The Document Request Tightrope: Balancing Your Company’s Interests and Your Duty to Respond

Document requests are a regular part of your life as an in-house lawyer — even when your organization isn’t involved in the litigation for which documents are requested. For corporate counsel, such document requests can present an interesting predicament. On one hand, you have a duty to respond; but on the other, you must protect your company’s interests. Producing information that is otherwise privileged may waive those privileges; producing protected employee information may subject your company to liability and reveal business practices and trade secrets that may compromise your company’s competitive advantage. However, failure to appropriately comply may result in the court sanctioning your company. To compile the concerns, trial attorneys often demand every piece of paper that may, even in the most remote sense, be relevant to their litigation.

It is also important to understand why document requests are so valuable to trial lawyers. The documents sought may contain information helpful to their client’s case. Document requests are often the only avenue through which the attorney can access and evaluate a company’s records. For example, if a plaintiff is claiming that an injury caused him or her to miss work, the opposing attorney might want the plaintiff ’s work records to determine whether this allegation is accurate. The documents might also be pertinent in determining or confirming the plaintiff ’s wages so the attorneys can accurately calculate the value of missed worktime.

This article is limited to requests for which your company is not a party to litigation. While some of the practical applications and privileges overlap, it is imperative to recognize your duty to produce documents differs when your company is a party to the underlying lawsuit.

Types of document requests

Document requests may present in various forms. The two most common are subpoenas and “Nonparty Requests for Production of Documents.”

Subpoenas

A subpoena will likely be the most common document request you receive. Subpoenas may be sent in both state and federal court proceedings. The Federal Rules of Civil Procedure permit and govern a subpoena for documents or testimony during litigation. Rule 45 is vital for attorneys to understand when responding to a subpoena. First, there are certain procedural requirements the subpoena must satisfy for it to be valid. Furthermore, Rule 45 provides that a company may move to quash or modify the subpoena if it seeks privileged or otherwise protected information, does not provide a reasonable amount of time to comply, or places an undue burden on the respondent.

If the subpoena is limited to the production of documents, you can serve a written objection within 14 days or the time specified in the subpoena. The requesting party must then file a motion to compel to obtain the documents. Specifically, Rule 45 provides that after an objection is made:

• (1) At any time, on notice to the commanded person, the serving party may move the court for the district where compliance is required for an order compelling production or inspection.
• (2) These acts may be required only as directed in the order, and the order must protect a person who is neither a party nor a party’s officer from significant expense resulting from compliance.

Fed. R. Civ. P. 45(d)(2)(B). Thus, if an objection is made and the court orders the nonparty to comply, the court must protect a nonparty from significant expenses resulting from compliance.

Subpoenas often seek a wide array of documents and use terms like “any and all.” Rule 45 provides protection from overly broad and burdensome requests as well:

A party or attorney responsible for issuing and serving a subpoena must take reasonable steps to avoid imposing undue burden or expense on a person subject to the subpoena. The court for the district where compliance is required must enforce this duty and impose an appropriate sanction — which may include lost earnings and reasonable attorney’s fees — on a party or attorney who fails to comply.

Fed. R. Civ. P. 45(d)(1). Courts are required to quash or modify any subpoena that subjects a company to undue burden. Undue burden is considered on a case-by-case basis. Courts will look into factors such as relevance, why the requesting party needs the documents, the breadth of the document request, the expanse of the time period, the particularity with which the documents are described, and the burden imposed on your company.

In addition to document production, it is important to note that a subpoena may also request testimony. In that instance, a written objection does not excuse an appearance at a hearing, deposition, or trial. Rather, you must file a motion for a protective order. The court will then determine whether you or another representative from the company must appear as requested by the subpoena.

For state subpoenas, some states have adopted the Uniform Interstate Depositions and Discovery Act (UIDDA), which provides a simple procedure for enforcing out of state subpoenas. Assume litigation is pending in state A and one of the parties wants to serve a subpoena on your company, which is located in state B. If state A and B have adopted the UIDDA, state A would present the state B clerk of court with a subpoena issued by a state A court. The state B clerk will then issue a subpoena for service upon the appropriate company. The terms of the issued subpoena must incorporate the same terms as the original subpoena and contain the contact information for all counsel of record and any party not represented by counsel. This provides an efficient alternative to filing suit in a foreign jurisdiction simply for purposes of serving a subpoena.

