Maryland Appellate Decision Permitting Limited Forensic Search of Non-Parties’ Cell Phones

In St. Francis Academy, et al. v. Gilman School, Inc., No. 1390 (Md. Ct. Spl. Apls. Mar. 21, 2022) (unreported), the intermediate appellate court affirmed an order directing forensic imaging and searching of non-parties’ cell phones under a strict protocol to protect the cell phone owners’ privacy.  It carefully balanced the discovering litigant’s need for relevant factual information against the non-parties’ concerns of privacy and security.  It addressed the latter with a detailed protocol.[1]

Plaintiff was a high school football player who was injured while playing for St. Francis Academy (“SFA”) on defendant Gilman’s football field.  He and his parents alleged that Gilman’s field was in a defective condition and they brought suit against Gilman and others.

Gilman served discovery subpoenas on SFA and two of its coaches (the “Coaches”).  SFA and the Coaches were not parties to the lawsuit.

SFA produced some documents, but no emails or text messages.  One of the coaches testified in deposition that he had exchanged texts with the player’s father.  He said others had likely also exchanged texts; however, he had obtained a new phone and could not find any texts.

Counsel for the coaches and Gilman communicated, with limited success.  At one point, SFA and the Coaches offered “to check their own devices….”  At another point, additional subpoenas were served.

Gilman offered to cooperate.  It proposed a detailed plan to safeguard the Coaches’ privacy by having a third-party vendor extract the data, permitting the Coaches’ counsel to review the data for responsiveness prior to production, and offering to consider cost-shifting.

SFA and the Coaches responded by sending twenty screen shots of text messages from one coach’s phone.  They said that the other coach “was unable to retrieve old messages.”

Gilman then provided additional detail about its proposal. It offered use of the third-party vendor to extract information from the phones, “run a list of search terms/parameters across the extracted information to identify what should be produced,” and permit the Coaches and their counsel to review the “hits” prior to production.  Gilman said it would provide search terms.

A series of events followed, resulting in Gilman moving to compel production and the Coaches cross-moving for a protective order.  After a preliminary ruling, Gilman sent an email suggesting search terms and the “to” and “from” names of a list of participants. The Coaches rejected this as “[t]oo broad.”  The motions to compel and for protective order were renewed. Gilman’s supporting affidavit explained: “Only the relevant hit data that is promoted for review [will be] viewed by a human in a readable, non-encrypted form.”  Gilman told the court that “[the Coaches’ counsel] can be the very first person to look at the text messages….”

The trial court narrowed the list of participants and ordered the parties to proceed, at Gilman’s cost.  On appeal, the Coaches asserted that their privacy was not adequately protected; however, the appellate court affirmed.  It rejected the assertion that this was a case of first impression, stating that the only issue was whether the third-party vendor could take the imaged data to its facility for forensic analysis.  It concluded that this is not “a drastic change in Maryland law.”

The Court of Special Appeals noted the trial court’s broad authority to fashion protective orders.   It wrote that “the Coaches did not challenge relevancy….” Their opposition was based on privacy concerns and alleged exposure to potential data theft, misappropriation, and unauthorized dissemination.

The Court carefully balanced the competing interests. It noted both that the Coaches were in “the unique position of non-parties in the production of discovery” and their valid concerns about the security of their data.

It also weighed “Gilman’s need for relevant information” and the methodology proposed.  It found that the vendor’s protocol’s posed only “a minimal risk” to privacy.  The imaged data would be encrypted. The only data that would be unencrypted would be material matching the search parameters.  The Court considered the two-factor authentication and other vendor security measures.  It noted that the Coaches and their counsel could conduct pre-production review and Gilman was paying the costs.

It wrote: “We conclude that the court’s order reasonably protects the Coaches’ privacy interests and, in the end, represents a measured and balanced approach to the production of the Coaches’ electronically stored data.” [emphasis added].  One may also speculate that the reasonable offers and efforts of Gilman’s counsel to cooperate were key factors.

In my view, the only error was that the appellate court did not publish its opinion so that it would be precedent.

________

[1] Under Md. Rule 1-104, unreported opinions may not be cited in any paper, motion, or other document filed in a Maryland court either as precedent or as persuasive authority.