injury. (2) The employer needs the tive order. (There are additional require- findings to comply with applicable law. (3) ments set out in the Privacy Rule, but these The employer must inform employees of are the primary ones.) the fact that the information will be disclosed, either by providing a copy of the (iv) Law Enforcement notice to the employee at the time the Different types of requests from law en- health care is provided or by posting the forcement officials authorize different lev- notice. els of disclosure. Different types of requests from law enforcement officials also (c) Disclosures to Health Oversight may require the agreement of the affected Agencies individual. (d) Disclosures Concerning (b) Public Health Activities Decedents Reports for preventing or controlling (e) Disclosures Concerning Crimes disease, injury or disability, including the on Covered Entities’ Premises. reporting of disease, injury, vital events (birth or death), and the conduct of public (f) Disclosures to Organ health surveillance, investigations, and Procurement Organizations to similar activities are permitted disclosures Facilitate Organ Donations under the Privacy Rule. No notice to the individual or approval by the individual is No notice to or agreement by the indi- required. vidual is required. Reports of child abuse or neglect also are permitted, again with no attendant no- (g) Disclosures for Research tice or approval requirements. Purposes Reports to a person subject to the juris- Certain research activities do not require diction of the Food and Drug Administra- an authorization, or the authorization is tion with respect to an FDA-regulated waived. The most common circumstance product or activity for which that person occurs when an institutional review board has responsibility, for the purpose of ac- determines that a waiver is permissible and tivities related to the quality, safety or ef- does so in accordance with certain criteria. fectiveness of the product or activity, are permitted. Such purposes include (1) re- (h) Disclosures to Avert Serious porting adverse events, (2) tracking FDA- Threat to Health or Safety regulated products, (3) enabling product re- calls, repairs, etc. or (3) conducting (i) Disclosures for Specialized post-marketing surveillance. These disclo- Government Functions sures do not require the notice or approval of the individual. These are military and veteran activities; Communicable disease reports are per- national security and intelligence activities; mitted without any notice or approval re- protective services for the President and quirement. others; medical suitability determinations; Disclosure to an employer is permitted, correctional institutions; government pro- The HIPAA Privacy Rule Page 135 grams providing public benefits; and work- the following uses and/or disclosures: (1) ers’ compensation. use by the originator of the notes for treatment, (2) use by the covered entity for its 6. Uses of Limited Data Sets; own training programs, (3) use or disclo- Fundraising sure by the covered entity to defend itself These exceptions are covered by 45 in a legal action or other proceeding C.F.R. § 164.514(e)-(g). brought by the individual, (4) use or disclo- Limited data sets may be disclosed for sure when demanded by HHS as part of its research, public health or health care op- enforcement activities, or (5) use or dis- erations. A data use agreement with the re- closure permitted by Section 164.512(a) cipient of the limited data set is required. (disclosures required by law), Section Fundraising, too, is a limited exception. 164.512(d) (health oversight activities in- If the covered entity satisfies the exception, volving the originator of the notes), Sec- then no authorization is required. (1) The tion 164.512(g)(1) (disclosures about dece- covered entity may use (or disclose to a dents made to coroners and medical business associate) demographic informa- examiners), or Section 164.512(j)(1) (dis- tion relating to an individual and dates of closures a covered entity is permitted to health care provided to the individual for make to avert a serious threat to health or the purpose of raising funds for the cov- safety). ered entity’s own benefit. (2) The covered entity must include in its notice of privacy 2. Contents practices (NPP) that it may use this data for (a) Core Elements fundraising purposes. (3) The fundraising materials must tell the individual how he or Under 45 C.F.R. § 164.508(c)(1), au- she can opt-out of receiving further thorizations must contain certain “core ele- fundraising materials. (4) If an individual ments.” These are: opts out, the covered entity must make 1. A description of the information to be “reasonable efforts” to ensure that future used or disclosed that identifies the infor- fundraising materials are not sent to the in- mation in a specific and meaningful fash- dividual. ion. 2. The name or other specific identifica- 7. Disclosures to Business Associates tion of the person(s) or class of persons authorized to make the requested use or These disclosures are discussed in-depth disclosure. in the Business Associates section of this 3. The name or other specific identifica- article. tion of the person(s), or class of persons, to B. Authorizations whom the covered entity may make the requested use or disclosure. 1. Requirements 4. A description of each purpose of the An authorization is a document designed requested use or disclosure. The statement to sanction a covered entity’s use of spe- “at the request of the individual” is a suffi- cifically identified PHI for a specified pur- cient description of the purpose when an pose, which is other than (1) treatment, individual initiates the authorization and payment or health care operations (TPO), does not, or elects not to, provide a state- or (2) any other use for which disclosure is ment of the purpose. allowed without an authorization. 5. An expiration date or an expiration There are special rules for authorizations event that relates to the individual or the required with respect to psychotherapy purpose of the use or disclosure. The state- notes, as discussed above. The Privacy ment “end of the research study,” “none,” Rule requires providers to obtain authori- or similar language is sufficient if the au- zation and not use or disclose PHI main- thorization is for a use or disclosure of pro- tained in psychotherapy notes except for tected health information for research, in- Page 136 DEFENSE COUNSEL JOURNAL—January 2003 cluding for the creation and maintenance of 4. Revocation a research database or research repository. An individual may revoke an authoriza- 6. Signature of the individual and date. tion to a health care provider or other cov- If a personal representative of the indi- ered entity at any time, provided that the vidual signs the authorization, a description revocation is in writing, but except to the of the representative’s authority to act for extent that (1) the covered entity has taken the individual must also be provided. action in reliance on the authorization; or (b) Required Statements (2) if the authorization was given as a condition of obtaining insurance coverage, In addition to the core elements, Section other law provides the insurer with the 164.508(c)(2) provides that the authoriza- right to contest a claim under the policy or tion must contain statements adequate to the policy itself. As a result, a health care place the individual on notice of all of the provider that wishes to use or disclose PHI following: pursuant to an authorization and does so 1. The individual’s right to revoke the after obtaining an authorization from the authorization in writing, and either (a) the individual may rely on the authorization, exceptions to the right to revoke and a de- even if the individual immediately revokes scription of how the individual may revoke it after the service has been provided. the authorization; or (b) to the extent that the information is included in the notice of C. Notice of Privacy Practices privacy practices (discussed below), a ref- Details concerning the contents and erence to the covered entity’s notice. dissemination of the notice of privacy 2. The ability or inability to condition practices (NPP) are found at 45 C.F.R. treatment, payment, enrollment or eligibil- § 164.520. ity for benefits on the authorization, by stating either (a) that the covered entity 1. Required Contents may not condition treatment, payment, enrollment or eligibility for benefits on This header must be prominently dis- whether the individual signs the authoriza- played at the top of the NPP: THIS NOTICE tion when the prohibition on conditioning DESCRIBES HOW MEDICAL INFORMATION of authorizations applies; or (b) the conse- ABOUT YOU MAY BE USED AND DISCLOSED quences to the individual of a refusal to AND HOW YOU CAN GET ACCESS TO THIS IN- sign the authorization when the covered FORMATION. PLEASE REVIEW IT CAREFULLY. entity can condition treatment, enrollment The NPP must contain s description “in- in the health plan, or eligibility for benefits cluding at least one example” of the types on failure to obtain the authorization. of uses and disclosures of PHI the covered 3. The potential for information dis- entity is permitted to make for purposes of closed pursuant to the authorization to be “treatment, payment and health care opera- subject to redisclosure by the recipient and tions.” The description “must include suffi- no longer be protected. cient detail to place the individual on notice of the uses and disclosures that are (c) Plain Language permitted or required.” There also must be a description of any Section 164.508(c)(3) requires that the other purposes for which the covered entity authorization must be in plain language. is “permitted or required” to use or dis- 3. Copy close PHI without the individual’s written authorization in “sufficient detail to place If a covered entity seeks an authorization the individual on notice of the uses and dis- from an individual, Section 164.508(c)(4) closures that are permitted or required.” requires that the entity must provide the in- If state or other applicable law prohibits dividual with a copy of the signed authori- or materially limits any disclosure permit- zation. ted under the Privacy Rule, that must be The HIPAA Privacy Rule Page 137 described in the notice. • A statement that individuals may Every notice must contain a statement complain to DHHS if they believe their that other uses and disclosures will be privacy rights have been violated by the made only with the individual’s written au- covered entity, and a brief description of thorization and that the individual may re- the covered entity’s privacy complaint fil- voke the authorization as provided in the ing processes along with a statement that Privacy Rule. the individual will not be retaliated against If the covered entity intends to contact for filing a complaint. the individual for any of the purposes listed • Contact information for a person or below, then the description of the types and office that can receive complaints and pro- uses of disclosures must include a separate vide further information about the covered statements disclosing that: (1) The covered entity’s privacy practices. entity may contact the individual to pro- • An effective date for the NPP. vide appointment reminders or information about treatment alternatives or other 2. Distribution of NPPs health-related benefits and services that Health plans must distribute their notices may be of interest to the individual. (2) of privacy practices no later than the com- The covered entity may contact the indi- pliance date for the health plan, which is vidual to raise funds for the covered entity. either April 14, 2003, or April 14, 2004, to (3) If the covered entity is a group health individuals then covered by the plan. Small plan, issues health insurance or serves as a health plans: April 14, 2004. A small health maintenance organization (HMO) health plan is one with annual receipts of with respect to a group health plan, that the $5 million or less. All other health plans: covered entity may disclose protected April 14, 2003. Thereafter, NPPs must be health information to the employer. distributed to new enrollees at the time of There also must be a statement setting enrollment. forth and describing the individual’s rights Within 60 days of a material revision, to (1) request restrictions on the use and the revised NPP must be distributed to disclosure of PHI, with a statement that the then-covered enrollees. At least once every covered entity is not required to agree to three years, the health plan must notify en- such a request; (2) receive “confidential rollees of the availability of the NPP and communications” from the covered entity how to obtain it. Health plans can satisfy on request, using an alternative address or the distribution requirement by providing contact procedure; (3) inspect and copy one copy of the notice to the enrollee; PHI on request; (4) seek amendment of separate copies do not have to be distrib- PHI; (5) receive an accounting of all dis- uted to covered spouses and dependents. closures made of PHI for which account- ings are required under Section 164.528; 3. Direct Treatment Relationships and (6) if the notice is provided electronically, to receive a paper copy. It is important to note the magic words: The NPP also must include: health care providers “with a direct treat- • Statements that the covered entity is ment relationship with an individual.” required by law to “maintain the privacy” They are the ones who must distribute a of PHI and to provide notice of this legal NPP to that individual. If there is no direct duty and its privacy practices. treatment relationship, there is no notice • A statement that the covered entity is requirement. So the analysis turns on what required to abide by the terms of its NPP constitutes a “direct treatment relation- currently in effect. ship.” • A statement that the covered entity re- Under Section 164.501 of the Privacy serves the right to change the terms of its Rule, a “direct treatment relationship” is NPP, including a description of how it will defined as a treatment relationship between give individuals notice of such revisions. an individual and a health care provider Page 138 DEFENSE COUNSEL JOURNAL—January 2003 that is not an “indirect treatment rela- entity, a covered entity must make reason- tionship.” An “indirect treatment relation- able efforts to limit PHI to the “minimum ship” means a relationship between an in- necessary” to accomplish the intended pur- dividual and a health care provider in pose of the use, disclosure or request. In which (1) the health care provider delivers other words, even if a use or disclosure of health care to the individual based on the PHI is permitted, covered entities must orders of another health care provider, and make reasonable efforts to disclose only (2) the health care provider typically pro- the minimum amount of information nec- vides services or products, or reports the essary to achieve the purpose for which it diagnosis or results associated with the is being used or disclosed. health care, directly to another health care provider, who provides the services or 1. Uses of PHI products or reports to the individual. Under 45 C.F.R. § 164.514(d)(2)), a There also are rules for how and when covered entity must identify (1) those per- these health care providers must provide sons or classes of persons, as appropriate, the NPP. These are: in its workforce who need access to pro- (1) Provide the notice no later than the tected health information to carry out their date of the first service delivery or, in an duties; and (2) for each such person or emergency situation, as soon as reasonably class of persons, the category or categories practicable after the emergency treatment of protected health information to which situation. access is needed and any conditions appro- (2) Except in an emergency treatment priate to such access. In doing so, a cov- situation, make a good faith effort to ob- ered entity must make reasonable efforts to tain a written acknowledgment or receipt limit the access to such persons or classes of the notice, and if that is not ob- of persons to PHI, consistent with the cat- tained, document the good faith efforts to egory or categories identified. obtain the acknowledgment and the reason why the acknowledgment was not 2. Disclosures of PHI obtained. (3) Providers that “maintain a physical Under 45 C.F.R. § 164.514(d)(3), for service delivery site” must both post the any type of disclosure that it makes on a notice “in a clear and prominent location routine and recurring basis, a covered en- where it is reasonable to expect individuals tity must implement policies and proce- . . . to be able to read the notice” and make dures (which may be standard protocols) copies available for individuals to take that limit the PHI disclosed to the amount with them. reasonably necessary to achieve the pur- (4) A covered entity that maintains a pose of the disclosure. For all other disclo- website describing its services or benefits sures, a covered entity must (1) develop must “prominently” post its NPP there and criteria designed to limit the PHI disclosed “make the notice available electronically to the information reasonably necessary to through the website.” accomplish the purpose for which disclo- (5) NPPs may also be provided by e- sure is sought; and (2) review requests for mail, subject to prior agreement by the in- disclosure on an individual basis in accor- dividual. dance with such criteria. (6) Health care providers that are part of A covered entity may rely, if such reli- an organized health care delivery arrange- ance is reasonable under the circumstances, ment may use a joint NPP. on a requested disclosure as being the minimum necessary for the stated purpose D. Minimum Necessary Rule when (1) making disclosures to public offi- The Privacy Rule is centered on the con- cials permitted under the Privacy Rule, if cept that, when using or disclosing PHI or the public official represents that the infor- when requesting PHI from another covered mation requested is the minimum neces- The HIPAA Privacy Rule Page 139 sary for the stated purpose(s); (2) the infor- fied as the amount that is reasonably neces- mation is requested by another covered en- sary to accomplish the purpose of the use, tity; (3) the information is requested by a disclosure or request. professional who is a member of its To put it another way, covered entities workforce or is a business associate of the should not use, disclose or request an entire covered entity for the purpose of providing medical records unless it is really needed. professional services to the covered entity, if the professional represents that the infor- 5. Six Exceptions mation requested is the minimum neces- As with most requirements of the Pri- sary for the stated purpose(s); or (4) docu- vacy Rule, there are exceptions to the mini- mentation or representations that comply mum necessary rule. When one of the fol- with the applicable requirements have been lowing situations arises, covered entities provided by a person requesting the infor- and their business associates need not fol- mation for research purposes. low the rule: Disclosures to or requests by a health 3. Requests for PHI • care provider for treatment; Under 45 C.F.R. § 164.514(d)(4), a cov- • Uses or disclosures made to the indi- ered entity must limit any request for PHI vidual or in response to a request that the to that which is reasonably necessary to ac- Privacy Rule allows an individual to make complish the purpose for which the request (Sections 164.524 and 164.528); is made, when requesting such information • Uses or disclosures made pursuant to from other covered entities. For a request an authorization under Section 164.508; that is made on a routine and recurring • Disclosures made to to Health and basis, a covered entity must implement Human Services in response to it’s author- policies and procedures (which may be ity to enforce HIPAA’s privacy protec- standard protocols) that limit the PHI re- tions. HHS authority appears in Sections quested to the amount reasonably neces- 160.300-160.312, Part 160, Subpart C; sary to accomplish the purpose for which • Uses or disclosures that are re- the request is made. quired by law, as described by Section For all other requests, a covered entity 164.512(a); and must (1) develop criteria designed to limit • Uses or disclosures that are required the request for PHI to the information rea- for compliance with applicable require- sonably necessary to accomplish the pur- ments of the Privacy Rule. pose for which the request is made; and (2) review requests for disclosure on an indi- BUSINESS ASSOCIATES AND vidual basis in accordance with such crite- BUSINESS ASSOCIATE ria. AGREEMENTS The business associate provisions of the 4. Special Content Requirement Privacy Rule pseudo-regulate third-party 45 C.F.R. § 164.514(d)(5) is an impor- businesses (that is, non-covered entities) tant aspect of the minimum necessary rule, who receive PHI from a covered entity by and it likely will require most covered enti- imposing additional obligations on covered ties and business associates to modify their entities with respect to the PHI shared with current behavior with respect to the use, those with whom it does business. Because disclosure and requesting of medical a covered entity is bound by the privacy records. It states that for all uses, disclo- standards of the Privacy Rule, HHS sures or requests to which the requirements deemed it necessary to safeguard informa- of the minimum necessary rule apply, a tion transmitted from a covered entity to a covered entity may not use, disclose or re- third party that is performing a function for quest an entire medical record, except or on behalf of that covered entity. Other- when the entire record is specifically justi- wise, a covered entity could contractually Page 140 DEFENSE COUNSEL JOURNAL—January 2003 avoid complying with the Privacy Rule by forms a function or activity as described transferring certain responsibilities to above to, for or on behalf of such orga- others. nized health care arrangement, does not, simply through the performance of such A. Who Is Business Associate function or activity or the provision of such Simply stated, a business associate is an service, become a business associate of entity that uses, discloses, creates or ob- other covered entities participating in the tains PHI in performing a function, activity organized health care arrangement. How- or service on behalf of a covered entity. ever, a covered entity may be a business The key to understanding the business as- associate of another covered entity. sociate provisions is understanding that not Certain individuals or entities that would all third parties doing business with cov- appear to be business associates actually ered entities are considered business asso- are not considered business associates un- ciates under the Privacy Rule. It is only der the Privacy Rule. The following are ex- those entities that act “on behalf of” a cov- cepted from the business associate require- ered entity that fall within the ambit of the ments: (1) a covered entity’s workforce, business associate rules. (2) a physician or contractor of a covered Specifically, “business associate” means, entity, (3) government-sponsored pro- with respect to a covered entity, one who: grams, (4) affiliated organizations deemed a single-covered entity, and (5) a health (a) On behalf of such covered entity or of plan that receives PHI solely for payments an organized health care arrangement (as defined in § 164.501) in which the covered en- purposes. tity participates, but other than in the capac- A covered entity may disclose PHI to a ity of a member of the workforce of such business associate and may allow a busi- covered entity or arrangement, performs, or ness associate to create or receive protected assists in the performance of: health information on its behalf, if the cov- (1) A function or activity involving the ered entity obtains satisfactory assurance use or disclosure of individually identifiable that the business associate will appropri- health information, including claims pro- ately safeguard the information. This stan- cessing or administration, data analysis, pro- dard does not apply (1) with respect to dis- cessing or administration, utilization review, closures by a covered entity to a health quality assurance, billing, benefit management, practice management, and repricing; care provider concerning the treatment of or the individual; (2) with respect to disclo- (2) Any other function or activity regu- sures by a group health plan or a health lated by this subchapter; or insurance issuer or HMO with respect to a (b) Provides, other than in the capacity of group health plan to the plan sponsor, to a member of the workforce of such covered the extent that the applicable requirements entity, legal, actuarial, accounting, con- of the Privacy Rule apply and are met; or sulting, data aggregation (as defined in (3) with respect to uses or disclosures by a § 164.501 of this subchapter), management, health plan that is a government program administrative, accreditation, or financial providing public benefits, if eligibility for, services to or for such covered entity, or to or for an organized health care arrangement or enrollment in, the health plan is deter- in which the covered entity participates, mined by an agency other than the agency where the provision of the service involves administering the health plan, or if the pro- the disclosure of individually identifiable tected health information used to determine health information from such covered entity enrollment or eligibility in the health plan or arrangement, or from another business as- is collected by an agency other than the sociate of such covered entity or arrange- agency administering the health plan, and ment, to the person. such activity is authorized by law, with re- A covered entity participating in an or- spect to the collection and sharing of indi- ganized health care arrangement that per- vidually identifiable health information for The HIPAA Privacy Rule Page 141 the performance of such functions by the provider to another. health plan and the agency other than the agency administering the health plan. 2. Model Provisions A covered entity that violates the satisfactory assurances it provided as a business The final Privacy Rule contains what are associate of another covered entity will be called “Model Business Associate Contract in noncompliance with the standards, Provisions,” which are available at aspe.os. implementation specifications and require- dhhs.gov/admnsimp and which will allevi- ments of the business associate provisions. ate some of the burden associated with A covered entity must document the satis- complying with this portion of the rule. In factory assurances required by this Privacy a nutshell, a business associate agreement Rule through a written contract or other must contain the following 12 elements: written agreement or arrangement with the (1) It must specify the permitted and re- business associate that meets the applicable quired uses and disclosures of PHI by the requirements. business associate. (2) It may permit the business associate B. Business Associate Agreements to use and disclose PHI for its management and administration. 