One variation to be cognizant of is whether the state you are dealing with permits the attorney to execute the subpoena or requires the court’s signature. Being armed with this knowledge will allow you to identify insufficient requests and thus avoid production.

Litigants are entitled to request information from a nonparty, such as your company. However, there are protections available to prevent disclosure of sensitive information that may jeopardize your company’s competitive advantage or subject your company to liability.

Nonparty requests for production of documents

Nonparty requests are a method through which parties to a lawsuit can obtain documents from entities that are not part of the lawsuit. While many jurisdictions require a subpoena to obtain documents from a company that is not a party to a lawsuit, some have state-specific statutes that allow an avenue for discovery to be conducted amicably without the court’s involvement. This will be more common when your company is domiciled in the same state in which the litigation is ensuing.

For example, according to O.C.G.A. § 9-11-34, Georgia law provides that a party to a lawsuit may require a nonparty to produce or otherwise make available “documents (including writings, drawings, graphs, charts, photographs, phono-records, and other data compilations from which information can be obtained, translated, if necessary, by the respondent through detection devices into reasonably usable form), or to inspect and copy, test, or sample any tangible things … ” While this may seem to provide unfettered access to your company’s file, protections are included as well. Much like Rule 45, the statute also provides that the nonparty may object and ultimately force the requesting party to prove why the documents are needed.

The aforementioned statute is more closely aligned with states’ procedure for requesting documents from a party to litigation. The majority of state statutes require a subpoena to request nonparty documents. As a default, nonparty requests should be handled in the same manner as subpoenas. However, be aware of the time frames set forth in the applicable statute for objections and responses. Often, a failure to timely object can result in a waiver of the objection.

It is also necessary to reiterate that this is limited to nonparty requests for production of documents. When your company is a party to litigation, different rules, statutes, and even judge-specific guidelines may apply.

Important protections to consider when determining what to produce

Attorney-client privilege

The attorney-client privilege is one of the most coveted forms of protection in US law. The purpose of this privilege is to allow an attorney and her client to discuss matters without the fear of those conversations being disclosed. For corporate counsel, the attorney-client privilege can be tricky. This is because your client is not a single person, but an entire entity. Depending on the structure of your company, you may interact with everyone from the executive team to the interns.

Information protected by the attorney-client privilege is not discoverable and should never be produced pursuant to a subpoena or document request.

Information protected by the attorney-client privilege is not discoverable and should never be produced pursuant to a subpoena or document request. Corporate counsel must understand what communications are protected by the attorney-client privilege and how those privileges might be waived. In order to withhold information subject to the privilege, you must make sure you structure your internal communications in a manner that lends itself to protecting privileged information. You only get one bite at this apple, and any waiver could result in highly sensitive information becoming discoverable.

As corporate counsel, it is essential to help your team understand what the attorney-client privilege is, why it is important, and how to preserve it. Then, when you receive a subpoena or request for production of documents, you can confidently withhold privileged information and protect your company’s interests.

Simply copying corporate counsel on an email does not make it privileged, and not all advice given by corporate counsel is deemed privileged. For example, you may be involved in making important business decisions that do not necessarily constitute legal advice. Often, discussions such as this will fall outside the realm of attorney-client privilege because you are acting in a business capacity and not legal capacity. So, what is covered?

First, an attorney-client relationship must exist. For corporate counsel, the business entity is considered the client, not individual employees, officers, members, shareholders, etc. Of course, an entity must act through its employees so certain communications will be protected, but not all.

To determine whether the attorney-client privilege applies, a judge will look at the subject matter of the communication and consider to whom it was made. For example, if you talk about a potential issue with the upcoming merger or acquisition with an entry-level receptionist, the conversation might not be protected. However, if this conversation takes place with the CEO, it is most likely privileged.

A general rule of thumb is to keep correspondence on a need-to-know basis. Waiver can be inadvertent, implied, or express. Once the privilege is waived, that communication is discoverable. The most common is inadvertent waiver. In today’s world of email blasts and “reply-all,” it is easy to accidentally include people on a communication who should not receive it. For example, if corporate counsel and the executive committee were discussing a potential change in the training manual to reduce workers’ compensation claims, this might be privileged. But if, on that same email chain, the topic changes to an upcoming golf outing and the sales team is looped into the email chain, the privilege has now been compromised.

