First-Citizens Bank and Trust Company v. HSBC Holdings PLC, et al.

Opinion

San Francisco Division FIRST-CITIZENS BANK AND TRUST Case No. 3:23-cv-02483-LB COMPANY, Plaintiff, ORDER v. Re: ECF No. 263 HSBC HOLDINGS PLC, et al., Defendants. The parties have a discovery dispute about First-Citizens’ document subpoenas to thirty-six former employees. They are not parties, and they are represented by the defendants’ counsel.1 The court twice declined to enforce the subpoenas wholesale, ordered “additional discovery limited to the [Pillars’] devices”(meaning the personal devices of Mr. Sabow and the six since-dismissed individual defendants), and directed First-Citizens to “curate” any follow-on requests “based on what [it] learned” and its “theory of the case.”2 Those productions are complete. Relying on them,

1 Disc. Letter Br. – ECF No. 263 at 1. Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the ECF-generated page numbers at the top of documents. The court can decide the dispute without oral argument. Civil L. R. 7-1(b). 2 First-Citizens asks the court to enforce the subpoenas against seven former employees (Matt Perlow, Alex Choy, Michael Hanewich, Lindsey Guinn, Jason Hughes, Jonathan Norris, and Sarah Storer) for three categories of documents from March 10 to September 10, 2023.3 The defendants and the former employees agree only to a search of Mr. Perlow’s personal devices, tied to his transmission of a client spreadsheet to his HSBC email, and oppose the rest.4 The court grants the request in part and denies it in part. Mr. Perlow, Mr. Choy, and Mr. Hanewich must produce responsive documents: as to each, the completed first-phase discovery supplies an individualized, evidence-based reason to think that the personal accounts hold unique, material evidence on the remaining claims. The court denies the request without prejudice as to Ms. Guinn, Mr. Hughes, Mr. Norris, and Ms. Storer: the only evidence particular to them is an access log showing that — while still employed — they viewed client information that their jobs gave them access to. That is not enough to compel searches of non-parties’ personal accounts. The court also denies the request without prejudice as to the remaining former employees. The earlier order compels the production of documents and does not authorize forensic imaging or inspection of anyone’s personal devices. All thirty-six former employees must continue to preserve potentially responsive material. 1. The Claims and the Staged Discovery According to First-Citizens, in March and April 2023, Mr. Sabow worked with HBUS and six senior First-Citizens employees — the “Pillars” — to recruit thirty-six First-Citizens employees to HSBC in a coordinated “raid” designed to capture the “core of [SVB’s] profitability engine.”5 The thirty-six resigned on Easter Sunday, April 9, 2023.6 First-Citizens claims that the participants took its confidential information with them and that none of it has been returned.7

3 Disc. Letter Br. – ECF No. 263 at 4 & n.3. 4 Id. at 6–7. 5 Id. at 2. 6 Id. at 3, 4 n.3. First-Citizens served document subpoenas on the thirty-six former employees. The court has addressed them twice. It declined to enforce the subpoenas wholesale and instead ordered “additional discovery limited to the [Pillars’] devices,” adopting the defendants’ compromise: a review of communications from Mr. Sabow’s and former defendant Rebekah Hanlon’s personal devices, and production from the five other dismissed individual defendants’ devices.8 At the December 12, 2024 hearing, the court observed that a “preservation hold is in place” for the former employees, said that it did not “know what . . . smoking gun” First-Citizens might be looking for, and directed First-Citizens to “curate” any later request “based on what [it] learned” and its “theory of the case.”9 The first-phase productions are complete. Overall, the defendants report more than 66,000 pages of party productions and over 1,000 mobile communications from their custodians.10 At a May 14, 2026, hearing, the court said that “the narrative of what happened in this relatively short amount of time is going to be fully discovered and excavated” regardless of which claims and parties remain, and that First-Citizens “need[s] to be able to” tell its story. Defense counsel responded, “We understand that.”11 2. The First-Phase Productions and the Present Dispute First-Citizens contends that the productions show a deliberate off-channel scheme: the Pillars assembled the thirty-six employees’ personal phone numbers and email addresses, stressed that the plan must stay secret lest First-Citizens “pull the plug,” redirected meeting invitations away from company email, and set up informal chains of command through which certain former employees relayed directives to others.12 First-Citizens says the resulting communications exist only on the