1. When Required (3) It may permit the business associate Covered entities must have agreements to provide data aggregation services relat- with all their business associates in order to ing to the health care operations of the cov- disclose PHI to the business associate. The ered entity. agreement must be done in advance of any (4) It may not authorize the business as- disclosure of PHI and must contain the sat- sociate to use or further disclose the infor- isfactory assurances mentioned above. An mation in any manner that would violate agreement with a business associate is a HIPAA regulations or the contract. written assurance outlining responsibilities, (5) It must require the business associ- and it is required when: ate to employ appropriate safeguards to (1) The covered entity is disclosing PHI prevent the use or disclosure of PHI, other to someone or some organization that will than as provided for by the agreement. use the information on behalf of the cov- (6) It must require the business associ- ered entity. ate to report to the covered entity any use (2) The business associate will be creat- or disclosure of PHI not authorized by the ing or obtaining PHI on behalf of the cov- agreement. ered entity. (7) It must require the business associ- (3) The business associate is providing ate to hold its employees, agents and sub- services to or for the covered entity and the contractors to the same standards as the provision of those services involves disclo- business associate. sure of PHI. (8) It must require the business associ- Under certain circumstances, a business ate to make PHI available to the covered associate agreement is not required: (1) entity when requested. when a covered entity discloses PHI to a (9) It must require the business associ- health care provider concerning treatment ate to make PHI available for the covered of the individual; (2) for the provision, co- entity to amend the PHI and provide ac- ordination or management of health care counting of disclosures. and related services, including the coordi- (10) It must require the business associ- nation or management of health care by a ate to maintain records for HHS inspection. health care provider with a third party; (3) (11) It must permit the covered entity to where the disclosure is a consultation be- terminate the agreement if covered entity tween health care providers related to a pa- determines that the business associate has tient; and (4) in situations involving the re- materially breached the agreement. ferral of a patient for health care from one (12) It must require that when the agree- Page 142 DEFENSE COUNSEL JOURNAL—January 2003 ment terminates, the business associate will the nature of the relationship with the busi- return or destroy all PHI in its possession, ness associate and the sensitivity of the including any copies. If it is not feasible or PHI being used and disclosed. practicable to destroy a to do so, the agreement must specify that the contract’s pro- 4. Compliance Dates tections will continue as long as PHI is in Requests were made by various sectors business associate’s possession. of the health care industry to extend the Privacy Rule compliance dates because 3. Issues to Consider covered entities were finding it difficult, if Some issues, but certainly not all, that not nearly impossible, to complete every- should be addressed and considered by the thing required by April 14, 2003. No ex- covered entity when drafting its business tension was granted, but under the final associate agreements are (1) audit and in- rule they were granted a one-year reprieve spection rights; (2) identification of the from the business associate provisions, un- custodian(s) of the designated record set; til April 14, 2004, under certain circum- (3) safeguarding the information contained stances. in the designated record set; (4) determin- Covered entities were given an exten- ing who is in the best position to under- sion for incorporating the business associ- stand and apply state legal standards to ate agreement provisions into current con- health information that is subject to special tracts that do not come up for renewal legal protection (for example, HIV, mental before April 14, 2003. On those contracts, health, and/or drug or alcohol treatment covered entities have until either the re- records); (5) deciding which party will pay newal date of the contract or April 14, for the maintenance of the designated 2004, whichever is later. In other words, record set; (6) identifying agreements that covered entities cannot enter into new ar- the business associate has with its subcon- rangements without incorporating business tractors and agents; and (7) if the business associate language, but they have an addi- associate retains the PHI after the termina- tional year from the original compliance tion of the contract, determining whether date to bring existing contracts into com- the parties’ indemnification clauses survive pliance. if the business associate improperly discloses PHI. SOME ADDITIONAL TECHNICAL It is important for covered entities to IMPLEMENTATION recognize that they may well be held to REQUIREMENTS have violated the business associate provi- A. Individuals’ Rights sions of the Privacy Rule if they knew of pattern of activity of a business associate 1. Right to Inspect, Copy, Access that might constitute a material breach of Under the Privacy Rule, individuals the parties’ contract, unless the covered en- have the right to inspect or copy their PHI tity takes reasonable steps to cure the contained in a “designated record set” for breach, and, if the cure is unsuccessful, the as long as the PHI is maintained in that set. covered entity terminated the contract or As with most of the Privacy Rule’s man- reported the breach to HHS. dates, there are exceptions to this basic Fortunately, the covered entity is not ob- rule. There is no right to inspect and copy ligated to monitor the business associate, (1) psychotherapy notes; (2) information but it does have a duty to mitigate, to the compiled in reasonable anticipation of, or extent practicable, any harmful effect for use in, a civil, criminal or administra- known to the covered entity to arise from tive action or proceeding; and (3) PHI sub- inappropriate disclosure of PHI by a busi- ject to the Clinical Laboratory Improve- ness associate. Thus, oversight or due dili- ments Amendments of 1988, 42 U.S.C. gence may be appropriate, depending on § 263a, to the extent the provision of ac- The HIPAA Privacy Rule Page 143 cess to the individual would be prohibited Access can be denied, but an appeal by law. must be permitted, when in these three Moreover, the right to access or to ap- situations: peal a denial of access is not required to be • A licensed health care professional given an individual in the following cir- has determined, in the exercise of profes- cumstances: sional judgment, that the access requested • A covered entity that is a correctional is reasonably likely to endanger the life or institution or acting under the direction of physical safety of the individual or another the correctional institution may deny, in person; whole or in part, an inmate’s request to ob- • The protected health information tain a copy of protected health information, makes reference to another person, unless if obtaining the copy would jeopardize the the other person is a health care provider, health, safety, security, custody or rehabili- and a licensed health care professional has tation of the individual or of other inmates, determined, in the exercise of professional or the safety of any officer, employee or judgment, that the access requested is rea- other person at the correctional institution sonably likely to cause substantial harm to or responsible for the transporting of the such other person. inmate. • The request for access is made by the • An individual’s access to protected individual’s personal representative and a health information created or obtained by a licensed health care professional has deter- covered health care provider in the course mined, in the exercise of professional judg- of research that includes treatment may be ment, that the provision of access to such temporarily suspended for as long as the personal representative is reasonably likely research is in progress, provided that the to cause substantial harm to the individual individual has agreed to the denial of ac- or another person. cess when consenting to participate in the Under the Privacy Rule, written denials research that includes treatment, and the must be provided to the individual request- covered health care provider has informed ing access and must be provided in a the individual that the right of access will timely fashion. The denial must be in plain be reinstated upon completion of the re- language, must describe the basis for the search. denial, must explain any appeal rights that • An individual’s access to protected may exist, and must notify the individual health information contained in records that the individual may complain to the subject to the Privacy Act, 5 U.S.C. covered entity or to DHHS. § 552a, may be denied if the denial would In providing individuals with the right to meet the requirements of that act. access their PHI, covered entities and their • An individual’s access may be denied business associates must provide access if the protected health information was ob- only to PHI maintained in a “designated tained from someone other than a health record set,” as that term is defined in the care provider under a promise of confiden- Privacy Rule. tiality and the access requested would be “Designated record set” means a group reasonably likely to reveal the source of of records maintained by or for a covered the information. entity that is (1) the medical records and In addition to these situations, there are billing records about individuals main- still other circumstances under which the tained by or for a covered health care pro- right to access is not required, but an indi- vider; (2) the enrollment, payment, claims vidual is entitled to appeal that determina- adjudication and case or medical manage- tion. Under these exceptions to the general ment record systems maintained by or for a rule providing a right to access, covered health plan; or (3) used, in whole or in part, entities must have appeals procedures in by or for the covered entity to make deci- place that comply with certain require- sions about individuals. ments set out in the Privacy Rule. To understand what constitutes the Page 144 DEFENSE COUNSEL JOURNAL—January 2003 phrase “group of records,” as used in the labor of copying, the protected health in- definition of “designated record set,” it is formation requested by the individual; (b) necessary to look to the Privacy Rule defi- postage, when the individual has requested nition of “record.” This word is said to the copy, or the summary or explanation, mean any item, collection or grouping of be mailed; and (c) preparing an explanation information that includes protected health or summary of the protected health infor- information and is maintained, collected, mation, if agreed to by the individual. used or disseminated by or for a covered entity. 2. Right to Request Amendment In providing individual access to PHI in Individuals are entitled to request that the designated record set, covered entities covered entities amend the PHI contained must do the following: within the designated record set, but the Provide access to inspect or copy • entities do not have to honor these re- PHI in the designated record set or deny quests. If the request for amendment is de- access within 30 days of the receipt of the nied, certain procedures set out in the Pri- request. vacy Rule must be followed. For example, If the request for access is for pro- • documentation of the request and denial tected health information not maintained or must be added to the designated record set. accessible to the covered entity on-site, the In satisfying the requirements of this covered entity must provide access or deny provision, covered entities must document access no later than 60 days from the re- the title(s) of the person(s) or office(s) receipt of the request. sponsible for receiving and processing re- The covered entity can extend these • quests for amendments and then retain that time frames once for 30 days. The covered documentation. In addition, they must as- entity must notify the individual of the sure a timely response to a request for need and reasons for the extension within amendment—60 days for certain requests the original, required time period. and 30 days for others. Covered entities Provide access in the form requested • also must (1) make sure that accepted by the individual. If that form is not readily amendments will be incorporated in (or reproducible, then provide access in a read- linked to) the designated record set, (2) able hard copy form or such other form or make sure that they inform the individual format as agreed to by the covered entity that the amendment has been accepted, and and the individual. (3) acquire the individual’s agreement to The covered entity may provide the • have the covered entity notify the people individual with a summary of the protected with whom the amendment needs to be health information requested, in lieu of shared. providing access to the protected health information or may provide an explanation 3. Right to Accounting of Disclosures of the protected health information to which access has been provided, if (a) the The right to an accounting of disclosures individual agrees in advance to receipt of a is very limited, since most of the disclo- summary or explanation; and (b) the indi- sures of PHI that are made are exempt vidual agrees in advance to the fees im- from the accounting requirement. (There posed, if any, by the covered entity for the is a list of exceptions at 45 C.F.R. summary or explanation. § 164.528(a)(1)(i)-(viii). If the disclosure is • If the individual requests a copy of not excepted from the accounting require- the protected health information or agrees ment, then the covered entity must account to a summary or explanation of such infor- for disclosures for the six-year period pre- mation, the covered entity may impose a ceding the request for an accounting. The reasonable, cost-based fee, provided that individual can designate a shorter period. the fee includes only the cost of (a) copy- The accounting of disclosures must in- ing, including the cost of supplies for and clude: (1) the date of the disclosure; (2) the The HIPAA Privacy Rule Page 145 name of the entity or person who received Another method of de-identification also the PHI and, if known, the address of such may be employed by a covered entity or a person or entity; (3) a brief description of business associate acting on behalf of the the PHI disclosed; and (4) a brief statement covered entity. Information is “de-identi- of the purpose of the disclosure that rea- fied” where all of the following identifiers sonably informs the individual of the basis of the individual or of relatives, employers of the disclosure, or, in lieu of such state- or household members of the individual are ment, a copy of a written request for dis- removed from the information and the cov- closure under Sections 164.502(a)(2)(ii) or ered entity does not have actual knowledge 164.512, if any. There are additional re- that the information could be used alone or quirements for multiple disclosures to the in combination with other information to same person or entity. identify the individual: (1) names; (2) all The first accounting of disclosures to an geographic subdivisions smaller than a individual in any 12-month period must be state (3) all elements of dates (except year) provided without charge. Thereafter, a cov- for dates related to the individual: birth ered entity may impose a “reasonable, date, admission date, discharge date, date cost-based fee” for each subsequent re- of death, all ages over 89 and all elements quest for an accounting by the same indi- of date (including year) that are indicative vidual within that 12-month period. How- of such age; (4) telephone numbers; (5) fax ever, a covered entity may charge the fee numbers; (6) e-mail addresses; (7) Social only if it has informed the individual of the Security numbers; (8) medical record num- existence of the fee in advance and pro- bers; (9) health plan beneficiary numbers; vided the individual with an opportunity to (10) account numbers; (11) certificate/ withdraw or modify the request in order to license numbers; (12) vehicle identifiers, avoid or reduce the fee. serial numbers, license plate numbers; (13) Covered entities should appoint some- device identifiers and serial numbers; (14) one to be responsible for receiving, pro- URLs; (15) IP address numbers; (16) bio- cessing and documenting requests for ac- metric identifiers, including finger and countings just as they do for requests for voiceprints;( 17) full face photographic amendment. images and any comparable images; (18) any other unique number, characteristic, B. De-identification code. A covered entity may use PHI to create De-identified information is health infor- information that is not IIHI or disclose PHI mation that does not identify an individual only to a business associate to do so on its and with respect to which there is no rea- behalf, whether or not the de-identified in- sonable basis to believe that the informa- formation is going to be used by the cov- tion can be used to identify an individual. ered entity. Health information that has A covered entity may determine that health been de-identified is not considered IIHI, information is de-identified, and therefore and the requirements of the Privacy Rule is not IIHI, only if certain, very technical do not apply to de-identified information, requirements are met. provided that (1) disclosure of a code or In the first instance, information may be other means of record identification de- classified as having been “de-identified” signed to enable the information to be re- when a person with appropriate knowledge identified is disclosure of PHI, and (2) if and experience (1) applies generally ac- de-identified information is re-identified, it cepted statistical/scientific principles and may be used or disclosed only as PHI is methods and determines that the risk is permitted to be used or disclosed under the very small that the information could be Privacy Rule. used to identify an individual and (2) docu- A code or other means of record identifi- ments the methods and results of the analy- cation may be assigned to de-identified in- sis. formation so that it can be re-identified, but Page 146 DEFENSE COUNSEL JOURNAL—January 2003 only if (1) the code or other means is not E. Security derived from or related to information Also mandated by Section 164.530, a about the individual and cannot be trans- covered entity must have in place appropri- lated to identify the individual, and (2) the ate administrative, technical and physical covered entity does not use or disclose the safeguards—that is, security—to protect code or mechanism for re-identification. As a rule of thumb, covered entities may the privacy of PHI. Privacy is the indi- choose simply to assume all information is vidual’s right over the use and disclosure PHI. For all practical purposes, covered en- of his or her PHI, and it includes the right tities probably will receive, use and dis- to determine when, how and to what extent close PHI in the course of their businesses, PHI is shared with others. Security, on the not de-identified information, except in other hand, is the specific measures a very limited circumstances, such as re- health care entity must take to protect PHI searching. from any unauthorized breaches of privacy, for instance, if information is stolen or sent C. Appointment of Privacy Officer to the wrong person in error. Security also includes measures taken to ensure against Under Section 164.530 of the Privacy the loss of integrity of PHI, such as if a Rule, each covered entity must designate a patient’s records are lost or destroyed by privacy official who is responsible for the accident. In other words, privacy concerns development and implementation of the what information is covered, and security policies and procedures of the covered en- is the mechanism used to protect it. tity. In addition, each covered entity must HIPAA requires “reasonable and appro- designate a contact person or office who is priate” general security measures, and the responsible for receiving complaints and Proposed Security Rule prescribes a de- who is able to provide further information tailed and comprehensive set of activities about matters covered by the notice of pri- to guard against the unauthorized disclo- vacy practices. sure of PHI stored or transmitted electronically or on paper. The specific require- D. Workforce Training and Education ments set out in the Proposed Security Covered entities also must train their Rule are beyond the scope of this article. workforces on the policies and procedures Much confusion has arisen within the with respect to PHI required by the Privacy health care industry as to exactly what se- Rule, to the extent that training is neces- curity measures will be required under sary and appropriate to carry out their HIPAA in order for covered entities to be functions within the covered entity. There in compliance with the Privacy Rule. This are specific requirements for training set is because privacy and security are ad- out in 45 C.F.R. § 164.530. dressed in separate regulations with sepa- Training must be provided to each mem- rate compliance dates and separate require- ber of the workforce by no later than the ments. compliance date for the covered entity. The best advice is that covered entities Thereafter, each new member of the should implement both privacy and secu- workforce must be trained within a reason- rity measures to comply with the Privacy able time after the person joins the Rule deadline of April 14, 2003. Why? workforce. If material changes are made to First, HIPAA applies to health information the policies and procedures required by the and doesn’t require the final Security Rule Privacy Rule, all members of the work- to become effective. It states that each force who are affected by those changes covered entity that must be trained on the changes within a maintains or transmits health information reasonable time after such changes become shall maintain reasonable and appropriate effective. administrative, technical and physical safe- The HIPAA Privacy Rule Page 147