Consider the following hypothetical. Your company was recently restructured and new management was put in place. The former manager had various communications with in-house counsel about who should be awarded a bid to perform work on certain projects for your company. After the former manager’s departure from the company, it is uncovered that he was receiving kickbacks from the contractors to whom he awarded bids. Litigation ensues and the former manager is named personally. During that litigation, the other party seeks communications and documents related to those decisions. The former manager asserts the attorney-client privilege. However, new management wants to produce the documents to clear the air and show the company’s investors the “one bad apple” has been ousted. Can new management waive the former manager’s right to assert the attorney-client privilege? Yes.

The United States Supreme Court has held “When control of a corporation passes to new management, the authority to assert and waive the corporation’s attorney-client privilege passes as well. New managers installed as a result of a takeover, merger, loss of confidence by shareholders, or simply normal succession, may waive the attorney-client privilege with respect to communications made by former officers and directors.” Therefore, if current managers want to waive the privilege, former managers are not entitled to the attorney-client privilege even if the communications were privileged at the time they were made.

The attorney-client privilege is not a blanket protection. One exception is when fraud or crime within your company is at issue. For the exception to apply, the requesting party must typically prove the person asserting the privilege was engaged in or planning a criminal or fraudulent scheme when he sought the advice of counsel; the advice was sought in furtherance of the scheme; and the documents containing the privileged information are related to the existing or future scheme. Courts are also clear that a custodian of records may not resist a subpoena for corporate records simply because the production of those documents may incriminate him.

Specific employee information

Whether your company is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is another aspect to consider. If you are a covered entity under HIPAA, then you may be responsible for privacy rules that govern your employees’ protected health information (PHI). If your company is not a covered entity, but is a business associate or maintains a self-insurance plan, you may also be subject to certain HIPAA privacy rules.

HIPAA has guidelines for disclosures relating to administrative and judicial proceedings. A covered entity may disclose PHI in response to a subpoena if certain notice requirements are met. The covered entity must have satisfactory assurance that the party requesting the PHI has attempted to notify the individual. The notice to the individual must include enough information about the litigation or proceeding in which the information is sought, and there must be enough time for the individual to raise an objection with the court. Additionally, before the covered entity may release the PHI, the objection time period must have expired with no objection filed or, if an objection was filed, it must be resolved. If there is a resolved objection, the covered entity should only disclose PHI consistent with the resolution. Alternatively, a covered entity may disclose PHI if a protective order has either been agreed to or sought from the court. The protective order would require the use and disclosure of the PHI to be limited to only purposes relating to the litigation. These parameters apply to a subpoena. It is important to note the difference between a subpoena and a court order because HIPAA distinguishes the two. If there is a court order, HIPAA states that you must respond to the court order and the notice or the protective order requirements outlined previously do not apply.

In instances where state protections are afforded, courts have said those protections should be applied even in federal proceedings when they do not significantly interfere with federal substantive and procedural policy. These holdings consider the fact that healthcare companies rely on the protections afforded by their individual state. When you receive a request for production in federal court, be sure to consider the protections your company is entitled to under state law as well.

If you are a covered entity under HIPAA, then you may be responsible for privacy rules that govern your employees’ protected health information (PHI). If your company is not a covered entity, but is a business associate or maintains a self-insurance plan, you may also be subject to certain HIPAA privacy rules.

Some companies that are not covered entities maintain detailed personnel files containing medical information. For example, trucking companies are subject to the Federal Motor Carriers Safety Association (FMCSA), which was created through the Motor Carrier Safety Act of 1999. FMCSA requires drivers of commercial vehicles to undergo a routine medical examination performed by a certified medical examiner in order to reduce crashes, injuries, and fatalities. The FMCSA states commercial drivers should be held to a higher standard of safety and the purpose of this examination is to determine that drivers are medically qualified to drive commercial vehicles.

If you are in-house for one of these companies and receive a subpoena for documents, you must consider the sensitive nature of the information. Be sure you wait out any objection period before producing documents and your employee or her attorney does not object to the production of the sensitive information. Another option is to send a written objection, as previously discussed, and withhold the information. Regardless of your decision, you should demand the requesting party send a HIPAA release executed by your employee (or often former employee) prior to producing any protected health information.

In addition to medical information, employee files often include social security numbers, wage information, birth dates, and other sensitive information. While not all information is protected, you should take into consideration what might be redacted or withheld to protect the interest of your company’s employee.

