1. Obtaining Electronic Evidence For Use in Litigation
Presented by
Brian Sniffen and Tara O’Hanlon
Miller Nash Graham & Dunn LLP

2. Background/Experience
Brian Sniffen – former litigator, and he’s OK with that.
Data Privacy and Data Security
Intellectual Property (trademarks and copyright work)
General Business/Corporate Counsel
Tara O’Hanlon – current litigator, she loves it.
General commercial litigation
Construction litigation and contract drafting
Condemnation litigation
Employment litigation

3. Discussion Topics
Brian will provide an overview of things to consider from the perspective of a recipient of a subpoena or other information request. (Opportunity to reach out before it’s an issue.)
Tara will discuss some of the nuts and bolts, along with some examples, of how to obtain and use electronic evidence in litigation.

4. The Recipient’s Perspective
When your client receives a subpoena or other document request, do your litigation thing (read, analyze with client, respond/object, confer, seek protective order if necessary).
Then ask:
Do you and your client have a continuing obligation to make sure the data produced is protected (or redacted before production)?
Does your client have a duty to notify the data owner (and if so, how soon)?
What else might your client have said about how it would protect the data?
Ideally, your client will know the answers to these already.

5. Continuing Obligation?
Short answer: yes.
Certain sensitive data is subject to administrative, technical, and physical safeguards. See, e.g., ORS 646A.622.
There may be litigation exceptions.
Turning over sensitive data can result in a “data incident.” See ABA and Bloomberg Law articles for discussion.
Whether an “incident” is a “breach” requiring notification is subject to an “appropriate investigation” standard. See, e.g., ORS 646A.604(7); FRCP 5.2.
Your client may have contractual obligations.
Best practice is to consider these issues on the front end.
You (the lawyer) may have ethical obligations. See, e.g., ORPC 1.6.

6. Duty to Notify?
If there has been a “data breach,” yes. See, e.g., ORS 646A.604.
You may have contractual obligations.
Timing can vary.
Obligations to investigate and remediate can vary.

7. What Else? What’s in your client’s privacy policy?
What else is on your client’s website?
What’s in your client’s contracts?
See Oregon’s recent H.B

8. Electronic Data and the Civil Rules
FRCP 34 and state equivalents: Electronically stored information (“ESI”) discoverable
FRCP 26:
Required to identify categories and types of ESI
Limitation on discovery for undue burden and cost
Pre-discovery conferences (FRCP 26(f))

9. ESI Sources Email – standard Texts Social Media
Facebook
Twitter
LinkedIn
Reddit/YouTube
Keeping up with the latest – WhatsApp/Vine/Snapchat
Internet searches/browsing history

10. How to Request ESI Requests for Production Interrogatories Define ESI
Specify format for collection
Identify other devices
Interrogatories
Devices used
Social Media/Data Platforms used

11. Third-party Subpoenas
FRCP 45 and state equivalent
Identifying the source of ESI
Identifying the form of production of ESI
Requesting access to devices
Accessing devices during depositions
Privacy/confidentiality issues
Affidavit of deponent authenticating ESI

12. Collection Methods Third-party Vendor v. Attorney v. Client
Forensically Sound – no change in metadata
Case law disfavoring client collection
Collection software: iMazing, AirDroid
Data privacy issues
Cost considerations
Testimony/Authentication

13. Authentication
Proposed changes to FRE 902: authentication by certification
(13) Certified Records Generated by an Electronic Process or System. A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent must also meet the notice requirements of Rule 902(11).
(14) Certified Data Copied from an Electronic Device, Storage Medium, or File. Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent also must meet the notice requirements of Rule 902(11).

14. Advancing your Case with ESI
People are more careful with , less so with texts/social media
Hard to dispute witness/party’s own words
Possibility for “smoking gun” evidence
Thinking outside the box for sources of ESI

15. Thank You
Brian Sniffen 111 S.W. Fifth Avenue Suite 3400 Portland, OR 97204
Tara O’Hanlon Pier Alaskan Way, Suite 300 Seattle, WA