guards—(A) to ensure the integrity and con- as retail and banking. Unfortunately, even fidentiality of the information; (B) to protect basic security measures are new to certain against any reasonably anticipated (i) threats sectors of the health care industry, which is or hazards to the security or integrity of the generally considered to be 10 to 15 years information; and (ii) unauthorized uses or behind other industries with regard to secu- disclosures of the information; and (C) oth- rity. The final Security Rule will mandate erwise to ensure compliance with this part by the officers and employees of such [cov- safeguards for physical storage, mainte-

ered entity]. nance, transmission and access to PHI. It will apply only to PHI, not to all individu- Second, as discussed above, the Privacy ally identifiable health information. All Rule provides that a covered entity must covered entities (and by extension, their have in place appropriate administrative, business associates) will be required to de- technical and physical safeguards to pro- velop and document a security program to tect the privacy of PHI. A covered entity guard against real and potential threats of must reasonably safeguard PHI from any disclosure or loss, which will include poli- intentional or unintentional use or disclo- cies, procedures and safeguards to protect sure in violation of HIPAA. In addition, a PHI stored on computer systems and in covered entity must reasonably safeguard physical office spaces. PHI to limit incidental uses or disclosures Moreover, the Security Rule will require made pursuant to an otherwise permitted or covered entities to appoint a security of- required use or disclosure. ficer, just as the Privacy Rule requires the Combating threats to both health infor- appointment of a privacy officer. Covered mation security and privacy should be at entities should recognize that security the heart of each covered entity’s Privacy readiness is not just an information tech- Rule compliance efforts. Security threats nology project; it involves people and pro- include: cesses, as well as IT. It’s not surprising that • intentional misuse by internal person- HIPAA compliance has been identified as nel; the top IT priority now and in the next two • malicious or criminal by from internal years, according to the 13th Annual personnel; HIMSS Leadership Survey sponsored by • unauthorized physical intrusion of Superior Consulting Co.4 Covered entities data systems by external persons; and must decide what security measures need • unauthorized intrusion of data sys- to be implemented. They cannot wait until tems by external persons via information the final Security Rule is published to be- networks. gin thinking about security issues. The greatest security threats are not hackers but insiders. Some key areas of se- HIPAA PENALTIES curity concerns are: AND ENFORCEMENT • unprotected Internet; • web browsing and cookies; The penalty provisions of HIPAA apply • authentication; to non-compliance by covered entities with • networks and firewalls; any of the requirements of the Administra- • lack of physical security; tive Simplification rules. However, the Pri- • hackers and other illegality; vacy Rule creates the most HIPAA compli- • internal mischief and disgruntled em- ance pitfalls for covered entities. ployees; and • data sharing. A. Civil Penalties The Proposed Security Rule probably Civil fines of $100 per violation up to will not be substantially modified when it $25,000 for multiple violations of the same is issued in its final form. In fact, most of the security components of HIPAA are al- 4. The full report, including graphics, is available ready being used by other industries, such at www.himss.org/2002survey/. Page 148 DEFENSE COUNSEL JOURNAL—January 2003 standard in any given calendar year may be more than one year in prison for knowingly imposed, but there are many instances in violating HIPAA; (2) not more than which the civil fines can be lifted or re- $100,000 and/or not more than five years duced: in prison for using false pretenses to vio- (1) If an offense is otherwise punishable late HIPAA; and (3) not more than (that is, criminally sanctionable) under $250,000 and/or not more than 10 years in HIPAA, a civil penalty may not be im- prison for violating HIPAA with the intent posed additionally. to gain personally or commercially or with (2) A civil penalty may not be imposed intent to cause malicious harm by the mis- if it is established to the satisfaction of use of IIHI. HHS that persons liable for the penalty did There are no exceptions explicitly set not know, and by exercising reasonable out in the HIPAA statute for mitigation or diligence would not have known, that they waiver of the criminal penalty provisions. violated the provision. (3) A civil penalty may not be imposed C. Enforcement if the failure to comply was due to reason- No formal mechanism is in place now able cause, not willful neglect, and the fail- for policing covered entities’ HIPAA com- ure is corrected during the 30-day period pliance. The HHS Office for Civil Rights beginning on the first date the person liable has been entrusted with the task of enforc- for the penalty knew, or by exercising rea- ing HIPAA, but it has stated that as long as sonable diligence would have known, that covered entities’ compliance efforts are the failure to comply occurred. The 30-day “reasonable and appropriate,” it will work period may be extended on request for a with covered entities to bring them into period of time determined by considering compliance. the nature and extent of the failure to comply. If HHS determines that a person HIPAA PRE-EMPTION failed to comply because the person was unable to comply, it may provide technical Similar to other federal mandates, assistance to the person during the 30-day HIPAA generally pre-empts conflicting period. provisions of state laws. The rule stated in (4) In the case of a failure to comply 45 C.F.R. § 160.203 is that where the Pri- owing to reasonable cause and not to will- vacy Rule conflicts with a provision of ful neglect, any penalty that is not entirely state law, the Privacy Rule controls. waived may be waived to the extent that There are, of course, exceptions to this the payment of such penalty would be ex- general rule. The primary exception is cessive relative to the compliance failure where a state law that relates to the privacy involved. of IIHI is “more stringent” than the Privacy There is no private civil right of action Rule. In that instance, state law controls. under HIPAA for individuals to bring law- According to Section 160.202, state law is suits on the basis of a HIPAA violation “more stringent” than the Privacy Rule if: alone. However, individuals may sue on (1) the state law prohibits or restricts a “invasion of privacy” claims, and they use or disclosure that that the Privacy Rule probably will attempt to use the Privacy would permit, except if the disclosure is (i) Rule as a general “standard of care” for required to determine whether a covered patient privacy. entity is in compliance with the Privacy Rule or (ii) to the individual; (2) the state law permits greater rights B. Criminal Penalties of the individual to access or amend IIHI; Criminal fines can be imposed for know- (3) the state law provides for giving the ing violations of HIPAA on a sliding scale individual a greater amount of information based on the egregiousness of the viola- about a use, disclosure, right or remedy; tion: (1) not more than $50,000 and/or not (4) the state law involves the form, sub- The HIPAA Privacy Rule Page 149 stance or need for giving express legal per- vacy Rule in more than one state—or all 50 mission, and the law provides requirements states, for that matter— by April 14, 2003, that narrow the scope or duration, increase the task can seem more than a little over- the privacy protections, or reduce the coer- whelming. cive effect of the circumstances surround- Many states, medical associations and ing the express legal permission; large health care organizations have com- (5) the state law provides for more de- missioned task forces to analyze state law tailed or longer record-keeping require- with respect to HIPAA pre-emption. For ments relating to accounting of disclosures; example, the Health Privacy Project, part or of the Institute for Health Care Research (6) the state law generally provides and Policy at Georgetown University, has greater privacy protection for the indi- conducted a 50-state survey of privacy vidual. laws, and the results of its study are avail- Second, where a determination is made able to the general public at no cost. How- that state law is necessary to do any of the ever, these analyses are just the starting following, state law controls: (1) prevent point in any pre-emption analysis. The fed- fraud and abuse; (2) ensure appropriate eral government has been asked to provide state regulation of insurance and health additional guidance on this aspect of the plans; (3) assist with state reporting on Privacy Rule in particular. Whether that health care delivery or costs; or (4) serve a guidance will be forthcoming remains to be compelling need related to public health, seen. safety, or welfare, with a minimal intrusion on privacy rights. ADDITIONAL RESOURCES Third, where a state law is principally designed to regulate the manufacturing, The following are a few of the many re- distribution, registration or dispensing or sources available to covered entities for other control of controlled substances, state guidance with respect to HIPAA compli- law controls. ance: Fourth, where a state law provides for • U.S. Department of Health and Hu- more detailed reporting of disease or in- man Services: http://aspe.os.dhhs.gov/ jury, child abuse, birth or death or for more admnsimp/ specific conduct of public health surveil- • HHS Office for Civil Rights: www. lance, investigation or intervention, state hhs.gov/ocr/hipaa/ law controls. • WEDI-SNIP Workgroup for Elec- Finally, where a state law requires a tronic Interchange Stategic National Imple- health plan to report or provide access to mentation Process: http://snip.wedi.org/ information for any of the following pur- • Health Privacy Project: www.health poses, state law controls: (1) management privacy.org audits, (2) financial audits, (3) program • HIPAAdvisory (Phoenix Health Sys- monitoring, (4) program evaluation or (5) tems): www.hipaadvisory.com/ licensure or certification of facilities or in- Covered entities should consult with dividuals. health care attorneys who understand the As is evident, the pre-emption analysis intricacies of the HIPAA Administrative is a significant undertaking. All states have Simplification provisions, in conjunction comprehensive regulatory, statutory and with their own internal efforts to become common law privacy schemes that must be complaint with HIPAA. There are certain considered by covered entities as part and aspects of each rule, and particularly the parcel of their Privacy Rule compliance ef- Privacy Rule, that all but require the advice forts. This analysis is time consuming and of counsel—for examples, drafting compli- will be different for each covered entity in ant policies and procedures, notices of pri- each state. Where an entity that is respon- vacy practices, authorizations, business as- sible for being in compliance with the Pri- sociate agreements, and training programs. Annual Survey of Fidelity and Surety Law, 2002, Part I

This roundup of recent cases covers public and private construction bonds, fidelity and financial institution bonds, and sureties’ remedies

By Bettina E. Brownstein, R. Earl The annual survey of fidelity and surety By Welbaum, Randall I. Marmor law is a project of the IADC Fidelity and By and Roger P. Sauer Surety Committee and is published in two parts. This is Part I of the 2002 survey. Edited by Charles W. Linder Jr. Part II will appear in the July 2003 issue of Defense Counsel Journal. The sections of the survey were pre- I. PUBLIC CONSTRUCTION BONDS pared as follows: A. Bonds under Federal Laws “Public Construction Bonds,” by Bettina Brownstein, a partner in the law firm of Performance bond surety on defaulted the Little Rock firm of Wright, Lindsey & federal government contract not entitled Jennings. This is her first appearance in to contract funds withheld for violations the fidelity and survey law annual survey. of David-Bacon Act. She holds B.A. (1971) and M.A. (1973) Surety that did not give notice of po- degrees from the University of Califor- tential bond default did not have claim nia at Los Angeles and earned her J.D. since government’s disbursement of degree from the University of the Pacific McGeorge School of Law in 1982. funds not in derogation of contract. “Private Construction Bonds,” by Only performance bond surety that IADC member R. Earl Welbaum of the Mi- enters into takeover agreement with ami (Coral Gables) firm of Welbaum, government can sue in Court of Federal Guernsey, Hingston, Greenleaf & Gre- Claims under Contract Disputes Act. gory. In Weschester Fire Insurance Co. v. “Fidelity and Financial Institution United States,1 Weschester was surety for a Bonds,” by IADC member Randall I. contractor who defaulted on a contract to Marmor of the Chicago firm of Clausen, rehabilitate the U.S. Coast Guard water- Miller P.C. front facility at Baton’s Neck, New York. “Sureties’ Remedies,” by IADC mem- The contract incorporated the Davis-Bacon ber Roger P. Sauer of the Westfield, New Jersey, firm of Lindabury, McCormick & Act, 40 U.S.C. § 276a, which requires la- Estabrook. borers to be paid no less than rates speci- The survey acknowledges the assistance fied by the U.S. Department of Labor. The of Michael J. Rune II, Andrew C. Demos act also mandates that these rates be a part and Cole S. Kain. of the contract. After the default, the surety The survey material is edited by IADC claimed entitlement to the entire unpaid member Charles W. Linder Jr. of the In- contract balance, including $60,216.58 that dianapolis firm of Linder & Hollowell. the government, finding the contractor had violated the act, had earmarked as restitu- tion for wages and fringe benefits to under- ing officer’s decision. Ruling on a motion paid workers. for summary judgment, the Court of Fed- The contracting officer disagreed, and eral Claims affirmed the decision of the Weschester sued to reverse of the contract- contracting officer, finding the central and controlling fact to be the incorporation of 1. 52 Fed.Cl. 567 (2002). the act in the contract with its provision Annual Survey of Fidelity and Surety Law 2002 — Part I Page 151 that the Coast Guard was to withhold pay- compliance with the Miller Act, Weststar ments to the contractor if any Davis-Bacon obtained a payment bond from Reliance violations were committed. Not surpris- Opinion Insurance Co. Weststar and a sub- ingly, the court found the workers’ rights contractor, Walton Technology Inc., en- to the contract funds to be superior to those tered into a settlement agreement providing of the Coast Guard, the contractor and the that Weststar would be obligated to pay surety. Walton for rental equipment only “when Weschester also asserted entitlement to and if paid” by the government. Walton $32,000, the amount of the last progress then sued Reliance and the contractor for payment to the contractor, on the ground the amount owed. that at the time it made the payment, the The Miller Act creates an obligation on Coast Guard already had decided to termi- the part of a surety to pay workers and ma- nate the contract. The Coast Guard re- terialmen for “sums justly due.” Reliance sponded that the surety had failed to give contended that since the Navy had not paid requisite notice of the default and had not Weststar, there were no “sums justly due” requested that further progress payments for which Reliance could be liable, since a be withheld. The court agreed, holding that surety’s liability is coextensive with that of the government, as obligee, owes only an its principal. equitable duty to a surety when the latter In Walton Technologies Inc. v. Weststar notifies the former that there has been a Engioeering,2 the Ninth Circuit agreed that default under the bond. In this case, the generally the rules of suretyship apply to court found that the government had kept Miller Act cases, but it stated that in the Westchester informed by copying it on context of the act, a court must look be- cure and show cause notices, thus giving yond the principal’s contractual obligations the surety opportunity to give notice of the to the act itself to define the surety’s liabil- contractor’s potential default on the bonds ity. Rights provided by the Miller Act will and to request that future progress pay- not be delimited by the contract between ments be withheld. Even so, the court the contractor and subcontractor, it stated, stated that the government had a duty to and thus Walton’s right to recovery on the Westchester, in the absence of valid notice bond accrued 90 days after it completed its by the surety of a default, if the govern- work and not “when and if” the government’s progress payment was not in accor- ment paid Weststar. The court further dance with the contract provisions. In this found that the subcontractor had not clearly instance, the Coast Guard’s payment was and explicitly waived its right to sue under held to be proper. the act. The parties asserted that the court had A sharply critical dissent declared that jurisdiction over the matter under the Con- the majority’s holding appeared to “stand tract Disputes Act, 41 U.S. C. § 609(a). the general rule of suretyship law on its The court disagreed. Only a performance head” in not allowing the surety to occupy bond surety that enters into a takeover the shoes of the principal and avail itself of agreement with the government and there- the principal’s defenses. It noted that the by establishes privity with it can maintain majority had determined that a Miller Act an action under the act. This had not oc- surety could be liable to a subcontractor curred in this case. even though the principal owed it nothing.

Surety could not avoid liability on B. State and Local Bonds payment bond based on unsatisfied “pay 1. Procedural when and if paid” clause in settlement agreement. 12-year statute of limitations for ac- Weststar Engineering was prime contractor on a federal project to repaint a Navy crane in Bremerton, Washington. In 2. 290 F.3d 952 (9th Cir. 2002). Page 152 DEFENSE COUNSEL JOURNAL—January 2003 tion on performance bond began to run In a 2-1 decision with a strongly worded on date of final loan closing. dissent, a panel of the Ninth Circuit, hav- The owner of a public housing facility ing considered conflicting precedent and constructed pursuant to an October 22, relying on the plain language of a subcon- 1982, contract, sued Seaboard Surety Co. tract, found the United States and Hawaii over faulty construction on October 16, to be intended third-party beneficiaries of a 1996, The trial court granted Seaboard subcontractor’s bond. As a result, the sub- summary judgment on the ground that the contractor’s surety was obligated to pay claim was barred by Maryland’s 12-year Hawaii and the U.S. federal government statute of limitations for actions on bonds. the defaulting subcontractor’s employment The court first disregarded, as against taxes. Island Insurance Co. v. Hawaiian public policy, the bond’s two-year limi- Foliage & Landscape Inc.4 tations period in favor of the Maryland Oahu Construction Co. had contracted statute, but it looked to that bond provision with the City and County of Oahu to build to determine the parties’ intent as to when a golf course. Oahu subcontracted land- the accrual time commenced and found it scaping work to Hawaiian Foliage & Land- to be the date on which the final payment scape, which obtained a performance/ under the contract fell due. This date was payment bond from Island Insurance Co. October 10, 1984, it concluded, when the Hawaiian defaulted. Island refused to pay state’s Community Development Adminis- its principal’s tax debts. The federal district tration requested final payment from the court granted the surety’s motion for sum- Maryland Housing Fund and stated its be- mary judgment. 2000 U.S.Dist. Lexis lief that the money from the fund was now 16749 (D. Haw.). “payable.” Since the contractor had filed The Ninth Circuit reversed, applying suit after October 10, 1996, its claim was Hawaiian law and adopting the argument time-barred. that the terms of the subcontract required This decision was affirmed in Hagers- Hawaiian to pay all taxes. The bond, in town Elderly Associates Limited Part- turn, covered its principal’s complete per- nership v. Hagerstown Elderly Building formance of the subcontract, which in- Associates Limited Partnership by the cluded payment of taxes. Having deter- Maryland Court of Appeals.3 The court mined the extent of the surety’s duty, the agreed that the 12-year period applied, but court easily found that the federal and state disagreed that this limitation barred the ac- governments were intended third-party tion against the surety. Instead, the appel- beneficiaries of the bond. late court held that, pursuant to the terms It did so by applying Section 302(1) of of the building contract, the accrual period the Restatement (Second) of Contracts, commenced November 1, 1984, the date of which provides that an entity is an intended the final loan closing. Embarking on a defi- beneficiary if the “performance of the nitional exploration of the word “payable,” promise will satisfy an obligation to the it concluded the word meant a sum “that is promisee to pay money to the beneficiary.” to be paid” and not that final payment was Island, the promisor, had promised to en- due. sure Hawaiian’s performance, including payment of taxes. This made the govern- 2. Substantive ments intended beneficiaries who could bring a direct action against Island. Surety liable for defaulting subcon- Island contended that it should not be tractor’s unpaid employment taxes to liable because its intended beneficiary was federal and state governments as in- Oahu, and Oahu could not be responsible tended beneficiaries on bond. for the taxes. The court gave this argument short shrift, instead emphasizing that the 3. 793 A.2d 579 (Md. 2002). language of the subcontract controlled in 4. 288 F.3d 1161 (9th Cir. 2002). that it reflected the parties’ intention to Annual Survey of Fidelity and Surety Law 2002 — Part I Page 153 make the bond responsible for the subcon- right to insist on performance by the tractor’s tax liabilities. surety. It held that tender of a new contrac- Characterizing the majority’s decision as tor and surety was not correction of the “inequitable and unusual” and describing a contractor’s default in that it did not consti- contract “into which no reasonable man or tute full performance as required by the woman would likely enter,” the dissent bond. However, the court did not explain found, adopting a “reasonable, probable, why a new contractor (one that had previ- and natural interpretation” of the contract ously bid on the project) and surety would terms, that the language did not evince an not constitute full performance, since the intention that Island be responsible for the end result—a completed athletic facility taxes. The dissent also contended that the guaranteed by a surety—would be the purpose of the bond was to protect the con- same. tractor (who had no liability for the unpaid taxes) from Hawaiian’s failure to perform Employee leasing contractor could and not to protect the federal or Hawaiian bring suit on general contractor’s bond governments. even though contract violated state employee leasing act. Surety’s tender of substitute contrac- Eastland Financial Services entered into tor with new surety did not satisfy sur- a contract to furnish labor to a general con- ety’s obligation to school board. tractor, MC Builders, with Mid-Continent In School Board of Broward County, Casualty Co. as surety for MC Builders. At Florida v. Great American Insurance Co.,5 the time of the contract, in violation of the school board appealed a decision grant- New Mexico’s Employee Leasing Act, ing summary judgment against it in favor Eastland was not a registered company and of Great American, the surety. had failed to post its own surety bond. Rockland Construction Co. contracted In Eastland Financial Services v. Men- with the school board to build a high doza,6 the New Mexico Court of Appeals, school athletic field and sports complex. while conceding that generally a contract Great made in violation of a statute prescribing American issued a performance bond. penalties is void, looked to the policy of Before beginning work, Rockland de- the law violated, the type of illegality in- faulted, and the board demanded that the volved in the contract and the facts of the surety complete construction. Great Ameri- case before deciding that the contract was can made arrangements for another con- enforceable against the surety on its bond. tractor to do so and to have a new surety Mid-Continent had argued unsuccess- guarantee completion. Great American fully to the trial court that Eastland should would then be released from its bond. The be precluded from bringing suit. The ap- board rejected this offer and insisted that pellate court agreed with the lower court, Great American either serve as general finding that the factual context and public contractor or supervise the new contrac- policy did not favor voiding the contract tor’s work. but instead favored protecting the leased After negotiations, the board declared employees. the surety in default and sued, arguing that the tender of a substitute contractor and de- Factual dispute concerning contrac- mand for release did not fulfill its obliga- tor’s substantial compliance with regis- tion to “correct” Rockland’s default. The tration statute precluded summary judg- trial court found in favor of the surety. ment for surety In a puzzling decision, the Florida Court of Appeal reversed, declaring that to allow Great American to substitute a new con- 5. 807 So.2d 750 (Fla.App. 2002), rehearing denied, March 15, 2002.. tractor would narrow the scope of bond 6. 43 P.3d 375 (N.M.App. 2002), corrected April coverage and cause the board to give up its 8, 2002. Page 154 DEFENSE COUNSEL JOURNAL—January 2003