8 Orders – ECF Nos. 102, 136. 9 12/12/14 Tr. – ECF No. 137 at 14–15, 19. 10 Disc. Letter Br. – ECF No. 263 at 4. 11 5/14/26 Tr.– ECF No. 242 at 80, 91 (quoted at Disc. Letter Br. – ECF No. 263 at 2, 6). former employees’ personal devices and remain unproduced.13 The defendants respond that employees discussing career moves on personal channels is ordinary and appropriate, the relay theory is speculation that would have surfaced in the custodians’ productions if true, and isolated texts among junior employees do not show unique, material evidence.14 The productions include two client-facing texts. On April 12, 2023 — three days after the resignations — Mr. Choy texted Sunita Patel, a first-phase custodian, that he had just met with a First-Citizens client about “a near term opportunity to refi the SVB deal . . . and bring them over to HSBC.” Katherine Andersen, another custodian, texted a former SVB client that “our tribe” had landed at HSBC: “We’ve got you!”15 The defendants respond that neither text references confidential information, the second recipient is not on First-Citizens’ list of allegedly lost clients, and working with former SVB clients at HSBC is not itself unlawful or a breach.16 An SVB access log shows former employees viewing confidential client information — including in the Client Insights Center database — in the days before, and on the day of, the resignations; two, including Mr. Choy, accessed information on Easter Sunday hours before resigning.17 The defendants respond that the log reflects employees using systems in the ordinary course of their jobs — including on weekends — in the months before their departures.18 Finally, the productions revealed specific transmissions. On April 16, 2023, Mr. Perlow emailed a spreadsheet of SVB client information from his personal account to his HSBC account; the defendants recently discovered and produced the email and offered a search of Mr. Perlow’s personal devices under reasonable parameters.19 First-Citizens adds that Ms. Patel and Ms. Andersen photographed their computer screens to move information to personal devices without leaving a forensic trail, and that Mr. Hanewich, after secretly committing to HSBC, photographed 13 Id. at 2. 14 Id. at 5, 6–7; see Order – ECF No. 105 at 28. 15 Disc. Letter Br. – ECF No. 263 at 2–3. 16 Id. at 5–6. 17 Id. at 3–4; Spreadsheet, Ex. C – ECF No. 265-1 (sealed). 18 Disc. Letter Br. – ECF No. 263 at 6. confidential information on his computer and emailed the photographs to himself.20 The defendants reply that the custodians’ screenshots say nothing about the thirty-six former employees, First-Citizens identifies nothing Mr. Hanewich allegedly took or used at HSBC, and his conduct occurred while he was still employed and entitled to access the information.21 First-Citizens asks the court to order the seven identified former employees to produce, for March 10 through September 10, 2023, the following: (1) documents obtained through their SVB/First-Citizens employment and documents derived from them; (2) documents regarding their departure from First-Citizens and affiliation with HBUS; and (3) documents regarding SVB/First- Citizens clients. If that review shows a need to search others, First-Citizens will ask separately.22 The defendants and the former employees propose only a meet-and-confer about search parameters for Mr. Perlow’s devices “tied to [his] alleged misuse of confidential information,” and otherwise oppose enforcement.23 Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case. Fed. R. Civ. P. 26(b)(1). The court must limit discovery that is “unreasonably cumulative or duplicative, or can be obtained from some other source that is more convenient, less burdensome, or less expensive.” Fed. R. Civ. P. 26(b)(2)(C)(i). Rule 45 incorporates these limits and requires the court, on a timely motion, to quash or modify a subpoena that “requires disclosure of privileged or other protected matter, if no exception or waiver applies,” or that “subjects a person to undue burden.” Fed. R. Civ. P. 45(d)(3)(A)(iii)–(iv). Nonparties unrelated to the litigants should not be burdened to the same extent as litigants, and requests to them must be narrowly tailored to meet specific needs for information. Updateme Inc. v. Axel Springer SE, No. 17-cv-05054-SI (LB), 2018 WL 5734670, at *3 (N.D. Cal. Oct. 31, 2018) (collecting cases). “The moving party bears the burden of persuasion

20 Id. at 3, 4 n.3 & Computer Images, Ex. B – ECF No. 264-2 (sealed). 21 Disc. Letter Br. – ECF No. 263 at 4, 6. 22 Id. at 4 & n.3. on a motion to quash, but the party issuing the subpoena must demonstrate that the discovery is relevant.” In re Rule 45 Subpoenas Issued to Google LLC & LinkedIn Corp., 337 F.R.D. 639, 645 (N.D. Cal. 2020). The party serving the subpoena “must take reasonable steps to avoid imposing undue burden or expense on a person subject to the subpoena,” and the court “must enforce this duty.” Fed. R. Civ. P. 45(d)(1). With the first-phase productions complete, the issue is whether First-Citizens has a particularized reason — beyond membership in the group of thirty-six — to believe that the individual’s personal accounts likely hold unique, material evidence, and whether production is proportional given the individual’s privacy interests as a non-party. Henson v. Turn, Inc., No. 15- cv-01497-JSW (LB), 2018 WL 5281629, at *5 (N.D. Cal. Oct. 22, 2018) (privacy interests bear on proportionality, particularly for personal devices). It does for three of the seven. It does not, yet, for the other four. 1. Mr. Perlow Must Produce Responsive Documents A week after he resigned, Mr. Perlow emailed a spreadsheet of SVB client information from his personal account to his HSBC account, a transmission the defendants located and disclosed only recently, and (First-Citizens says) one that Mr. Perlow offered to remediate only when the email became undeniable.24 The defendants agree that his personal devices should be searched; they dispute only the search’s breadth, proposing parameters “tied to [his] alleged misuse.”25 The broader scope is warranted. Mr. Perlow’s conceded self-transmission of client data makes each of First-Citizens’ three categories likely to yield unique and material evidence about his acquisition of First-Citizens materials and the alleged coordination, and client documents (as narrowed below) bear on use of the information and damages. The evidence is unique because his personal accounts are not in any party’s possession: the April 16 email surfaced in party discovery