Sensitive business information

Businesses often spend a great amount of resources to fine-tune operations and procedures. This can include proprietary software, strategic initiatives, investments, contracts or operating agreements with other companies, and many other resources. Every successful business has its own playbook that has been adjusted and perfected through research and development. That playbook, whatever it is for your company, is very important to protect as disclosing the information through a document request could negatively impact your company. Keep in mind documents produced may become part of the record for that lawsuit — and that record is public.

Every successful business has its own playbook that has been adjusted and perfected through research and development. That playbook, whatever it is for your company, is very important to protect as disclosing the information through a document request could negatively impact your company.

Of course, the most concerning thing about your company’s playbook being public is the possibility of a competitor gaining access. If the information sought is not privileged, but sensitive, it is good practice to have the requesting party enter into a confidentiality agreement prior to producing the documents. As corporate counsel, you should be familiar with any protections afforded to your specific industry, such as applicable intellectual property laws.

If you determine some of the documents should be produced or are ordered by the court to produce certain documents, you should obtain a nondisclosure or confidentiality agreement from all parties involved. The agreement should, at a minimum, govern who has access to the documents, the extent to which each entity or person has access to the documents and the lifespan of all documents produced (generally includes a requirement that all documents be returned to in-house counsel or destroyed after the conclusion of the case). The agreements often require every person accessing the documents to sign. You can also require the requesting party to sign an affidavit of compliance, which will put them on the hook for enforcing the agreement throughout litigation.

Keep in mind that even if your documents are protected, any court filings may be public. Therefore your agreement should protect the sensitive information from inadvertent disclosures (for example, a portion being cited or used as an exhibit in a motion). To avoid this issue, all agreements should include language such as the following:

Any party in this suit that files with the Court a brief, motion, or other document that contains confidential ABC Company document(s) or other material, any summaries or extracts of confidential ABC Company material or any detailed reference to confidential ABC Company information shall make its filing under seal. The individual or entity filing a document or exhibit with the Court that contains confidential ABC Company information shall be responsible for informing the Court and the Clerk of the Court that the filing contains confidential ABC Company information, that it is subject to the terms and provisions of this Confidentiality Stipulation and Agreement and Court Order, and must be received and maintained under seal. Furthermore, the individual or entity filing a document or exhibit with the Court that contains confidential ABC Company information shall be responsible for obtaining a Court Order, if necessary, authorizing the filing to be made under seal.

Less common, but still just as important to consider, is whether producing certain documents may have unintended consequences.

Take the following situation for example. A driver is hit head on and injured by another vehicle that crossed the middle line. This is a typical personal injury action. No airbags deployed and defense counsel is going to base his argument on the fact that the impact was so minor that it did not cause the airbags to come out. You are corporate counsel for a car manufacturer and receive a request for production of documents from the defendant’s attorney for information related to the airbags in the plaintiff’s car. Defense counsel likely just wants to know the force required to trigger the airbags, but sends a sweeping request nonetheless. In an effort to cooperate, you produce all documentation and specifications related to the airbags.

Unbeknownst to you, part of the engineering file includes remarks that the airbags did not deploy at the requisite impact, but actually required a much harder impact than intended during testing. Congratulations, your company is now the newest party to the lawsuit. Defense counsel wants to bring you in and blame the plaintiff’s injuries on your defective airbags. The plaintiff wants your company in the lawsuit for the perceived “deep pockets.”

This is not to suggest you hide information, but you may call the requesting party to discern exactly what they are seeking. This informal approach to responding is discussed in further detail in the final section.

Nuanced or statutorily provided protections

These protections are rare, but if your company falls within a nuanced exception, it may be afforded additional protections from requests for production and subpoenas.

For example, it is well established that Indian tribes possess the common-law immunity from suit traditionally enjoyed by sovereign powers. However, does this tribal immunity bar the enforcement of third-party subpoenas? The Eight Circuit Court of Appeals says yes, holding, “From the plain language of the United States Supreme Court’s definition of a suit … and from that Court’s well-established federal policy of furthering Indian self-government, a federal court’s third-party subpoena in private civil litigation is a suit that is subject to Indian tribal immunity. An Indian nation, as a nonparty, can be protected in the discovery process.”

Another example of an industry-specific carve out is found in Georgia where exception is made to the Open Records Act to protect sensitive financial records and information from disclosure.