An Alaska trial court dismissed a II. PRIVATE CONSTRUCTION subcontractor’s Little Miller Act claim BONDS against the general contractor’s surety be- A. Liability of Surety cause the contractor had failed to comply with an Alaska statute that bars a contrac- Under Georgia law, filing of lien- tor from suing for compensation unless it release bond does not create new cause either met or was in substantial compliance of action for subcontractor against with the statute’s registration requirements owner. Rather, subcontractor or sup- when the contract was entered into. In plier must first perfect its lien and seek McCormick v. Reliance Insurance Co.,7 the recovery from contractor prior to seek- Alaska Supreme Court, finding questions ing recovery from owner’s surety. of material fact as to whether the contrac- In Few v. Capitol Materials Inc.,8 a tor had substantially complied with the property owner, Joseph Few, contracted statute, reversed. with the Perez Group, the contractor, to John McCormick orally contracted with build a house. Six days after filing for Alaska Electric Co., an electrical subcon- bankruptcy, the contractor purchased dry tractor on an Anchorage International Air- wall materials from Capital Materials, for port runway project, to provide trucking which it failed to pay, and Capital Materi- services. The general contractor, Wilder als filed a materialman’s lien against Few’s Construction Co., refused payment, claim- property. He discharged the lien by filing ing that McCormick’s work was outside a lien-release bond, as provided for in the scope of the agreement to provide end- Georgia’s mechanic’s lien statute, Section dump trucking services. McCormick then 44-14-364 of the Georgia Code. Capital sued Wilder and its surety, Reliance. Mov- Materials then proceeded directly against ing for summary judgment, Reliance as- Few on the bond without commencing any serted that McCormick’s contractor regis- action against Perez Group. The trial court tration had expired before he contracted granted summary judgment in favor of the with Alaska Electric and that thus his ac- supplier on its claim, which the Georgia tion was barred. Court of Appeals affirmed. The Alaska Supreme Court discussed The Georgia Supreme Court reversed, the courts’ approach to the statute as one of holding that an owner’s filing of a lien- requiring substantial rather than strict com- release bond under the Georgia statute does pliance in that substantial compliance not create a new cause of action for a lien “affords the public the same protection claimant. The bond merely stands in the that strict compliance would offer.” Be- place of the real property as security for the cause the court found that the evidence of lien claimant and does not hinder the prin- McCormick’s prior registration with the cipal and surety on the bond from raising Alaska Division of Occupational Licens- any defense that would have been available ing, his valid contractor’s license issued by as a defense to the lien foreclosure. The the Municipality of Anchorage, and his court ruled that a lien claimant must first state business license, as well as evidence seek to recover from the contract, with that his bond and insurance had remained whom it was in privity, and not the owner in effect after his license had elapsed, of the property. raised a factual issue about substantial The case was reversed because Capital compliance that warranted reversal of the Materials failed to commence a timely ac- trial court’s dismissal of his complaint. tion against contractor before proceeding against Few on his bond or to fall within any of the exceptions of the in the statute. 7. 46 P.3d 1009 (Alaska 2002). 8. 559 S.E.2d 429 (Ga. 2002), reconsideration B. Miscellaneous denied, February 25, 2002, rev’g 543 S.E.2d 102 (Ga.App. 2000). Motion to recover attorneys’ fees in Annual Survey of Fidelity and Surety Law 2002 — Part I Page 155 action in Florida must be filed within 30 with Mountbatten seeking payment of days after filing of judgment, thus $1,113,251.90 under one of the labor and surety’s claim filed 47 after favorable material bonds. Tri-state filed suit, and judgment was untimely. Mountbatten asserted several affirmative In Ulico Casualty Co. v. Roger Kennedy defenses, among which was that Tri-state Construction Inc.,9 the trial court entered a was not, as a matter of law, a proper claim- final judgment in favor of the Ulico Casu- ant under the surety bond. On that basis, alty Co., the surety, and its principal under the district court granted Mountbatten’s its bond against the general contractor on motion for summary judgment. January 17, 2001. Ulico moved for attor- The U.S. District Court for the Southern neys’ fees 47 days later, on March 6. The District of New York held that Tri-State trial court held that the motion was un- was not a proper bond claimant because as timely under a recent amendments to the a professional employer organization Florida Rules of Civil Procedure.10 (PEO), it did not provide labor and mate- The Florida Court of Appeal affirmed rial as the terms were used in the language and held that the surety’s motion was un- of the bond. The court also noted that Tri- timely. Prior to the January 1, 2001, State’s efforts to characterize itself as a amendment of Rule 1.525, the court ex- joint employer of the labors on the project plained, an attorneys’ fees motion could be to which the bonds applied did not make it filed within a “reasonable time” after entry a provider of labor and material itself— of the final judgment. It held that in revis- Tri-state merely served administrative ing Rule 1.525 to specifically state that functions, including payroll and human re- motions “shall” be served within 30 days source services. These, the court con- after the filing of a judgment and consider- cluded, did not meet the bond’s definition ing the committee note to the rule, which of labor and materials. 2001 U.S.Dist. explains that the rule is intended to estab- Lexis 6279. lish a time requirement to serve for costs The Second Circuit explained that since and attorneys’ fees, the Florida Supreme this was a diversity case, the law of New Court clearly intended to abrogate the long York applied. It found that Tri-state’s PEO standing “reasonable time” standard. status as a claimant under the surety bond was a matter of first impression in New C. Liability of Surety York’s jurisprudence. Noting that the PEO industry has developed only recently and is Liability of surety under labor and experiencing fast growth, it certified this material payment bond claim by con- question to the New York Court of Ap- struction project staffing company is peals: “In the circumstances presented, is a matter of first impression under New PEO, under New York law, a proper claim- York law, and question is certified to ant under a labor and materials surety New York’s highest court. bond?” In Tri-state Employment Service Inc. v. The court further noted that in general Mountbatten Surety Co.,11 Team Star Con- those who can recover on a payment bond tractors entered into an agreement with are subcontractors or persons supplying la- O’Ahlborg & Sons to perform construction bor or materials to subcontractors or gen- work at a site in Quincy, Massachusetts. eral contractors, and that other jurisdictions Mountbatten Surety Co. issued two labor hold that lenders or creditor cannot be a and material bonds to Team Star as princi- proper bond claimant. pal and O’Ahlborg as obligee. Tri-state contended that its status is that Tri-state then entered into an oral agreement with Team Star to provide employee leasing services. Team Star subsequently 9. 821 So.2d 453 (Fla.App. 2002). failed to make payments on outstanding in- 10. See 773 So.2d 1099 (Fla. 2000). voices, and Tri-state filed a proof of claim 11. 295 F.3d 256 (2d Cir. 2002). Page 156 DEFENSE COUNSEL JOURNAL—January 2003 of an “employer” of the workers involved available to the contractor,13 the court at the project and that it is treated accord- stated, the surety in this case, USF&G, ingly under the Internal Revenue Code and could assert Anzac’s failure to comply with other statutes, such as the Fair Labor Stan- a condition precedent as a defense to non- dards Act. The Second Circuit observed payment. Therefore, Anzac’s failure to that California cases have held that the le- abide by a valid condition precedent ex- gal status of an employer of laborers fur- cused Team Land and the surety from nished to a work of improvement is crucial making payment until such time as Anzac factor that distinguishes a person who “fur- provided the requisite release. nishes” laborers to a project “from a person The court went further and held that who merely organizes the work force, per- even if it were to determine that the lan- forms administrative functions, advances guage used was ambiguous, invalidating wages, or does all three in behalf of an- the waiver provision was not the correct other.” course of action. The trial court “could have easily interpreted the release provi- D. Indemnity sion according to the intent of the parties and the custom of the industry.” Surety asserted valid defense to non- payment under bond due to subcon- III. FIDELITY AND FINANCIAL tractor’s failure to execute condition INSTITUTION BONDS precedent indemnity/hold harmless agreement. A. Emloyee Dishonesty In Team Land Development Inc. v. Trade secrets not covered property Anzac Contractors Inc.,12 a subcontract under crime policy. contained a provision that made final pay- In Holloway Sportswear Inc. v. Trans- ment contingent on the subcontractor portation Insurance Co.,14 Holloway (Anzac) providing releases to the prime claimed that its former employee stole contractor (Team Land) in “satisfactory” trade secrets, including clothing designs form holding the prime contractor and and pricing information, which he sold to a owner free and harmless from all claims competitor. It sought recovery of its losses arising from or in connection with the sub- under a policy that included commercial contract. Team Land issued a check to the crime coverage. The policy indemnified escrow account of Anzac’s attorney, but Holloway for damage to “covered prop- Anzac did not provide the releases as erty,” which was defined as “money” and called for in the subcontract. “securities” and tangible property other The trial court construed the release pro- than money and securities. vision of the subcontract as “ambiguous,” The federal district court in the Southern thereby relieving Anzac from the condition District of Ohio entered summary judg- precedent to payment. It granted summary ment for the insurer, holding that the to Anzac. plaintiff’s trade secrets were intangible The Florida Court of Appeal reversed, property and therefore did not fall within referring to a dictionary definition of “sat- the policy’s definition of “covered prop- isfactory” as meaning “giving satisfaction erty.” sufficient to meet a demand or requirement; adequate.” B. Definition of Employee Since a surety is afforded any defenses Provision in policy defining “em- 12. 811 So.2d 698 (Fla.App. 2002), rehearing de- ployee” as person employed by “employ- nied, March 22, 2002. ment contractor” was ambiguous. 13. Citing C.A. Oakes Constr. Co. v. Ajax Paving In Mansion Hills Condominium Ass’n v. Indus. Inc., 652 So.2d 914, 916 (Fla.App. 1995). 15 14. 177 F.Supp.2d 764 (S.D. Ohio 2001). American Family Mutual Insurance Co., 15. 62 S.W.3d 633 (Mo.App. 2001). a condominium association claimed that an Annual Survey of Fidelity and Surety Law 2002 — Part I Page 157 office manager, who had been furnished by The intermediate appellate court agreed a management company and embezzled and affirmed the grant of summary judg- funds from the association’s checking ac- ment in favor of the insurer, but the West count, was its employee. It sought recovery Virginia Supreme Court of Appeals re- under an employee dishonesty endorse- versed. ment of a property and business insurance The supreme court observed that the dis- policy. tinction between an employee and an inde- The trial court entered judgment for the pendent contractor is whether an insured insurer, finding that the office manager has the right to control and supervise the was not an “employee” within the meaning work performed. The trial court had con- of the policy, but the Missouri Court of cluded that the plaintiff never exercised Appeals reversed. control over Tyler, but the court noted that The policy covered acts of dishonesty by the failure to exercise control did not dic- an “employee” of the insured, which in- tate whether the plaintiff had the right to do cluded any person employed by an “em- so. The court held that there was a genuine ployment contractor” while the person per- issue of material fact whether the plaintiff formed services under the insured’s had the right to supervise and control direction and control. The association had Tyler’s work, hired KEM Construction Co. to manage the property, and KEM placed the office C. Exclusions manager on site. KEM paid all salary and Insurance broker who furnished cli- employment benefits, but the office man- ents to premium finance company was ager was subject to the direction and con- intermediary or finder within meaning trol of the association. The insurer main- of exclusion. tained that “employment contractor” First Insurance Funding Corp. v. Fed- clearly referred to a temporary insurance eral Insurance Co.17 involved construction agency, and therefore KEM was not an of an exclusion in a financial institution “employment contractor” as that term was bond that barred coverage for losses caused used in the policy. by an agent, broker, independent contrac- The court concluded that the term was tor, intermediary, finder or similar repre- subject to more than one reasonable inter- sentative. First Insurance sought a declara- pretation, and therefore it was ambiguous tory judgment that it was entitled to and must be construed in favor of the in- indemnification and that Federal’s denial sured. of the claim amounted to an unreasonable and vexatious action under the Illinois In- Question of fact whether person re- surance Code. The federal district court sponsible for loss was employee or inde- held that the exclusion applied to the loss pendent contractor. claimed by the plaintiff and dismissed the In Mountain Lodge Ass’n v. Crum & action. The Seventh Circuit affirmed. Forster Indemnity Co.,16 Mountain Lodge, First Insurance was engaged in an insur- an unincorporated association, hired ance premium finance business. Colesons Norman D. Tyler as a “construction man- Insurance Group, an independent insurance ager” to oversee renovations of its condo- broker, frequently referred clients to First minium facility. Tyler allegedly overbilled Insurance to obtain financing for payment the plaintiff for labor and materials and of insurance premiums. Colesons assisted misappropriated funds, and the plaintiff clients in preparing the loan application sought recovery of the loss under a policy and finance agreement required by First that included employee theft coverage. The Insurance. In the transaction at issue, First insurer denied coverage on the ground that Tyler was an independent contractor and not an employee within the meaning of the 16. 558 S.E.2d 336 (W.Va. 2001). policy. 17. 284 F.3d 790 (7th Cir. 2002). Page 158 DEFENSE COUNSEL JOURNAL—January 2003