24 Id. at 3 & n.2, 6. only because he sent it to an HSBC address, and material confined to personal channels would never surface that way. The three categories, the six-month window, and parameters modeled on the first-phase protocol keep the burden proportional. 2. Mr. Choy and Mr. Hanewich Must Also Produce Responsive Documents Two facts particularize Mr. Choy. He viewed confidential client information hours before resigning on Easter Sunday.26 Three days later, he told a first-phase custodian that he had just met with a First-Citizens client about “a near term opportunity to refi the SVB deal . . . and bring them over to HSBC.”27 The defendants answer that the text does not itself reference confidential information.28 That is a merits argument, and it misses the discovery question: whether Mr. Choy’s personal-channel documents are likely to hold unique, material evidence about the use of First-Citizens’ client information and the diversion of its business, which are issues at the center of the trade-secret claim and damages. A post-resignation pitch to move an existing “SVB deal” to HSBC, days after eve-of-resignation access to client data, makes that showing. Whether the pitch drew on confidential information is what the documents will reveal. The possibility that they may exonerate is a reason to produce them, not to withhold them. Mr. Hanewich’s conduct is of a different kind than a log entry: after secretly committing to HSBC, he photographed confidential information on his computer screen and emailed the photographs to himself.29 The defendants do not deny the conduct; they say that he was still employed and “entitled to access the information,” and that First-Citizens has not identified anything he took or used at HSBC.30 But an entitlement to view information does not explain photographing the screen and transmitting the images to a personal account, a method that, on

26 Id. at 3–4; Spreadsheet, Ex. C – ECF No. 265-1 (sealed). 27 Disc. Letter Br. – ECF No. 263 at 2–3. 28 Id. at 5–6. 29 Id. at 4 n.3. First-Citizens’ evidence, participants used precisely because it leaves no forensic trail.31 Access consistent with one’s duties is one thing; screen photography plus self-transmission is activity “inconsistent with” one’s “prior work,” and courts have found comparable acquisition-consistent conduct sufficient to support an inference of improper acquisition. 7EDU Impact Acad., Inc. v. You, 760 F. Supp. 3d 981, 997–98 (N.D. Cal. 2024) (allegations that the employee “opened nearly 100 files . . . days prior to her departure,” followed by erasure of her devices, “reasonably support[ed] an inference” of improper acquisition) (cleaned up). That accessing information during one’s employment is not itself misappropriation goes to liability, not discovery. Whether Mr. Hanewich improperly acquired information is what his documents will show. See, e.g., United States v. Olgado, No. 17-CR-00603-BLF-2, 2022 WL 2356996, at *9 (N.D. Cal. June 30, 2022). For both men, as for Mr. Perlow, the material is unique (personal accounts, outside any party’s possession), the categories and window are tailored, and the order compels documents rather than imaging, which keeps the intrusion proportional. Nidec Corp. v. Victor Co. of Japan, 249 F.R.D. 575, 577 (N.D. Cal. 2007); Henson, 2018 WL 5281629, at *5. 3. The Remaining Four Employees Ms. Guinn, Mr. Hughes, Mr. Norris, and Ms. Storer stand differently. The only evidence particular to them is the access log: entries showing that, in the days before the resignations, they viewed confidential client information in systems that their jobs gave them.32 All of that access occurred while they were employed. None of it is tied — as to these four — to any download, photograph, off-network transmission, relay role, client solicitation, or post-departure use. On this record, the innocent explanation (employees doing their jobs, including on weekends, as the log elsewhere reflects) is possible.33 Access during employment is not itself improper. See, e.g.,