For example, Georgia Municipal Association (GMA) administers the Georgia Municipal Employees Benefit System (GMEBS) Defined Benefit Retirement Plan. GMA frequently receives requests for production of documents or subpoenas for information regarding a particular plan participant and his or her benefits (think divorce proceeding and the parties are dividing assets). GMEBS is subject to the Georgia Open Records Act, so a request for production of documents or subpoena is not usually necessary to obtain information pertaining to the plan. However, state law provides some exceptions to the Open Records Act. Included is an exemption for financial records in the possession of the retirement system that concern a party other than the retirement system itself. This exception affords protection for the financial information and benefit information of participants in this retirement plan. With this exception in tow, counsel can withhold financial information until the plan participant authorizes disclosure.

These exceptions are very rare, but equally significant. It is important to know whether your state laws or the federal rules provide specific protections related to your industry. This is especially true if you work in any capacity with government or quasigovernment entities.

Work product

This is one of the most fundamental and critical protections afforded. The work-product doctrine protects information developed by counsel in anticipation of litigation. This is often more common when your company is being sued, but it is key to mention when discussing document production.

After an accident, companies often conduct an investigation and gather information related to the accident. This may come up with trucking companies involved in a wreck, a retailer facing a slip-and-fall injury in its store, or when an employee is injured at work. The file containing witness statements, incident reports, etc., are often discoverable once your company is brought into the lawsuit. This is because these investigations transpire for every incident (often required by the company’s handbook) and are considered a common business practice rather than something done in anticipation of being sued for that specific event.

Be careful to keep your legal advice and analysis separate from the normal investigation conducted for every occurrence. Another way to protect information obtained is to retain outside counsel to complete the investigation. If outside counsel handles the interviews, takes pictures, and collects evidence, it will likely be protected through the work-product doctrine.

What if your work product is requested by a parent or subsidiary company to assist in litigation? A number of district court opinions have considered whether the work-product privilege is waived when a party shares qualifying documents with another party for use in litigation in a related case. Several of the district court opinions said the key is whether the “transferor has common interests with the transferee.” Many of the courts found that work-product privilege is not waived “by disclosures between attorneys for parties having a mutual interest in litigation, between parties that were potential co-defendants to an antitrust suit, between attorneys representing parties sharing such a common interest in actual or prospective litigation, or between parties one of whose interests in prospective litigation may turn on the success of the other party in a separate litigation.”

What to do when you receive a document request

The aforementioned information is intended to help you understand the protections you may be afforded when faced with a request for production. You should avail yourself of any and all protections permissible under the law. While every request is different and may not result in you producing documents, the following are practical considerations when you are faced with a request or subpoena you believe requires the production of certain limited documents.

Evaluate exactly what information or documents are being requested

Oftentimes, the wording includes phrases like “any and all documents pertaining to X.” In a large entity, there may be thousands of documents relating to “X.” It is typically helpful to reach out to the requesting attorney and get a better understanding as to what is needed. This can help streamline the process and reduce unnecessary document production. Returning to the airbag example, if that corporate counsel called defense counsel to ask what documents were being sought, he would have learned the focus was on the force required to trigger the airbag. Defense counsel may have agreed to accept the specs page for that model airbag in lieu of “any and all” documents related to the airbag. By making this phone call, corporate counsel would have likely prevented the company from being brought into the lawsuit because the engineering file would not have been produced.

If you do take this informal approach, be sure to confirm the agreement in writing. This will protect your company if the attorney later alleges you failed to fully comply with the request.

Identify all of the documents sought that are protected and should not be disclosed

This will require you to consider the validity of each request, the nature of the document sought and whether the document, in whole or in part, is subject to any of the aforementioned protections.

For smaller document productions, you may be able to simply redact confidential information (e.g., social security numbers in employee file). By doing so, you can timely comply with the request and avoid court involvement. If you do intend to object to the production of some or all documents, be sure to make a written objection within the applicable time frame so the objection is not waived. Any written objection should be served on all parties of record.

If a nondisclosure or confidentiality agreement is in order, include that requirement in your objection. It is best practice to have a draft agreement your company is comfortable with to use as a proposed agreement. This helps ensure you are afforded all protections desired.

Produce the documents, if any

When producing documents, make sure to keep a record of all documents produced, all documents withheld and all correspondence with the requesting attorney. A well-documented file will be your best form of protection if you are later accused of withholding documents or otherwise failing to produce complete records.

In litigation, parties often use a privilege log as a beneficial tool to keep track of documents produced or withheld during discovery. A privilege log typically lists all documents withheld from production, a brief description of the document and the reason it was withheld. Judges are very familiar with privilege logs, so as a practical matter, it will be easier for the judge to interpret and gather pertinent information if he or she becomes involved.