Insurance disbursed $4.3 million to Cole- “immediately upon discovery” by the in- sons on the faith of forged loan documents sured of any dishonest act committed by and sought recovery of the loss under its that employee. It also required the insured financial institution bond, to give notice of loss as soon as possible The Seventh Circuit concluded that and to submit a proof of loss within 120 Colesons was an intermediary, finder or days. The court concluded that the evi- similar representative of the insured within dence supported the trial court’s determi- the unambiguous meaning of the exclusion. nation that the insured had discovered the The court noted that Colesons’s responsi- dishonest conduct in March 1998, when bility for bringing businesses together to the president had agreed to repay the unau- consummate a transaction was the precise thorized charges within two weeks. The type of conduct in which an intermediary court held that coverage for the president or finder typically engages. It rejected First terminated at that time. Insurance’s contention that Colesons did Proof of loss filed in June 1999 was un- not act as its intermediary in the course of timely, the court concluded, and that the fraudulent transactions involving loans to insurer was prejudiced by the delay. fictitious entities. It held that First Insur- ance bore the risk of cloaking Colesons Acquisition of insured’s stock by an- with the authority to act as its intermediary. other bank was “taking over” of insured and terminated coverage. D. Termination of Coverage In American Casualty Co. of Reading, Pennsylvania v. Etowah Bank,19 American Coverage terminated as to employee Casualty, a CNA Cos. entity, insured when audit first revealed unauthorized Etowah Bank under a financial institution expenditures; proof of loss was untimely. bond. It denied coverage for an employee In Acadia Insurance Co. v. Keiser Indus- dishonesty loss discovered during the term tries Inc.,18 the president of Keiser, the in- of the bond because Etowah had been sured, made unauthorized personal charges “taken over” by Regions Financial Corp. on the company credit card. Keiser, a con- 30 days before the loss was discovered. structor of modular homes, sought recov- Regions had purchased 100 percent of ery of the loss under a policy that included Etowah’s stock. American Casualty filed a commercial crime coverage. complaint for declaratory judgment. A March 1998 audit uncovered unautho- On cross motions for summary judg- rized charges of $40,000. The president ment, the district court found that the ter- agreed to repay the charges within two mination provision of the bond was am- weeks, but he did not do so. A March 1999 biguous and entered judgment for the audit revealed that the president’s personal insured. The 11th Circuit reversed and in- charges on the credit card had increased to structed the lower court to enter judgment more than $225,000. In June 1999, the infor the surety. sured notified the insurer of loss and sub- Under its terms, the bond terminated “as mitted a proof of claim to the insurer, an entirety” on the “taking over” of the in- which denied coverage and filed a declara- sured by another institution. The appeals tory judgment action. This was denied, but court held that Etowah had been taken over following a bench trial, the trial court en- when Regions purchased 100 percent of tered judgment for the insurer because of Etowah’s stock and Etowah became its late notice. wholly owned subsidiary. It concluded that The Supreme Judicial Court of Maine the term “taking over,” as used in the bond, affirmed. The policy provided that the in- is not ambiguous and occurs when a finan- surance was cancelled as to any employee cial institution acquires more than 50 percent of the stock of another institution. 18. 793 A.2d 495 (Me. 2002). Etowah argued that a “taking over” by 19. 288 F.3d 1282 (11th Cir. 2002). Regions never occurred because Regions Annual Survey of Fidelity and Surety Law 2002 — Part I Page 159 did not assume control of Etowah’s “core one its employees. The trial court deter- functions,” that Etowah continued to oper- mined that the common law made-whole ate as before under the same by-laws, and doctrine prevented CNA from enforcing its that it maintained separate books and subrogation rights until the insured was records, with management remaining sub- fully reimbursed for its loss. The appellate stantially unchanged. Turning back this court affirmed, argument, the court observed that the CNA insured KVA under a business “core functions” test is used to determine package policy that included coverage for whether a receiver or regulator has as- “employee dishonesty.” KVA’s employee sumed control over, and has thus taken embezzled $2.3 million over a 10-year over, a failed financial institution, where span, about $268,000 of which occurred stock ownership has not changed. That test, during the term of the policy. CNA paid the court stated, does not apply in cases the $50,000 policy limit, and KVA initi- involving the purchase of stock by another ated lawsuits against those responsible for institution. the loss, including One Valley Bank. CNA maintained that the subrogation E. Third-party Rights provision of the policy entitled it to a share of the recoveries. The provision stated that Employee dishonesty coverage did not “amounts paid in excess of the payments inure to insured’s creditor. under the policy shall be reimbursed up to In O/E Systems Inc. v. Inacom Corp.,20 the amount paid by those, including you, the plaintiff leased computer equipment to who made such payments.” Finding the Inacom. After Inacom filed a petition in provision to be ambiguous, the West Vir- bankruptcy, the leased computer equip- ginia Supreme Court of Appeals instead ment could not be located. The lessor as- applied the common law made-whole doc- sumed that the equipment was misappro- trine, under which an insured must be fully priated by Inacom’s former employees and reimbursed before subrogation rights arise. asserted a claim under Inacom’s commer- The court noted that the doctrine may be cial crime policy, The federal district court overridden by valid contract, but held that in Delaware granted the insurer’s motion to the contractual provision was ambiguous dismiss. and therefore invalid, Under the terms of the policy, coverage was provided only for the insured’s benefit IV. SURETIES’ REMEDIES and did not inure to any other person or organization. The court held that the plain- Power plant operator that paid de- tiff therefore could not make a claim di- faulting contractor subs and suppliers is rectly under Inacom’s policy because it not volunteer and is allowed recovery was not a named insured under the policy under performance bond. or a third-party beneficiary, nor was it an Ordinarily, sureties are clamorous pro- assignee or judgment creditor of the in- ponents of the doctrine of equitable subro- sured. gation, but in Federal Insurance Co. v. Maine Yankee Atomic Power Co.,22 equi- F. Recoveries table subrogation was used against a surety. Made-whole doctrine superceded am- In 1998, Maine Yankee decided to de- biguous subrogation clause in policy. commission one of its nuclear plants. It In Kanawha Valley Radiologists Inc. v. hired Stone and Webster Engineering to do One Valley Bank N.A.,21 CNA Cos. inter- the job at a cost of $250 million. Under the vened in a lawsuit to obtain a share of the proceeds of a settlement Kanawha Valley (KVA), its insured, had negotiated with 20. 179 F.Supp.2d 363 (D. Del. 2002). One Valley Bank to obtain partial restitu- 21. 557 S.E.2d 277 (W.Va. 2001). tion for funds embezzled from KVA by 22. 183 F.Supp.2d 76 (D. Me. 2001). Page 160 DEFENSE COUNSEL JOURNAL—January 2003 contract, performance bonds in the amount $12,000,000 it would ultimately have had to of 15 percent of the contract price were pay them under the payment bond a risk for secured from Federal Insurance Co. which Federal Insurance received the pre- By 2000, the power company was hav- mium.23 ing serious concerns with the contractor’s The theory is then referred to as one of solvency, and in May of that year a default “equitable subrogation combined with un- was declared. By that time, approximately just enrichment.” $12 million worth of labor and material The court had no trouble in finding that from the contractor’s subs and suppliers Maine Yankee unjustly enriched Federal had accrued but not yet been paid. How- Insurance, basically reasoning that it had ever, not all these amounts were overdue, paid sums that otherwise would have been and no claim was made that the surety de- payable under the payment bond, despite faulted on its payment bond obligations. the fact that no claims were ever presented. The power company was apparently It also refused to preclude recovery under quite anxious to complete the project. To the doctrine of volunteerism, find this to be guard against delay, it negotiated some- something requiring strict interpretation as thing called an interim service agreement well as good and sound economic reasons that allowed Stone & Webster to continue for Maine Yankee doing what it did. In ad- work on a reimbursable cost basis, with dition, although dealing with a given sub- payments going from Maine Yankee to ject matter under an express contract would subs and suppliers directly. Federal con- have precluded recovery under Maine curred and, in fact, even signed the agree- common law, the court found this not to be ment, which, however, contained a general the case. reservation of rights clause. Maine Yankee then paid the subs and Award of attorneys’ fees upheld pur- suppliers approximately $12 million for ac- suant to indemnity agreement where cruals that predated the default. Later, it challenge was non-specific. decided to complete the decommissioning Schaefer v. Spider Staging Corp.24 did project itself and made a formal claim not involve a surety. In fact, it was a per- against Federal for the full amount of the sonal injury case, but it did involve a con- performance bond. There was at least struction project and a contractual indem- agreement that the obligee had no right to nity agreement. recover under the payment bond. Subcon- Two roofers employed by Schaefer and tractors and suppliers were paid as part of Sons Roofing Inc. were hurt on the project the agreement, and claims under the pay- when a scaffolding platform rented from ment bond were never presented. Spider collapsed. In the paperwork on the Although the federal district court in project the roofer agreed to indemnify the Maine referred to the route of recovery as scaffolding company even for its own neg- “equitable subrogation,” its analysis soon ligence. The relevant clause was one to in- turned to an “unjust enrichment” claim. It demnify and hold harmless from any and stated: all claims, actions, suits, proceedings, Since the [payment] bond amounts never costs, expenses, damages and liabilities, in- actually came due, at bottom Maine Yankee cluding costs of suit and attorneys’ fees. is arguing that Federal Insurance has been The trial court had made fairly substan- unjust enriched—that by virtue of Maine tial awards. In one action, $315,358 was Yankee’s payments to subcontractors and recovered; in another, the fee bill was suppliers Federal Insurance has saved the $55,752. Schaefer Roofing appealed on the grounds of reasonableness. On appeal, the Eighth Circuit initially 23. Id. at 76. considered the standard of review and re- 24. 275 F.3d 735 (8th Cir. 2002), panel and en banc rehearing denied, 2002 U.S.App. Lexis 2341. fused to scrutinize the listing of services Annual Survey of Fidelity and Surety Law 2002 — Part I Page 161 rendered, instead deferring to the “careful their liability to the amount of the bond. In consideration” of the court below. In addi- response to this argument, the successor tion, Schaefer made “no specific challenge conservators pointed to well-settled Kansas to [the] records except an unsupported as- law which, they claimed, followed the ma- sertion that the hourly billing rates were jority view that while the amount of the excessive.” It was held that lacking a de- penal sum of a bond may not be enlarged, a tailed challenge, the district court did not surety may be required to pay prejudgment abuse its discretion in accepting the sub- interest and costs of suit even if they ex- mission of fee bills. ceed the amount of the bond. After an ex- Disputes over the recovery of fees and haustive analysis of the cases cited by the costs are common in indemnity battles, and successor conservators, the court agreed the case provides further corroboration for with their position and acknowledged that the premise that in indemnity battles an in- Kansas state law has allowed the award of demnity agreement means what it says. prejudgment interest against a surety since 1885. Surety liable for interest and costs in Next, the sureties argued that while an excess of sum of penal bond; surety’s award of interest from the date of the defal- liability for interest arises at date of cation may be authorized by Kansas state conversion of property, not from date of law, case law does not mandate such an notice or demand on surety. outcome. The sureties claimed that the rel- In In the Matter of the Conservatorship evant case law allows for an award of in- of Huerta,25 the Kansas Supreme Court terest from the time that the sureties’ duty ruled that a lower court was within its au- to discharge the liability “matured.” In thority to impose a judgment of interest other words, they claimed that interest can- against three sureties in excess of the penal not be charged against them until the ac- sum of their conservatorship bonds. The counts of the wards are settled and the as- court went a step further and held that the sets delivered to the wards, or until such sureties were liable for interest dating back time as the conservators are discharged to the date of the conversion of the wards’ from their duties. assets, not just from the date that the sure- The successor conservators argued that ties received notice of the loss or demand it was beyond question that a principal who under the conservator’s bond. converts funds is liable from the date of the Six cases were consolidated, all of conversion. The court agreed, noting that which revolved around claims by successor Kansas law acknowledged that a surety’s conservators against former conservators liability is dependent on the liability of its who were unable to account for all of the principal. The court also stated that the assets of their respective wards. Successor case law relied up was consistent with the conservators filed suit against both the current state of law allowing a surety to principals and sureties—St. Paul, USF&G, step into the shoes of the conservator in and Old Republic—as a result of the prin- order to fulfill the conservator’s duties cipals’ theft of funds belonging to the should the conservator fail to do so. The wards. Judgments were rendered in each court also recognized that in conversion ac- case against the principals and the sureties tions, the general rule is that interest is re- in the amount of each wards’ loss, plus in- coverable from the date of the conversion. terest from the dates of the conversions. All the judgments, except one, exceeded There is special relationship between the amount of the penal sums of the bonds principal debtor and surety. when interest and the fees of the successor In Good v. Holstein,26 the Superior Court conservators were included in the judg- of Pennsylvania held that a surety who ment amount. The sureties raised two defenses. First, 25. 41 P.2d 814 (Kan. 2002). they argued that Kansas state law limits 26. 787 A.2d 426 (Pa.Super. 2001). Page 162 DEFENSE COUNSEL JOURNAL—January 2003 held a first mortgage was satisfied when a confession of judgment action against the property was attributed its fair market sureties of the first mortgage, after the sec- value sufficient to cover the entire amount ond mortgage was foreclosed and the prop- of a surety agreement. Reversing the trial erty was sold at sheriff’s sale. The sureties court, the court concluded that the law has filed an action in assumpsit, seeking pay- recognized a special relationship between ment on the surety agreement. The trial the principal debtor and his surety based on court entered judgment on finding that the reciprocal duties and mutual confidence. sureties were personally liable to the owner The core of this special relationship is the corporation for the amount in default. surety’s obligation to repay the debt of the On the appeal, the Superior Court held principal debtor if the latter defaults due to that the corporation was the alter ego of inability to repay the creditor. Conversely, sole owner for purposes of the sale of the a creditor has a duty to a surety to dis- property on which the corporation held the charge liens on the mortgaged property in second mortgage, and also that a surety order of seniority. who held a first mortgage was satisfied In this case, the holder of a first mort- when property was attributed its fair mar- gage, who was also the owner of a corpora- ket value. tion that held the second mortgage, filed a By Carol McHugh Sanders

CARMAKERS’ DAMAGES duct, the trial court also reduced the compensatory award to $4.935 million. Juror declarations filed at the post-trial $290 Million Punitive stage revealed that one juror, during delib- Award Against Ford Stands erations on the malice aspects of the case, Voting 4-3 and, according to a story in commented that she had watched a televi- The Recorder [San Francisco], causing cor- sion news program reporting on fires that porations nationwide to issue a “collective occurred in older Ford Mustangs. She re- gasp,” the California Supreme Court de- counted to the jury that the former Ford clined to review or depublish a California chairman had said that the company would Court of Appeal decision that imposed a rather contest or settle the fire-related law- $290 million punitive award against Ford suits than recall and fix all the vehicles. Motor Co. in a products liability case in The jury foreperson, who was a deputy dis- which three family members died in a trict attorney, told the juror that the news rollover crash. 2002 Cal. Lexis 7254. The program was not evidence in their case and court’s order lets stand the intermediate ap- should not be discussed further, according pellate court’s decision and lengthy opin- to the juror declarations. ion in Romo v. Ford Motor Co., 122 Another juror, Ford alleged, engaged in Cal.Rptr.2d 139 (Cal.App. 2002), which misconduct by recounting during delibera- reversed the trial court’s order allowing a tions a dream she from the night before in new trial on punitive damages based on ju- which a Ford Bronco rolled over, killing ror misconduct. her own children and many others while The case arose from an accident a de- Ford representatives stood by questioning cade ago involving a 1978 Ford Bronco. the proof of the event. Her discussion of Both Romo parents and one child were the dream occurred after the jury decided killed when the vehicle rolled over several compensatory damages and before the vote times. The suit alleged that the Bronco was on malice. Several other jurors stated that defectively designed because only the front this juror repeatedly said during delibera- one third of the roof had steel support, tions that the jury must “save the babies” while the remainder was made of fiber- by finding Ford liable. The jury voted 9-3 glass, which easily collapsed in the roll- on the issue of malice and the amount of over accident. punitive damages. After a four-month trial in 1999, a jury The Court of Appeal, in an opinion by awarded the three surviving Romo children Judge Vartabedian, found no juror miscon- $6.226 million in compensatory and $290 duct had occurred and reversed the trial million in punitive damages. Granting court’s order. Nothing in the trial record Ford’s post-trial motion for a new trial on indicated that the court should reject the punitive damages based on juror miscon- normal presumption that the jury followed Page 164 DEFENSE COUNSEL JOURNAL—January 2003 the court’s instructions, he stated, adding violated due process rights. Although no that the trial court, several days into the other California case approached the size jury deliberations and after widespread of this punitive award, the Court of Appeal news coverage about a large verdict against held it was not excessive. Using the guide- General Motors, admonished the jury to posts set by the U.S. Supreme Court in consider only the evidence presented at the BMW of North America Inc. v. Gore, 517 trial and to ignore any news accounts con- U.S. 560 (1996), the court condemned cerning their case or any other case. The Ford’s conduct as very reprehensible in presumption of prejudice from the one- putting thousands of lives at risk. In the time mention of the television news pro- court’s view, there was not a wide disparity gram was rebutted by the record, the court between the actual harm suffered by the stated. Romo family and the damages rendered, The court also treated the juror’s discus- and Ford should have been on notice that sion of her dream as within the realm of a punitive damages that amounted to 1.2 per- “permissible rhetorical device” used to ex- cent of the company’s net worth were a press her fears of similar accidents. The possibility in this trial. collective process that makes up a jury deliberations, the court explained, disabused Chrysler Fails to Reverse the two jurors of any “misconceptions” they may have had about their duty as ju- $3 Million Punitive Award rors to follow the law and consider only In another case involving a much evidence presented at the trial, which re- smaller punitive damages award, Chrysler buts any presumption of prejudice. lost out before the Sixth Circuit in its bid to Ford also argued, but to no avail, that the overturn a jury verdict. Clark v. Chrysler plaintiffs had not proved that it acted with Corp., 310 F.3d 461 (6th Cir. 2002). malice in designing and manufacturing the The jury award in this case also arose Bronco. The design and production of the from a fatal crash in which Charles Clark Bronco itself was the despicable conduct, was driving his Dodge Ram truck when he the court said. “[W]e think it obvious that was hit in October 1993 by a state police putting on the market a motor vehicle with car. It collided with the left front fender of a known propensity to roll over and, while Clark’s truck, causing the vehicles to rotate giving the vehicle the appearance of sturdi- and “side slap” after impact. Clark, who ness, consciously deciding not to provide was not wearing a seat belt, was ejected adequate crush protection to properly from the truck, thrown onto the grass me- belted passengers . . . constitutes despi- dian and died six hours later from the inju- cable conduct,” the court determined. ries. Neither the police officer nor Clark’s The court pointed out other evidence two passengers were seriously injured. that tipped the scales against Ford on the Clark’s wife alleged in her products li- “despicable scale,” including that the com- ability suit that Chrysler’s lock latch on the pany knew truck-based sport utility ve- Ram’s doors was defectively designed, as hicles roll over at a higher rate than passen- it did not hold the door shut during the ac- ger cars; the company’s safety engineers cident. The jury found Chrysler and Clark had concluded that no utility vehicle were each 50 percent at fault, so that the should be produced without a roll bar; and jury’s $471,258 compensatory award was Ford’s own testing, after the first genera- cut in half in the judgment for Clark, while tion of Broncos was on the road, showed its $3 million in punitive damages stood. that the roof failed to meet the company’s Affirming, the Sixth Circuit determined safety standards, and it began including in an opinion by Judge Oliver that both of steel reinforcement in all Broncos built af- Clark’s expert witnesses demonstrated that ter 1980. their scientific testimony was sufficiently As for the $290 million punitive award, reliable under standards set in Daubert v. Ford argued that it was so excessive that it Merrell Dow Pharmaceuticals Inc., 509 Current Decisions Page 165

