The Orwellian Irony of Requesting Private Data in a Data Privacy Suit

Two months ago, Magistrate Judge Laurel Beeler issued a decision in , Henson v. Turn, Inc., No. 15-cv-01497-JSW (LB) 2018 U.S. Dist. LEXIS 181037, (N.D. Cal. Oct. 22, 2018), a data privacy class action. The Plaintiffs in this suit allege that Turn, Inc. placed 'zombie cookies' on their devices which could not be blocked or deleted. Judge Beeler's order denied the Defendant's requests for production of the plaintiffs' mobile devices for forensic imaging; the full browsing history on the devices; and all cookies stored and deleted on the devices. She instead adopted the Plaintiffs' counter proposal that they only produce web browsing history and cookies for websites associated with Turn, and just the date fields for all other cookies.

Turn places cookies, or tracking beacons, on smartphones to gather information about a user's web browsing and app use. The Court noted studies showing that most Americans are uncomfortable with the amount of information that companies collect about them. Turn used a Verizon function that created a unique header (X-UIDH) for each of its customers that could be read in HTTP request made to sites run by Turn. Turn 'respawned' zombie cookies on smartphones that contained all of the values from old cookies which had X-UIDHs which matched those in a HTTP request.

Judge Beeler ruled that the request for a complete forensic image of the smartphones was not relevant and proportional to the needs of the case under Fed. R. Civ. P. 26(b)(1). A complete forensic image would include text messages, photos, and other data irrelevant to claims or defenses. Notably the decision states that, "While questions of proportionality often arise in the context of disputes about the expense of discovery, proportionality is not limited to such financial considerations. Courts and commentators have recognized that privacy interests can be a consideration in evaluating proportionality, particularly in the context of a request to inspect personal electronic devices." Henson, 2018 U.S. Dist. LEXIS 181037, at *15. Judge Beeler emphasized that the Defendant was asking for access to the forensic images, despite the fact that the Plaintiffs had imaged their own devices and were producing information from those images.

A request for the full browsing history on the Plaintiffs' devices was also ruled to not be relevant and proportional to the needs of the case, and raise similar privacy concerns. The Court decided that Turn could decide whether or not the Plaintiffs regularly deleted cookies from their smartphones by making reference to the date fields of the cookies and browsing histories, and the full content of each was not needed. There is an obvious contradiction between the basis of the Plaintiffs' suit and the nature of the ESI request:

"There is an Orwellian irony to the proposition that in order to get relief for a company's alleged surreptitious monitoring of users' mobile device and web activity, a person has to allow the company unfettered access to inspect his mobile device or his web browsing history. Allowing this discovery would further invade the plaintiffs' privacy interests and may deter current and future plaintiffs from pursuing similar relief." Id. at *27.