31 Id. at 3. 32 Id. at 3, 4 n.3 (citing 9/19/2025 Letter, Ex. D – ECF No. 263-4); Spreadsheet, Ex. C – ECF No. 265- 1 (sealed). Olgado, 2022 WL 2356996, at *9 (“simple acquisition of a company’s trade secrets by an employee is not acquisition by improper means”) (cleaned up). Anomalous conduct — mass file- opening followed by device-wiping, activity “inconsistent with any of [the employee’s] prior work” — merits discovery, not routine use of work systems. 7EDU, 760 F. Supp. 3d at 998. That difference matters because of what the court asked First-Citizens to do: curate follow-on requests around what the first phase taught about particular people. For these four, it taught nothing particular. Enforcing subpoenas against non-parties’ personal devices and accounts on group membership plus routine access would invert the required showing — that the discovery is likely to yield unique and material evidence — and would give too little weight to the privacy interests that make personal-device discovery from non-parties an intrusion of a different order. Nidec, 249 F.R.D. at 577; Henson, 2018 WL 5281629, at *5; accord Radio Music License Comm., Inc. v. Global Music Rights, LLC, No. CV 19-3957 TJH (ASx), 2020 WL 7636280, at *4 (C.D. Cal. Jan. 2, 2020) (adding twenty-two custodians not proportional and duplicative); Vena v. Moore, No. 22-cv-437-W (BLM), 2023 WL 6194315, at *4 (S.D. Cal. Mar. 24, 2023) (non-party discovery inappropriate where the information can be had without intruding on the non-party’s privacy). The stakes are large, but proportionality asks about the marginal benefit of this discovery from these people, and on this record that benefit is speculative. Much of the coordination story remains available through less intrusive means: the productions ordered today, the custodial record, and depositions.34 On the other hand, the four did not merely use work systems in the ordinary course: they viewed confidential client information on the eve — some on the day — of resignations that, on First-Citizens’ evidence, they had secretly coordinated for weeks, timing that itself supports an inference of purposeful acquisition.35 The first-phase productions show that the thirty-six were directed to keep the plan off company channels lest First-Citizens “pull the plug.” If that is right, responsive departure and affiliation communications exist on these employees’ personal accounts and nowhere else, which is the definition of unique evidence.36 The request is narrow — three 34 Id. at 5 (ten deponents available). 35 Id. at 3–4; Spreadsheet, Ex. C – ECF No. 265-1 (sealed); 9/19/2025 Letter, Ex. D – ECF No. 263-4. categories, six months, negotiated parameters, shared counsel, and documents rather than imaging — and the stakes, which the defendants’ own documents put above $1 billion, make four additional custodial searches arguably proportional.37 Balancing the approaches, the court denies the discovery without prejudice. First-Citizens may test its theories in depositions, and the productions that are ordered may supply the individualized predicate that is missing now. Any renewed request must be person-specific: what the person did beyond viewing information within the person’s job, why the innocent explanation fails, and why the person’s own accounts likely hold unique, material evidence. 4. Scope, Protocol, and the Other Former Employees The order compels the production of documents. Mr. Perlow, Mr. Choy, and Mr. Hanewich must, through counsel, collect and produce responsive documents from their personal devices and accounts by applying the agreed search parameters. The order does not authorize forensic imaging, mirroring, or direct inspection of any device or account. Category three is narrowed. As proposed (“documents regarding SVB/FCB clients”), it would sweep in ordinary post-hire client work at HSBC with no tie to the claims. As ordered, it reaches documents concerning SVB or First- Citizens clients that reflect the solicitation or transition of those clients to HBUS or the use of, or derivation from, SVB or First-Citizens information. Categories one and two are adopted as proposed. The period is March 10 through September 10, 2023. Within fourteen days, counsel must meet and confer on search parameters — custodial sources, terms, and any individual-specific adjustments — using the first-phase protocol as the model.38 Production must be substantially complete within sixty days of this order and is subject to the protective order.39 The request is denied without prejudice as to the other former employees. Any renewal must follow the joint-letter brief process and make the individualized showing described above. 37 Disc. Letter Br. – ECF No. 263 at 3. 38 Disc. Letter Br. – ECF No. 130. ] Nothing in this order limits party discovery or depositions. All thirty-six former employees must 2 continue to preserve potentially responsive documents. * 3 5 This resolves ECF No. 263. 7 Dated: August 19, 2026 LAUREL BEELER 8 United States Magistrate Judge 9 10 11 qa 12

2 «14

Z 18 19 20 21 22 23 24 25 26 40 12/12/24 Tr. — ECF No. 137 at 14; Disc. Letter Br. — ECF No. 263 at 6-7. First-Citizens’ preservation concerns about HBUS CEO Michael Roberts’s mobile phone — a January 2024 device 27 exchange that did not restore certain pre-August 2023 data — involve a party custodian, are disputed, and are not presented for decision in this letter. Disc. Letter Br. — ECF No. 263 at 2 n.1, 6n.4. The 28 court decides nothing about them here.