U.S. 579 (1993). Clark’s lock latch expert son said he was on board with the major- testified that the 1992 Dodge Ram did not ity’s opinion on the defective design issues have a state-of-the-art or state-of-the- but could not go along with the majority on industry lock latch. He referred to several the punitive damages issue. In his book, other lock latch examples in the industry the issue of punitive damages should not that were state-of-the-art at the time that have been submitted to the jury because Clark’s pickup truck was manufactured. Clark did not produce clear and convincing His opinion that the lock latch was defec- evidence that Chrysler was guilty of wan- tive and unreasonably dangerous, the court ton or reckless disregard for the lives and determined, was based on a sufficiently re- safety of its customers. liable foundation, including his technical To Judge Nelson’s thinking, the record knowledge of automobile door latch sys- supported only a finding of “garden- tems, his extensive testing of door latch variety negligence” on Chrysler’s part. If bypass failure, his familiarity with the Clark had used the seat belt that Chrysler Chrysler K latch and his examination of provided, his life would have been spared, the latch in Clark’s truck, as well as other he wrote. “The hard truth, uncomfort- K latches identical to the one involved in able though it may be to say so, is that if Clark’s case. anyone was reckless in this situation, it was Likewise, Clark’s accident reconstruc- Mr. Clark himself, not Chrysler,” he con- tion expert also demonstrated sufficient re- cluded. liability under the Daubert standards. That expert testified that the structure to which CLASS ACTIONS the truck’s door attached when it closed, called a B-pillar, is the skeleton of the vehicle and typically would be reinforced. He District Court Off Track said that the Dodge Ram lock latch was 40 in Selecting Lead Plaintiff years out of date and that the B-pillar was A federal district court may get to pick defectively designed because it was a the lead plaintiff in a securities class ac- single piece of sheet metal that had not tion, but not that plaintiff’s counsel, ac- been shaped and welded into a square box cording to a first impression decision from to provide structure, as was typical in the the Ninth Circuit that reversed the lower industry. This testimony had sufficient reli- court’s choice of lead plaintiff. The peti- ability, the court concluded, because the tion for a writ of mandamus drew an am- expert had an extensive background in au- icus curiae brief from the Securities and tomobile safety testing and had examined Exchange Commission, supporting the Clark’s truck, the accident scene, the police party appointed lead plaintiff, and an am- report and the photographs. He also knew icus brief from two large institutional in- the state-of-the-art and state-of-the-indus- vestors—the California Public Employees try standards in B-pillars at the time Retirement System and Barclays Global Clark’s truck was built. Investors—supporting the district court’s Chrysler also failed to persuade the position. Sixth Circuit that a new trial was needed The class action before the Ninth Cir- based on testimony about four other sub- cuit, In re Cavanaugh, 306 F.3d 726 (9th stantially similar accidents and because the Cir. 2002), was one of more than 20 securi- lower court refused to use a jury instruc- ties fraud complaints filed in the U.S. Dis- tion on the presumption accorded to com- trict Court for the Northern District of pliance with federal motor vehicle stan- California based on a dramatic drop in late dards. Chrysler also struck out on its claim 2000 in the share price of a company in the that the punitive award must be considered telecommunications business, Copper so excessive that it offends due process Mountain Networks Inc., whose stock safeguards. price plunged in the fourth quarter of 2000 Concurring and dissenting, Judge Nel- from $125 to $10 per share after it an- Page 166 DEFENSE COUNSEL JOURNAL—January 2003 nounced that its revenues and earnings for for the class. that quarter had declined, contrary to ear- On the Cavanaugh group’s petition to lier projections. the Ninth Circuit for a writ of mandamus, The district court announced plans to the appeals court reversed and remanded. consolidate the numerous class actions and In an opinion by Judge Kozinski, it held to appoint a lead plaintiff, as allowed under that the district court went way beyond the the Private Securities Litigation Reform dictates of the PSLRA in selecting the lead Act of 1995 (PSLRA). Scheduling a case plaintiff. That court, Judge Kozinski wrote, management conference, the court inter- “quickly went off the statutory track” by viewed three parties who expressed an in- engaging in a “free-wheeling comparison” terest in becoming lead plaintiff: William of the parties competing for lead plaintiff. A. Chenoweth, an accountant who lost an The only relevant comparison under the estimated $295,000 on the stock’s decline; PSLRA’s statutory scheme evaluates plain- Quinn Barton, a self-employed investor tiffs’ financial interest in the outcome of who lost about $59,000; and five business- the litigation, he stated. men, led by David Cavanaugh, who each The most capable plaintiff under the lost between $462,000 and $943,000 for a PSLRA is presumptively the one with the collective loss of $3.327 million. greatest financial stake in the outcome of At the case management conference, the the case, so long as he meets the typicality district court queried all three candidates and adequacy requirements for a class rep- about how they chose their attorneys and resentative under Rule 23 of the Federal negotiate their fee agreements. The Cava- Rules of Civil Procedure, the Ninth Circuit naugh group already had retained Milberg, panel observed, and then other plaintiffs Weiss, Bershad, Hynes & Lerach, arguably may then try to rebut the presumptive lead the best-known plaintiffs’ securities litiga- plaintiff’s showing of typicality and ad- tion firm in the nation, under a fee agree- equacy under Rule 23. The Ninth Circuit ment that would pay it a percentage of the rejected the lower court’s view that a total recovery, a sum that would increase plaintiff’s adequacy under Rule 23 can be with the size of the recovery, topping out at measured in part by how good a fee deal he just over 30 percent. strikes with his attorneys. If the Rule 23 The second lead plaintiff candidate, adequacy determination turns on which Barton, had retained Beatie & Osborn, a plaintiff has the cheapest deal, the court small New York law firm, under a fee said that would pressure plaintiffs to pick a agreement that would pay between 10 to lawyer who offers the lowest fees, rather 15 percent of the recovery, with an $8 mil- than counsel who they believe will do the lion cap. The third candidate, Chenoweth, best job for the class. Besides, the court had not retained counsel. added, the district court gets a say later in The court found the Cavanaugh group the ball game on attorneys’ fees when it presumptively the most adequate plaintiff approves any class action settlement, under the PSLRA standard because it had which the appeals court noted is “virtually the largest financial stake in the contro- the universal case.” versy, but it concluded that Barton had re- The presumptive lead plaintiff’s choice butted that presumption by showing he had of counsel and fee arrangement may be rel- a more advantageous attorneys’ fee agree- evant, the court added, in ensuring that the ment. Referring to Milberg, Weiss, the plaintiff is not receiving preferential treat- court commented that the “well-recognized ment in some back-door financial arrange- brand name in securities litigation” could ment or has engaged a lawyer with a con- not rationally explain the significantly flict of interest. “But this is not a beauty larger fee compared to Barton’s counsel. contest; the district court has no authority Disqualifying Chenoweth from consider- to select for the class what it considers to ation because he had not selected counsel, be the best possible lawyer or the lawyer the court appointed Barton as lead plaintiff offering the best possible fee schedule,” Current Decisions Page 167 the court stated. “Indeed, the district court the company’s collection effort, the Sev- does not select class counsel at all.” enth Circuit held in Nielsen v. Dickerson, The Ninth Circuit also rejected amicus 307 F.3d 6223 (7th Cir. 2002). SEC’s contention that the PSLRA raised The court affirmed the trial court’s sum- the adequacy bar for lead plaintiffs to en- mary judgment in favor of a class of sure that the most sophisticated investor debtors who alleged that David D. Dicker- available garners that lead role. The statute son, a Virginia-licensed attorney, violated may have heightened the pleading require- the Fair Debt Collection Practices Act ments and otherwise strengthened the (FDCPA). Each class member had been a chances of an institutional investor serving GM credit card holder who had received a as lead plaintiff, the court stated, but it did letter on Dickerson’s law firm letterhead not up the ante on the Rule 23 adequacy between September 22, 1997, and July 15, requirements. It does not give district 1999, about his or her delinquent account. courts the sweeping authority to deny a The district court determined that Dicker- plaintiff the role of class representative be- son’s minimal involvement in preparing cause the court disagrees with his choice of the letters rendered them misleading in vio- counsel, the court held. lation of Section 1692e(3) of the FDCPA. Granting the writ of mandamus, the 1999 U.S.Dist. Lexis 13931. Ninth Circuit instructed the lower court to The letters, the district court ruled, vacate its order appointing Barton as lead falsely implied to the debtor that an plaintiff and to appoint the Cavanaugh attorney had become professionally in- group to that role if no other party rebuts volved in the collection, violating Section the presumption that the group is the most 1692e(10)’s ban on using any false repre- capable of adequately representing the sentation or deceptive means in collecting class. a debt. After the district court granted sum- Concurring in the judgment, Judge mary judgment on liability, the parties Wallace wrote separately to note that the reached a settlement that reserved the de- majority’s opinion neither determined its fendants’ right to appeal the liability rul- own jurisdiction for the extraordinary rem- ing. edy sought nor confined itself to the ques- Dickerson argued on appeal that he was tions posed. On the jurisdictional issue, he meaningfully involved in sending out the resolved that a “clear procedural error” had delinquency letters. Household Bank, occurred in the lower court that would war- which had issued the GM cards, sent rant a mandamus. He chided the majority, Dickerson a list of about 2,000 debtors however, for interjecting “ruminations on each month, for which he was paid $2.45 the quality of the firms selected by the proper account. He pointed out on appeal that spective lead plaintiffs in this case” and for he briefly reviewed the data printouts from otherwise putting forth “broad-ranging Household each month. His staff also dicta” on what should occur at the lower checked the firm’s database to see if the court on remand. account holder’s name showed up among recent bankruptcy court filings and to de- CLASS ACTIONS termine if the firm had already sent a letter to that person. The firm’s staff also checked the debtors’ addresses to be sure Lawyer Liable for Debt no one resided in one of three states that Collection Violations prohibited the type of letter Dickerson in- A Virginia lawyer who sent dunning let- tended to send. ters to Illinois residents to collect on delin- After the firm completed its three-part quent accounts for a large credit card com- review, the data was turned over to a bulk pany is liable under the federal debt mailing facility to send out on the firm’s collection laws because he did little more letterhead with a facsimile of Dickerson’s than lend his name and firm letterhead to signature. The letters advised the debtors to Page 168 DEFENSE COUNSEL JOURNAL—January 2003 contact Household about the delinquency was the true source of Dickerson’s letters, and make payments directly to GM card. If the court held that Household shared a debtor contacted Dickerson’s office by Dickerson’s liability as a debt collector un- mail, that letter was forwarded to House- der Section 1692a(6) for violating other hold. Telephone calls from debtors were sections. taken either by Dickerson himself, who The Seventh Circuit also saw little merit advised the caller to write a letter, or mes- in Household’s claim that it did not inten- sages were taken by his staff and then for- tionally violate the FDCPA because it had warded to Household for handling. Dicker- made a bona fide error in legal judgment. son never instituted legal action against Household’s bona-fide error defense was any GM debtors. doomed, the court said, because its actions In an opinion by Judge Rovner, the Sev- plainly contravened the court’s opinion in enth Circuit held that Dickerson’s letters Avila v. Rubin, 84 F.3d 222 (7th Cir. falsely suggested that an attorney had be- 1996), in which the court recognized that a come actively involved in GM’s debt col- delinquency letter from an attorney con- lection efforts. The work that Dickerson veys authority and implies that the attorney and his staff performed for GM in an “as- supervised or actually controlled the proce- sembly-line fashion” was nothing more dures behind the dunning letter. To avoid than ministerial, in the court’s view; the liability for misrepresentations with such a dunning letters basically were form letters letter, the attorney must have some profes- prepared and issued en masse. The undis- sional involvement with the debtor’s file. puted facts showed the court that Dicker- Since Avila was nearly a year old when son brought no professional legal judgment Household retained Dickerson, the credit to bear on the effort. company could not avail itself of the bona Household argued on appeal that it could fide error defense. not be liable as a “debt collector” under the FDCPA because it had not falsely used EMPLOYMENT LAW Dickerson’s name in its debt-collecting efforts. The court disagreed. It deemed Household, although the creditor, to be a Sidley, Austin Firm Must debt collector because it used Dickerson’s Turn Over More Information name and letterhead to give the false im- A Chicago-based law firm must comply pression to its debtors that an attorney was more fully with a subpoena in an Equal involved. Dickerson did not individually Employment Opportunity Commission assess the status or validity of the debts, (EEOC) investigation to determine whether relying on Household’s judgment on those 32 demoted partners in fact were employ- matters. If a debtor who received the past- ees under the Age Discrimination in Em- due letter contacted Dickerson’s firm, ployment Act (ADEA). The Seventh Cir- rather than GM directly, as instructed in cuit did not resolve whether the former the letter, the law firm was not authorized partners at Sidley & Austin were employ- to negotiate a payment plan, settle the debt ees, but only that there is enough doubt or take legal action against the debtor. about whether they are covered by the age The $2.45 per account flat-rate fee ar- discrimination laws to entitle the EEOC to rangement also indicated to Judge Rovner greater compliance with its subpoena. that little actual legal work was expected in Equal Employment Opportunity Commis- preparing the past-due letters. “The fixed sion v. Sidley, Austin, Brown & Wood, and quite modest nature of Dickerson’s re- 2002 U.S.App. Lexis 22152). muneration strongly suggests that House- A concurring judge noted that the U.S. hold was paying for the marquee value of Supreme Court has granted certiorari in a Dickerson’s name rather than his profes- case from the Ninth Circuit that may re- sional assistance in the collection of its solve some or all of the problems that gov- debts,” she wrote. Finding that Household ern the classification of Sidley’s members. Current Decisions Page 169

Wells v. Clackamas Gastroenterology As- appoints its own members, rather than sociates P.C., 271 F.3d 903 (9th Cir. standing for election before all 500 part- 2001), cert. granted, No. 01-1435, October ners in the firm. That committee makes all 1, 2002 (summary at 71 U.S. Law Week major decisions for the firm and delegates 3062). The Ninth Circuit held in Clack- to non-committee members some powers amas that any person classified as an em- to hire, fire, promote and determine com- ployee for purposes of state law necessarily pensation of subordinates. The executive is an employee for purposes of federal law. committee also sets partners’ income, The EEOC pursued information from based on each partner’s percentage of the the law firm now known as Sidley, Austin, firm’s over-all profits. Brown & Wood after the firm demoted the Perhaps the “most partneresque feature” 32 equity partners in 1999 to “counsel” or of the 32 demoted lawyers relationship “senior counsel” status. The commission with the firm was their personal liability subpoenaed documents relating to whether for the firm’s debts, Judge Posner noted. those partners were covered by ADEA, Yet, that exposure to liability should not be which protects employees, but not employ- decisive as to whether they are employers, ers, from age discrimination. The commis- he continued, because they had no power sion also sought information about whether over their own fate at the firm. The two Sidley may be forcing other partners to re- groups—partners under state law and em- tire at a set age, contrary to federal anti- ployers under the ADEA—may not coin- discrimination laws that abolished manda- cide, the court stated. tory retirement. Vacating the district court’s order, the On the commission’s motion to enforce Seventh Circuit said that once the firm its subpoena, the federal district court or- fully complies with the subpoena concern- dered the firm to comply fully. 2002 ing ADEA coverage, the lower court U.S.Dist. Lexis 2113. should then decide whether the 32 partners On appeal, Sidley maintained that it pro- are arguably covered by the ADEA. duced enough information to show that the Concurring in the judgment, Judge 32 lawyers were bona fide partners before Easterbrook said he would count the 32 their demotion and, as such, were employ- lawyers as “real partners” and conse- ers not covered by ADEA. The firm also quently not employees under the ADEA. asserted that the question of whether the 32 He found the suggestion that one can be a demoted partners are within the ADEA’s partner under normal agency principles and coverage is jurisdictional, which once an- still be an employee because of a “federal swered against the commission, requires it law override” incompatible with the U.S. to stop investigating. Supreme Court’s discussion of employees The Seventh Circuit, in an opinion by under the Employee Retirement Income Judge Posner, said the firm could “obtain Security Act in Nationwide Mutual Insur- no mileage” by characterizing the coverage ance Co. v. Darden, 503 U.S. 318 (1992). issue as jurisdictional. EEOC could pursue Darden, he noted, held that the circularity information as to whether the 32 demoted of ADEA’s definition of employee should partners were employees under the ADEA be fixed by incorporating into federal law because it is entitled to investigate suffi- the traditional state agency law criteria for ciently to determine whether it should pro- identifying master-servant relations. ceed to the enforcement stage, the court Illinois treats participation in profits as stated. the defining characteristic of a bona fide While Sidley may have shown that the partner, Judge Easterbrook noted, and that 32 lawyers were partners, it did not neces- would make the 32 demoted partners em- sarily mean that they were employers ex- ployers. “Anyway, it makes both linguistic empt from ADEA coverage, Judge Posner and economic sense to say that someone wrote. He noted that the firm is governed who is liable without limit for the debts of by a 36-member executive committee that an organization is an entrepreneur (a prin- Page 170 DEFENSE COUNSEL JOURNAL—January 2003 cipal) rather than an ‘employee’ (an State of New York and the Healthcare As- agent),” he wrote. sociation of New York State. The Court of Appeals concluded that INSURANCE COVERAGE one insurer is obligated to defend the hospital and its employees while the other two insurers are off the hook, based on specific Insurer Must Defend Hospital policy exclusions. The court, in an opinion Against Defamation Claim by Judge Smith, held that Healthcare Un- An insurer has to defend a New York- derwriters must defend under the personal based hospital and its staff in a defamation injury liability policy it had in place with action brought by a doctor who had risen to the hospital. That policy obligated Health- the “limited public figure” status with his care Underwriters to provide the hospital a very vigorous campaign supporting mid- defense for all personal injury damages wifery at the facility. The New York Court arising from various acts, including libel, of Appeals held in Town of Massena v. slander or other defamatory or disparaging Healthcare Underwriters Mutual Insur- material. The insurer argued that it did not ance Co., 2002 N.Y. Lexis 2729, that have to defend because the policy excluded Healthcare must defend Massena Memorial coverage for allegations of defamatory Hospital in an underlying federal lawsuit statements made within a business enter- the doctor filed alleging a host of wrongs, prise with knowledge of their falsity. including defamation. The federal district court in Franzon’s In the underlying action, Dr. Olof underlying action held that he was a lim- Franzon, who operated a women’s medical ited public figure who must prove reckless- and surgical health care office, filed a fed- ness as to the truth of the statements made, eral court complaint against the hospital, but not knowledge of their falsity. The its board of managers and various physi- state Court of Appeals held that even if the cians and hospital executives. He alleged allegedly defamatory statements concerned that the defendants conspired to deprive Franzon’s medical practice as a business him of his civil rights under the First and enterprise and were intentionally and mali- 14th Amendments by trying to “excommu- ciously made, there was no allegation that nicate him from, and ruin him, in the the statements were made with knowledge Massena medical community.” He also of their falsity. It added that since Franzon charged that the hospital and medical per- is a limited public figure, actual malice re- sonnel disparaged him in internal reviews quires only recklessness as to the truth of and to his patients, refused to renew his the statements and not knowledge of their hospital privileges and defamed him. falsity. Thus, defense coverage is proper In the action that reached the New York based on the policy terms, the state high Court of Appeals, the Town of Massena, court held. which owned the hospital, sought a decla- The insurer also argued that it had no ration that three insurers owed it a defense duty to indemnify because the allegations in the federal action. The trial court found of malice were equivalent to allegations that all three insurers owed a duty to de- of intentional wrongdoing. Because of fend. The Appellate Division reversed, Franzon’s status as a limited public figure, holding that coverage for the alleged he could recover on his defamation claim if wrongs were either specifically excluded he established that the hospital and its under the applicable policies’ provisions or staff’s allegedly defamatory statements were intentional and therefore excluded as were made with reckless disregard of their a matter of public policy. 724 N.Y.S.2d truth, the court stated, adding that such 107 (App.Div. 3d Dep’t 2001). The appeal defamatory statements would be covered to the state’s high court drew amicus curiae by Healthcare Underwriters’ policy and briefs from the Medical Society of the would not be precluded by public policy. Current Decisions Page 171

JURY INSTRUCTIONS negligence action. Wal-Mart, the court held, correctly argued that its rules and policies may exceed what is required by Instruction Based on Store’s ordinary care in a given situation, but that Safety Manual Improper fact should not be used as evidence to The Indiana Supreme Court reversed a create a separate or higher duty of care. $600,000 jury award because of an im- “We think this rule is salutary because it proper jury instruction incorporating a Wal- encourages following the best practices Mart employee manual that set a standard of without necessarily establishing them as a care higher than the ordinary care required legal norm,” the court stated. in the negligence suit at issue. Reversing the The second problem with the instruction, jury verdict, the court determined in Wal- the court held, was that it invited jurors to Mart Stores, Inc. v. Wright, 774 N.E.2d 891 apply Wal-Mart’s subjective view of ordi- (Ind. 2002), that the instruction set a subjec- nary care, rather than the objective stan- tive, rather than objective, standard of care dard set by external community demands. in the slip-and-fall case. The store’s belief that it should perform at Ruth Ann Wright sued Wal-Mart, alleg- a higher standard than objective reasonable ing she was injured when she fell on water care is not relevant to the jury’s determina- in the lawn and garden corral outside the tion, the court stated, concluding also that Wal-Mart store in Carmel, Indiana. Por- the improper jury instruction could not be tions of the store’s employee manual, de- deemed harmless error. tailing procedures on handling spills and other floor hazards, were admitted into evi- SOVEREIGN IMMUNITIES ACT dence at the jury trial. Wal-Mart hotly contested the applicability of the manual to the open-air lawn and garden corral. A Wal- Domain Name Game Mart employee, who was just arriving for Goes International work and witnessed Wright fall, testified An American-based Internet domain that she routinely swept or squeegeed wa- name registration company was not able to ter from the corral floor as needed. overcome sovereign immunity in its suit One jury instruction told jurors they against the Republic of South Africa in a could consider the violation of any of the dispute over the use of a uniform resource store’s own rules, along with all the other locator on the Internet. In Virtual Coun- evidence, in determining whether Wal- tries Inc. v. Republic of South Africa, 300 Mart was negligent. The instruction also F.3d 230 (2d Cir. 2002), the Second Circuit provided that the violation of these rules affirmed the U.S. District Court for the was a “proper item of evidence tending to Southern District of New York’s dismissal show the degree of care recognized by of the company’s claims based on a lack of Wal-Mart as ordinary care under the condi- subject matter jurisdiction under the For- tions specified in its rules, policies, prac- eign Sovereign Immunities Act of 1976 tices and procedures.” (FSIA). The jury returned a $600,000 verdict in Virtual Countries, a Seattle-based com- favor of Wright, which was reduced to pany that owns Internet domain names $420,000 based on her 30 percent com- for various countries, had been using parative fault. The Indiana Court of Ap- southafrica.com since October 1996 to peals affirmed. 754 N.E.2d 1013 (Ind.App. publish travel news, weather and tourist in- 2001). formation about the southern region of Af- The state supreme court, in an opinion rica. The Republic of South Africa owns by Justice Boehm, reversed, agreeing with southafrica.net. Wal-Mart’s argument that the jury instruc- Central to Virtual Countries’ lawsuit tion based on its store manual set a higher was a press release that the Republic of standard of care than ordinary care in the South Africa issued in October 2000 an- Page 172 DEFENSE COUNSEL JOURNAL—January 2003 nouncing that it could be the first country (S.D. N.Y. 2001). in the world to claim the right to use its Affirming, the Second Circuit held that own domain name in the generic top-level South Africa’s press release had no direct domain of “.com.” The release further effect in the United States that would make stated that it intended soon to file an own- the nation subject to jurisdiction in there ership claim to southafrica.com with the under the FSIA. In an opinion by Judge World Intellectual Property Organization, a Sack, the court concluded that any impact United Nations agency that deals with in- from South Africa’s press release on Vir- tellectual property protection. The press re- tual Countries fell at the end of a long lease stated that sovereign countries have chain of causation, mediated by third par- the first right to own their own domain ties’ numerous actions. The news media’s names as national assets to help promote extensive coverage of South Africa’s an- trade and tourism. South Africa also an- nouncements and then investors’ and nounced its intention to take up the issue potential partners’ negative response to before an international tribunal that super- Virtual Countries intervened in any con- vises a non-binding arbitral system for re- necting chain between the press release and solving domain name disputes. the company’s financial difficulties. Vir- One week later, Virtual Countries filed tual Countries’ “expansive theory” that an suit in a U.S. federal court, asserting that American-based company’s financial loss the Republic of South Africa could not use constitutes a direct effect in the United southafrica.com and seeking to enjoin any States was “plainly flawed,” the appeals arbitration or court proceeding in any fo- panel held. rum worldwide that challenged its right to that name. Moving to dismiss the action, TOBACCO TIMES South Africa maintained that it was immune from suit in the United States because it was engaged in international diplo- Nationwide Class Action macy concerning the use of sovereign Certified for Smokers nations’ domain names when it issued its In a ruling that could have major ramifi- press release. cations for the tobacco industry, a U.S. dis- Virtual Countries argued that the immu- trict court judge in the Eastern District of nity veil did not protect South Africa be- New York on September 19, 2002, certi- cause its acts outside the United States fied a nationwide class of plaintiffs to caused a direct effect in this country, a spe- pursue strictly punitive damages against cific exception to immunity under Section tobacco companies. In re Simon II Litiga- 1605(a)(2) of the FSIA. The president of tion, 212 F.Supp.2d 57 (E.D. N.Y. 2002), Virtual Countries filed a declaration stating confirmed and expanded as amended, that South Africa’s press release had a U.S.Dist. Lexis 19773, reconsideration “devastating” effect on his company’s denied, 2002 U.S.Dist. Lexis 22920. operations because it placed a cloud over Judge Jack Weinstein certified the class its ownership of many domain names. As as a way to avoid a bunch of trials across examples of the fallout it had suffered, the country resulting in unrelated punitive the company noted that it had to sell damage judgments in what he described as switzerland.com and had lost a potential “massive and complex litigation.” The strategic alliance with a South African firm class certified includes all smokers in the that feared reprisals from its country’s gov- United States who have been diagnosed ernment. since April 9, 1993, with any of more than The federal district court in the Southern a dozen specified smoking-related ill- District of New York concluded that dis- nesses. Diseases covered by the order in- missal was appropriate because no excep- clude lung cancer, mouth cancer, chronic tion in the FSIA destroyed South Africa’s obstructive pulmonary disease and emphy- sovereign immunity. 148 F.Supp.2d 256 sema. Current Decisions Page 173

The class also includes smokers who re- bacco Co., No. 94-08273-CA-22, in the sided in the United States at the time of Circuit Court of the 11th Judicial Circuit, their deaths and smoked cigarettes pro- Dade County, Florida. duced by any of the five major tobacco The order also excludes as class mem- company defendants. The non-opt out class bers anyone who should have reasonably would exclude persons who already have realized that they had the a smoking-re- obtained settlements or judgments against lated disease prior to April 9, 1993, and any defendant tobacco company. It also ex- anyone whose diagnosis of one of the cludes anyone who is a member of the cer- specified diseases predates their use of to- tified class in Engle v. R.J. Reynolds To- bacco. Complied by Elizabeth M. Youngdale Tarlton Law Library University of Texas at Austin

This is a selective bibliography of cur- Settlement of Patent Infringement Law- rent law review literature of interest to suits: Antitrust Rules and Economic Impli- defense counsel. Main articles are identi- cations, 54 FLA. L. REV. 747 (2002). fied by naming the author or authors. Florida Law Review, University of Florida The designations “Note,” “Comment,” Fredric G. Levin College of Law, 115 Hol- etc. are as listed in the publication, with land Hall, Box 117637, Gainesville, FL the authorship, if given, shown in paren- 32611-7637. theses. Symposiums are generally shown by title. Suan Perng Pan, Patent Damage Assess- ments after Rite-Hite and Grain Process- U.S. and International ing, 42 IDEA 481 (2002). IDEA, Franklin Pierce Law Center, Two White St., Con- Damages cord, NH 03301.

Jennifer K. Robbennolt, Determining Jennifer K. Robbennolt, Punitive Dam- Punitive Damages: Empirical Insights and age Decision Making: The Decisions of Implications for Reform, 50 BUFF. L. REV. Citizens and Trial Court Judges, 26 LAW & 103 (2002). Buffalo Law Review, State HUM. BEHAV. 315 (2002). Law & Human University of New York at Buffalo Law Behavior, Box G-1126, Baruch College, 17 School, 605 John Lord O’Brian Hall, Buf- Lexington Ave., New York, NY 10010. falo, NY 14260. Lisa Litwiller, Re-examining Gasperini: Carrie L. Williamson, “But You Said Damages Assessments and Standards of We Could Do It!” Oil Companies’ Liabil- Review, 28 OHIO N.U. L. REV. 381 (2002). ity for the Unintended Consequence of Ohio Northern University Law Review, MTBE Water Contamination, 29 ECOLOGY Claude W. Pettit College of Law, 525 L.Q. 315 (2002). Ecology Law Quarterly, South Main St., Ada, OH 45810. 493 Simon Hall, University of California Boalt Hall, Berkeley, Berkeley, CA 94720. Margaret Bull Kovera & Stacie A. Cass, Compelled Mental Health Examinations, Note (Adam W. Johnson), Injunctive Liability Decisions, and Damage Awards Relief in the Internet Age: The Battle Be- in Sexual Harassment Cases: Issues for tween Free Speech and Trade Secrets, 54 Jury Research, 8 PSYCHOL. PUB. POL’Y & L. FED. COMM. L.J. 517 (2002). Federal Com- 96 (2002). Psychology, Public Policy & munications Law Journal, Indiana Univer- Law, American Psychological Association, sity School of Law—Bloomington, 211 S. 750 First St. N.E., Room 3082, Washing- Indiana Ave., Bloomington, IN 47405. ton, DC 20002-4242.

Daniel A. Crane, Exit Payments in Joel Stroud, Space Law Provides In- Reviewing the Law Reviews Page 175 sights on How the Existing Liability Damages, 54 STAN. L. REV. 1239 (2002). Framework Responds to Damages Caused Stanford Law Review, Crown Quadrangle, by Artificial Outer Space Objects, 37 REAL Stanford, CA 94305-8610. PROP. PROB. & TR. J. 363 (2002). Real Property, Probate and Trust Journal, Uni- Mark A. Klugheit, “Where the Rubber versity of South Carolina School of Law, Meets the Road”: Theoretical Justifications Main and Greene Streets, Room 301, Co- vs. Practical Outcomes in Punitive Dam- lumbia, SC 29208. ages Litigation, 52 SYRACUSE L. REV. 803 (2002). Syracuse Law Review, Syracuse Comment (John U. Bauco), Acquista v. University College of Law, Syracuse, NY New York Life Ins. Co.: Consequential 13244-1030. Damages, Emotional Distress, and Protect- ing the Insured and the Insurer, 76 ST. John R. Williams, Punitive Damages in JOHN’S L. REV. 201 (2002). St. John’s Law Section 1983 Actions, 17 TOURO L. REV. Review, St. John’s University School of 575 (2001). Law, 8000 Utopia Pkwy, Jamaica, NY Leon D. Lazer, The Latest Word from 11439. the Supreme Court on Punitive Damages, 18 TOURO L. REV. 107 (2001). Touro Law Danielle Conway-Jones, Remedying Review, Jacob D. Fuchsberg Law Center, Trademark Infringement: The Role of Bad Room 201, 300 Nassau Road, Huntington, Faith in Awarding an Accounting of De- NY 11743. fendant’s Profits, 42 SANTA CLARA L. REV. 863 (2002). Santa Clara Law Review, John Alan Cohan, Environmental Rights Santa Clara University, Santa Clara, CA of Indigenous Peoples under the Alien Tort 95053. Claims Act, the Public Trust Doctrine and Corporate Ethics, and Environmental Dis- Douglas G. Smith, Application of Patent pute Resolution, 20 UCLA J. ENVTL. L. & Law Damages Analysis to Trade Secret POL’Y 133 (2002). UCLA Journal of Envi- Misappropriation Claims: Apportionment, ronmental Law & Policy, UCLA School of Alternatives, and Other Common Limita- Law, Box 951476, 405 Hilgard Ave., Los tions on Damages, 25 SEATTLE U. L. REV. Angeles, CA 90095-1476. 821 (2002). Seattle University Law Re- view, 900 Broadway, Seattle, WA 98122. Lisa Litwiller, Has the Supreme Court Sounded the Death Knell for Jury Assessed M. Stuart Madden, Renegade Conduct Punitive Damages? A Critical Re-Exami- and Punitive Damages in Tort, 53 S.C. L. nation of the American Jury, 36 U.S.F. L. REV. 1175 (2002). South Carolina Law Re- REV. 411 (2002). University of San Fran- view, University of South Carolina School cisco Law Review, 2130 Fulton Street, San of Law, Columbia, SC 29208. Francisco, CA 94117.

Noel Wise, Personal Liability Promotes Evidence Responsible Conduct: Extending the Re- sponsible Corporate Officer Doctrine to J. Alexander Tanford, The Ethics of Federal Civil Environmental Enforcement Evidence, 25 AM. J. TRIAL ADVOC. 487 Cases, 21 STAN. ENVTL. L.J. 283 (2002). (2002). Stanford Environmental Law Journal, Steven G. Drexler, A Guide for Sub- Stanford Law School, 559 Nathan Abbott mitting Questioned Documents and Hand- Way, Stanford, CA 94305. writing Evidence, 26 AM. J. TRIAL ADVOC. 65 (2002). American Journal of Trial Ad- Comment (Theodore Eisenberg et al.), vocacy, Cumberland School of Law of Reconciling Experimental Incoherence Samford University, 800 Lakeshore Drive, with Real-World Coherence in Punitive ROBH 307, Birmingham, AL 35229. Page 176 DEFENSE COUNSEL JOURNAL—January 2003

Mitchell L. Lathrop, The Changing Face Identification, 7 SUFFOLK J. TRIAL & APP. of Expert Evidence, 52 FDCC Q. 409 ADVOC. 1 (2002). Suffolk Journal of Trial (2002). and Appellate Advocacy, Suffolk Univer- Frank H. Gassler, Dealing with Discov- sity Law School, 120 Tremont St., Boston, ery in the Too Much Information Age, 52 MA 02108. FDCC Q. 513 (2002). FDCC Quarterly, Marquette University Law School, Box Insurance 1881, Milwaukee, WI 53201-1881. Jennifer Kulynych & David Korn, Use Artemio Rivera, Testing the Admissibil- and Disclosure of Health Information in ity of Trademark Surveys after Daubert, 84 Genetic Research: Weighing the Impact of J. PAT & TRADEMARK OFF. SOC’Y 661 the New Federal Medical Privacy Rule, 28 (2002). Journal of the Patent and Trade- AM. J. L. & MED. 309 (2002). American mark Office Society, Box 2600, Arlington, Journal of Law and Medicine, American VA 22202. Society of Law, Medicine & Ethics, 765 Commonwealth Ave., Suite 1634, Boston, Leonard Birdsong, The Exclusion of MA 02215. Hearsay Through Forfeiture by Wrong- doing—Old Wine in a New Bottle— Bradley C. Nahrstadt & Christina D. Solving the Mystery of the Codification Ketcham, A Primer on Defending Breast of the Concept into Federal Rule Cancer Litigation, 25 AM. J. TRIAL ADVOC. 804(b)(6), 80 NEB. L. REV. 891 (2001). 451 (2002). American Journal of Trial Ad- Nebraska Law Review, University of vocacy, Cumberland School of Law of Nebraska—Lincoln College of Law, Lin- Samford University, 800 Lakeshore Drive, coln, NE 68583-0902. ROBH 307, Birmingham, AL 35229.

Symposium, Translating Science into Yu-Ping Liao & Michelle J. White, No- Law: Lessons from Doctors, Judges and Fault for Motor Vehicles: An Economic Lawyers about the Use of Medical Evi- Analysis, 4 AM. L. & ECON. REV. 258 dence in the Courtroom, 36 NEW ENG. L. (2002). American Law and Economics Re- REV. (2002). New England Law Review, view, Box 208245, 127 Wall St., New Ha- 154 Stuart St., Boston, MA 02116. ven, CT 06520.

Joseph Sanders et al., Legal Perceptions Robert W. Woody, Health Information of Science and Expert Knowledge, 8 Privacy: The Rules Get Tougher, 8 CONN. PSYCHOL. PUB. POL’Y & L. 139 (2002). INS. L.J. 211 (2001). Connecticut Insurance Lloyd Dixon and Brian Gill, Changes in Law Journal, University of Connecticut the Standards for Admitting Expert Evi- School of Law, 65 Elizabeth St., Hartford, dence in Federal Civil Cases since the CT 06105. Daubert Decision, 8 PSYCHOL. PUB. POL’Y & L. 251 (2002). Benjamin J. Richardson, Mandating En- Carol Krafka et al., Judge and Attorney vironmental Liability Insurance, 12 DUKE Experiences, Practices and Concerns Re- ENVTL. L. & POL’Y F. 293 (2002). Duke garding Expert Testimony in Federal Civil Environmental Law & Policy Forum, Duke Trials, 8 PSYCHOL. PUB. POL’Y & L. 309 University School of Law, Durham, NC (2002). Psychology, Public Policy & Law, 27708. American Psychological Association, 750 First St. N.E., Room 3082, Washington, Stephen J. Henning & Daniel A. Ber- DC 20002-4242. man, Mold Contamination: Liability and Coverage Issues: Essential Information Jeremy C. Bucci, Revisiting Expert Tes- You Need to Know for Successfully Han- timony on the Reliability of Eyewitness dling and Resolving Any Claim Involving Reviewing the Law Reviews Page 177

Toxic Mold, 8 HASTINGS W.-NW. J. ENVTL. Procedure L. & POL’Y 73 (2001). Hastings West- Northwest Journal of Environmental Law William B. Rubenstein, The Concept of & Policy, U.C. Hastings College of the Equality in Civil Procedure, 23 CARDOZO L. Law, 200 McAllister St., San Francisco, REV. 1865 (2002). Cardozo Law Review, CA 94102. 55 Fifth Avenue, New York, NY 10003- 4391. Tod I. Zuckerman, Intellectual Property Insurance Coverage Disputes: A Primer Kevin M. Clermont & Theodore Eisen- and a State-by-state Survey of Cases, 29 berg, Litigation Realities, 88 CORNELL L. LINCOLN L. REV. 1 (2001). Lincoln Law REV. 119 (2002). Cornell Law Review, Review, One North First St., San Jose, CA Cornell Law School, Myron Taylor Hall, 95113. Ithaca, NY 14853-4901.

Note (W. Devin Resides), Holding Geoffrey Parmer, What “Erin Brocko- HMOs Liable in the New Millennium: vich” Failed to Tell You about the Reali- New Theories with an Old Twist, 27 OKLA. ties of Class Action Litigation, DISP. RESOL. CITY U. L. REV. 419 (2002). Oklahoma J., May-July 2002, at 19 (2002). Dispute City University School of Law Law Re- Resolution Journal, American Arbitration view, 2501 N. Blackwelder, Oklahoma Association, 335 Madison Ave., New City, OK 73106. York, N.Y. 10017-4605.

Comment (D. Chris Harkins), The Writ- Robert M. Brava-Partain, Due Process, ing Is on the Wall . . . and Inside It: The Rule 23 and Hybrid Classes: A Practical Recent Explosion of Toxic Mold Litigation Solution, 53 HASTINGS L.J. 1359 (2002). and the Insurance Industry Response, 33 Hastings Law Journal, 200 McAllister St., TEX. TECH L. REV. 1101 (2002). Texas San Francisco, CA 94102. Tech School of Law Law Review, 1802 Hartford, Lubbock, TX 79409. Edward H. Cooper, Simplified Rules of Federal Procedure? 100 MICH. L. REV. J. Stephen Zielezienski & Catherine I. 1794 (2002). Michigan Law Review, Paolino, Insurance Privacy after Gramm- Hutchins Hall, 625 S. State St., Ann Arbor, Leach-Bliley—Old Concerns, New Protec- MI 48109-1215. tions, Future Challenges, 37 TORT & INS. L.J. 1139 (2002). Tort and Insurance Law Jack B. Weinstein, A Survey of Changes Journal, American Bar Association, Box in United States Litigation, 76 ST. JOHN’S 10892, Chicago, IL 60610-0892. L. REV. 379 (2002). St. John’s Law Re- view, St. John’s University School of Law, Louis J. Papa & Anthony Basile, No- 8000 Utopia Parkway, Jamaica, NY 11439. Fault Insurance Fraud: An Overview, 17 TOURO L. REV. 611 (2001). Touro Law Re- Note (Mary C. Cavanagh), Interpreting view, Jacob D. Fuchsberg Law Center, Rule 60(B)(6) of the Federal Rules of Civil Room 201, 300 Nassau Road, Huntington, Procedure: Limitations on Relief from NY 11743. Judgments for “Any Other Reason,” 7 SUF- FOLK J. TRIAL & APP. ADVOC. 127 (2002). Jeffrey Thomas, Insurance Implications Suffolk Journal of Trial and Appellate Ad- of September 11 and Possible Responses, vocacy, Suffolk University Law School, 34 URB. LAW. 727 (2002). Urban Lawyer, 120 Tremont St., Boston, MA 02108. University of Missouri—Kansas City, 5100 Rockhill Road, Kansas City, MO Richard H. Dreyfuss, Class Action Judg- 64110-2499. ment Enforcement in Italy: Procedural “Due Process” Requirements, 10 TULANE J. Page 178 DEFENSE COUNSEL JOURNAL—January 2003

INT’L & COMP. L. 5 (2002). Tulane Journal The Rhetoric of Strict Products Liability of International and Comparative Law, Versus Negligence: An Empirical Analy- Tulane University Law School, 6329 Freret sis, 77 N.Y.U. L. REV. 874 (2002). New St., New Orleans, LA 70118-2631. York University Law Review, 110 W. Third St., New York, NY 10012. Laurens Walker, A Model Plan to Re- solve Federal Class Action Cases by Jury Note (Katrina R. Atkins), Defining the Trial, 88 VA. L. REV. 405 (2002). Virginia Duty of Gun Manufacturers in Hamilton v. Law Review, 580 Massie Road, Char- Beretta U.S.A., 29 N. KY. L. REV. 849 lottesville, VA 22903-1789. (2002). Northern Kentucky Law Review, Northern Kentucky University, Salmon P. Products Liability Chase College of Law, Nunn Hall Room 319, Highland Heights, KY 41099. David W. Prince & Paul H. Rubin, The Effects of Product Liability Litigation on David A. Fischer, Product Liability: A the Value of Firms, 4 AM. L. & ECON. REV. Commentary on the Liability of Suppliers 44 (2002). American Law and Economics of Component Parts and Raw Materials, 53 Review, Box 208245, 127 Wall St., New S.C. L. REV. 1137 (2002). South Carolina Haven, CT 06520. Law Review, University of South Carolina School of Law, Columbia, SC 29208. James A. Henderson Jr., Echoes of En- terprise Liability in Product Design and Note (Gary Zhao), Chinese Product Li- Marketing Litigation, 87 CORNELL L. REV. ability Law: Can China Build Another 958 (2002). Cornell Law Review, Cornell Great Wall to Protect Its Consumers? 1 Law School, Myron Taylor Hall, Ithaca, WASH. U. GLOBAL STUD. L. REV. 581 NY 14853-4901. (2002). Washington University Global Studies Law Review, Washington Univer- Andrew E. Falsetti, Fluoxetine-induced sity School of Law, Campus Box 1120, Suicidal Ideation: An Examination of the One Brookings Drive, St. Louis, MO Medical Literature, Case Law and the Le- 63130-4899. gal Liability of Drug Manufacturers, 57 FOOD & DRUG L.J. 273 (2002). Food and Professional Responsibility Drug Law Journal, Food and Drug Law In- stitute, 1000 Vermont Ave. N.W., Suite Steven Shavell, Law Versus Morality as 200, Washington, DC 20005. Regulators of Conduct, 4 AM. L. & ECON. REV. 227 (2002). American Law and Eco- Note (Mark D. Shifton), The Restate- nomics Review, Box 208245, 127 Wall St., ment (Third) of Torts: Products Liability— New Haven, CT 06520. The ALI’s Cure for Prescription Drug De- sign Liability, 29 FORDHAM URB. L.J. 2343 Laurel S. Terry, MDPs, “Spinning” and (2002). Fordham Urban Law Journal, 140 Wouters v. NOVA, 52 CASE W. RES. L. W. 62d Street, New York, NY 10023. REV. 867 (2002). Case Western Reserve Law Review, CWRU School of Law, Casenote (Sheila J. Baran), “Good 11075 E. Boulevard, Cleveland, OH Cause” Wins the Battle, But Will Protec- 44106. tive Orders Survive the Product Liability War? 53 MERCER L. REV. 1675 (2002). William H. Simon, The Belated Decline Mercer Law Review, Walter F. George of Literalism in Professional Responsibility School of Law, Mercer University, Macon, Doctrine: Soft Deception and the Rule of GA 31207. Law, 70 FORDHAM L. REV. 1881 (2002). Fordham Law Review, 140 W. 62d St., Richard L. Cupp Jr. & Danielle Polage, New York, NY 10023. Reviewing the Law Reviews Page 179

Margaret Colgate Love, The Revised fying a Law Firm’s Ethical Infrastructure: ABA Model Rules of Professional Con- Avoiding Legal Malpractice Claims based duct: Summary of the Work of Ethics on Conflicts of Interest, 33 ST. MARY’S L.J. 2000, 15 GEO. J. LEGAL ETHICS 441 (2002). 669 (2002). St. Mary’s Law Journal, One Valerie Breslin & Jeff Dooley, Whistle Camino Santa Maria, San Antonio, TX Blowing v. Confidentiality, 15 GEO. J. LE- 78228-8604. GAL ETHICS 719 (2002). Georgetown Jour- nal of Legal Ethics, Georgetown Univer- Barry R. Temkin, Can Negligent Refer- sity Law Center, 600 New Jersey Ave. ral to Another Attorney Constitute Legal N.W., Washington, DC 20001. Malpractice? 17 TOURO L. REV. 639 (2001). Touro Law Review, Jacob D. Fuchsberg Fred C. Zacharias, What Lawyers Do Law Center, Room 201, 300 Nassau Road, When Nobody’s Watching: Legal Adver- Huntington, NY 11743. tising as a Case Study of the Impact of Underenforced Professional Rules, 87 Sarah Stephens McNeal, Lawyers Doing IOWA L. REV. 971 (2002). Iowa Law Re- Business with Their Clients: Identifying view, University of Iowa College of Law, and Avoiding Legal and Ethical Dangers: Boyd Law Building, Melrose and Bying- A Report of the Task Force on the Inde- ton, Iowa City, IA 52242-1113. pendent Lawyer, 3 TRANSACTIONS: TENN. J. BUS. L. 47 (2002). Transactions: Tennessee Virginia H. Underwood & Richard H. Journal of Business Law, University of Underwood, The Attorney-client and Work Tennessee College of Law, 1505 W. Product Privileges: The Case for Protecting Cumberland Ave., Knoxville, TN 37996- Internal Investigations on the University 1810. Campus, 90 KY. L.J. 531 (2002). Kentucky Law Journal, University of Kentucky Col- Sean J. Griffith, Ethical Rules and Col- lege of Law, Lexington, KY 40506-0048. lective Action: An Economic Analysis of Legal Ethics, 63 U. PITT. L. REV. 347 Casenote (Matthew G. Steinhilber), Ex- (2002). University of Pittsburgh Law Re- cessive Focus on Mitigating Factors in At- view, 3900 Forbes Ave., Pittsburgh, PA torney Misconduct Case Fails to Preserve 15260. Public Confidence in the Legal Profession, 61 MD. L. REV. 482 (2002). Maryland Law Sanford M. Stein & Jan M. Geht, Legal Review, 515 W. Lombard St., Baltimore, Ethics for Environmental Lawyers: Real MD 21201. Problems, New Challenges and Old Val- ues, 26 WM. & MARY ENVTL. L. & POL’Y Tony Honore, The Necessary Connec- REV. 729 (2002). William and Mary Envi- tion Between Law and Morality, 22 OX- ronmental Law and Policy Review, Col- FORD J. LEGAL STUD. 489 (2002). Oxford lege of William and Mary, Box 8795, Journal of Legal Studies, Journals Depart- Williamsburg, VA 23187. ment, Oxford University Press, Great Clarendon St., Oxford OX2 6DP, U.K. Torts

Peter Eggenberger, License to Bill = Li- Eric Helland & Alexander Tabarrok, cense to Kill? Ethical Considerations on The Effect of Electoral Institutions on Tort Lawyers’ Fees (with a View to Switzer- Awards, 4 AM. L. & ECON. REV. 341 land), 20 PENN ST. INT’L L. REV. 505 (2002). American Law and Economics Re- (2002). Penn State International Law Re- view, Box 208245, 127 Wall St., New Ha- view, Pennsylvania State University, 150 ven, CT 06520. S. College St., Carlisle, PA 17013. Michael L. Rustad & Thomas H. Koe- Susan Saab Fortney & Jett Hanna, Forti- nig, Taming the Tort Monster: The Ameri- Page 180 DEFENSE COUNSEL JOURNAL—January 2003 can Civil Justice System as a Battleground view, 42 SANTA CLARA L. REV. 1291 of Social Theory, 68 BROOKLYN L. REV. 1 (2002). Santa Clara Law Review, Santa (2002). Brooklyn Law Review, Brooklyn Clara University, Santa Clara, CA 95053. Law School, 250 Joralemon St., Brooklyn, NY 11201. Florida

Note (Ryan M. Springer), On Causation Leonard Birdsong, The Residual Ex- and Comparison: Medical Malpractice and ception to the Hearsay Rule—Has It other Professional Negligence after Steiner Been Abused—A Survey Since the 1997 Corp. v. Johnson & Higgins, 16 BYU J. Amendment, 26 NOVA L. REV. 59 (2001). PUB. L. 355 (2002). BYU Journal of Public Nova Law Review, Nova Southeastern Law, J. Reuben Clark Law School, 460 University, 3305 College Ave., Fort Lau- JRCB, Brigham Young University, Provo, derdale, FL 33314. UT 84602-8000. Illinois Patrick J. Kelley & Laurel A. Wendt, What Judges Tell Juries about Negligence: Casenote (Byron Christopher Williams), A Review of Pattern Jury Instructions, 77 The Content of His Character: Hale v. CHI.-KENT L. REV. 587 (2002). Chicago- Comm. on Character and Fitness of the Illi- Kent Law Review, Chicago-Kent College nois Bar, 4 T.M. COOLEY J. PRAC. & CLINI- of Law, 565 W. Adams St., Chicago, IL CAL L. 269 (2001). Thomas M. Cooley 60661-3691. Journal of Practical and Clinical Law, Tho- mas M. Cooley Law School, 217 S. Capitol Michael D. Mirne, The Brawl at Wrig- Ave., Lansing, MI 48933. ley: An Analysis of Tort Liability, 9 SPORTS LAW. J. 95 (2002). Sports Lawyers Journal, Indiana Tulane University School of Law, 6329 Freret St., New Orleans, LA 70118. Note (Gregory A. Bullman), A Right Without a Potent Remedy: Indiana’s Bad Danielle Conway-Jones, Factual Causa- Faith Insurance Doctrine Leaves Injured tion in Toxic Tort Litigation: A Philosophi- Third Parties Without Full Redress, 77 IND. cal View of Proof and Certainty in Uncer- L.J. 787 (2002). Indiana Law Journal, Indi- tain Disciplines, 35 U. RICH. L. REV. 875 ana University School of Law, Law Build- (2002). University of Richmond Law Re- ing, Room 009, Bloomington, IN 47405- view, T.C. Williams School of Law, Room 1001. 301, University of Richmond, Richmond, VA 23173. Jeffrey O. Cooper, The Continuing Complexity of Indiana Rule of Evidence Local Interest 404(b), 35 IND. L. REV. 1415 (2002). Joseph R. Alberts, Survey of Recent De- California velopments in Indiana Product Liability Law, 35 IND. L. REV. 1427 (2002). Casenote (Tracey Angelopoulos), Pavlo- Charles M. Kidd, Survey of the Law of vich v. Superior Court: Spinning a World Professional Responsibility, 35 IND. L. Wide Web for California Personal Jurisdic- REV. 1477 (2002). tion, 39 SAN DIEGO L. REV. 1019 (2002). Timothy C. Caress & Katherine Amy San Diego Law Review, University of San Lemon, Recent Developments in Indiana Diego School of Law, 5998 Alcala Park, Tort Law, 35 IND. L. REV. 1583 (2002). San Diego, CA 92110. Indiana Law Review, Indiana University School of Law—Indianapolis, 530 W. New Matthew J. Madalo, Ethics Year in Re- York St., Indianapolis, IN 46202-3225. Reviewing the Law Reviews Page 181

Louisiana New York

Comment (Wendy Watrous), Lawyer or Sha-Shana N.L. Crichton, Distinguish- Loan Shark? Rule 1.8(E) of Louisiana’s ing Between Direct and Consequential Rules of Professional Conduct Blurs the Damages under New York Law in Breach Line, 48 LOY. L. REV. 117 (2002). Loyola of Service Contract Cases, 45 HOW. L.J. Law Review, Loyola University New Or- 597 (2002). Howard Law Journal, 2900 leans School of Law, 7214 St. Charles Van Ness St. N.W., Washington, DC Ave., Campus Box 901, New Orleans, LA 20008. 70118. Joel Slawotsky, New York’s Article 16 Michigan and Multiple Defendant Product Liability Litigation: A Time to Rethink the Impact Daniel P. Ryan, Michigan Rule of Evi- of Bankrupt Shares on Judgment Molding, dence 702: Amend It or Leave It to 76 ST. JOHN’S L. REV. 397 (2002). St. Schanz? 19 T.M. COOLEY L. REV. 1 (2002). John’s Law Review, St. John’s University Thomas M. Cooley Journal of Practical School of Law, 8000 Utopia Parkway, Ja- and Clinical Law, Thomas M. Cooley Law maica, NY 11439. School, 217 S. Capitol Ave., Lansing, MI 48933. Paul H. Aloe, Civil Practice, 52 SYRA- CUSE L. REV. 227 (2002). Missouri Michael J. Hutter, Evidence, 52 SYRA- CUSE L. REV. 397 (2002). Bobbi McAdoo & Art Hinshaw, The Thomas F. Segalla & Richard J. Cohen, Challenge of Institutionalizing Alternative Insurance Law, 52 SYRACUSE L. REV. 449 Dispute Resolution: Attorney Perspectives (2002). on the Effect of Rule 17 on Civil Litigation Steven Wechsler, Professional Responsi- in Missouri, 67 MO. L. REV. 473 (2002). bility, 52 SYRACUSE L. REV. 563 (2002). Missouri Law Review, University of Mis- Scott L. Haworth, Torts, 52 SYRACUSE L. souri—Columbia, 203 Hulston Hall, Co- REV. 677 (2002). Syracuse Law Review, lumbia, MO 65211-4190. Syracuse University College of Law, Syra- cuse, NY 13244-1030. Nevada Pennsylvania Note (Carl Tobias), Waiting for Daubert: The Nevada Supreme Court and the Ad- Seth William Goren, A Pothole on the missibility of Expert Testimony, 2 NEV. Road to Recovery: Reliance and Private L.J. 59 (2002). Class Actions under Pennsylvania’s Unfair Note (Brian Irvine), Intentional Inflic- Trade Practices and Consumer Protection tion of Mental Distress in Nevada, 2 NEV. Law, 107 DICK. L. REV. 1 (2002). Dickin- L.J. 158 (2002). Nevada Law Journal, 4505 son Law Review, Dickinson School of Maryland Parkway, Box 451003, Las Ve- Law, 150 S. College St., Carlisle, PA gas, NV 89154-1003. 17013.

New Jersey Texas

Seymour Moskowitz, Rediscovering Mark L. Kincaid & Trevor A. Taylor, Discovery: State Procedural Rules and the Annual Survey of Texas Insurance Law Level Playing Field, 54 RUTGERS L. REV. 2002, 6 J. TEX. CONSUMER L. 2 (2002). 595 (2002). Rutgers Law Journal, 5th & Journal of Texas Consumer Law, Univer- Penn Sts., Suite 510, Camden, NJ 08102. sity of Houston Law Center, 100 Law Cen- ter Houston, TX 77204-6060. Page 182 DEFENSE COUNSEL JOURNAL—January 2003

Steve McConnico & Robyn Bigelow, tion in Texas, 33 TEX. TECH L. REV. 971 Summary of Recent Developments in (2002). Texas Tech School of Law Law Texas Legal Malpractice Law, 33 ST. Review, 1802 Hartford, Lubbock, TX MARY’S L.J. 607 (2002). 79409. Broadus A. Spivey, Ethics: Lawyering and Professionalism, 33 ST. MARY’S L.J. West Virginia 721 (2002). St. Mary’s Law Journal, One Camino Santa Maria, San Antonio, TX Student Article (Sean R. Levine), Spo- 78228-8604. liation of Evidence in West Virginia: Do Too Many Torts Spoliate the Broth? 104 Appellate Practice Group of Locke, W. VA. L. REV. 419 (2002). West Virginia Liddell & Sapp, Recurring Issues in Con- Law Review, Box 6130, Morgantown, WV sumer and Business Class Action Litiga- 26506-6130.

Correction An error occurred in the U.S. Postal Service Statement of Ownership, Manage- ment and Circulation, which appeared on page 400 of the October 2002 issue of Defense Counsel Journal. The figure in Paragraph 15(h), actual nearest filing date, should be 786. About the IADC

The International Association of Defense Counsel is the oldest and most prestigious international association of attorneys representing corporations and insurers. Its activities benefit not only the approximately 2,400 invitation-only, peer-reviewed members and their clients through networking, education and professional opportunities, but also the civil justice system and the legal profession. The IADC takes a leadership role in many areas of legal reform and professional development. Founded in 1920, IADC’s membership comprises the world’s leading corporate and insurance attorneys, partners in large and small law firms, senior counsel in corporate law departments, and corporate and insurance executives. They engage in the practice and management of law involving the defense, prosecution and resolution of claims affecting the interests of corporations and insurers. The Association maintains a comprehensive list of publications and training programs, including the quarterly Defense Counsel Journal. It holds annual and midyear meetings and sponsors the IADC Trial Academy, the IADC Corporate Counsel College, and the IADC Fidelity and Surety Trial Practice Program, each held annually. The IADC founded the Defense Research Institute and co-founded Lawyers for Civil Justice.