In re Google RTB Consumer Privacy Litigation

Opinion

IN RE GOOGLE RTB CONSUMER Case No. 21-cv-02155-YGR (VKD) PRIVACY LITIGATION ORDER GRANTING IN PART AND DENYING IN PART PLAINTIFFS’ MOTION TO COMPEL Re: Dkt. No. 393

Plaintiffs move for an order compelling defendant Google LLC (“Google”) to produce several documents Google has withheld from production, in whole or in part, based on claims of attorney-client privilege or attorney work product protection. Dkt. No. 393. Google opposes the motion. Dkt. No. 396. The Court held a hearing on the matter on January 31, 2023. Dkt. No. 417. For the reasons explained below, the Court grants plaintiffs’ motion to compel as to disputed Entries #4 (redaction permitted), #41, #660 (redaction permitted), #1231 (redaction permitted), and #1262. The Court denies the motion as to the remainder of the disputed entries. Plaintiffs have challenged approximately 5,470 of the nearly 10,500 entries on Google’s privilege logs. See Dkt. No. 339; Dkt. No. 401 at 2-3. Because the Court could not resolve these challenges using its expedited discovery dispute resolution procedures, the Court ordered further proceedings, including briefing of the matter “as a regularly noticed motion under Civil Local Rule 7-2, supported by declarations and other evidence as necessary” with respect to the 18 documents the parties referenced in their prior submission. Dkt. No. 360 at 8. The Court also Of the 18 documents originally at issue, the parties resolved their dispute with respect to nine documents, leaving the following nine privilege log items in dispute: Entries #4, #41, #285, #660, #1231, #1262, #2813, #3265, and #9955. The Court reviewed each of these documents in camera. The parties agree that, in this case, federal common law governs Google’s claims of privilege and work product protection. See Dkt. No. 393 at 6; Dkt. No. 396 (citing only federal law). “The attorney-client privilege protects confidential communications between attorneys and clients, which are made for the purpose of giving legal advice.” United States v. Sanmina Corp., 968 F.3d 1107, 1116 (9th Cir. 2020). The privilege extends to a client’s confidential disclosures to an attorney in order to obtain legal advice, as well as an attorney’s advice in response to such disclosures. United States v. Ruehle, 583 F.3d 600, 607 (9th Cir. 2009) (citations and quotations omitted). “Because it impedes full and free discovery of the truth, the attorney- client privilege is strictly construed.” Id. (citations and quotations omitted). In the Ninth Circuit, whether information is protected by the attorney-client privilege is determined using an eight-part test: (1) Where legal advice of any kind is sought (2) from a professional legal adviser in his capacity as such, (3) the communications relating to that purpose, (4) made in confidence (5) by the client, (6) are at his instance permanently protected (7) from disclosure by himself or by the legal adviser, (8) unless the protection be waived. Sanmina, 968 F.3d at 1116. Where a communication has more than one purpose, it may be protected as privileged if the primary purpose of the communication is to give or receive legal advice, as opposed to business or some other non-legal advice. In re Grand Jury, 23 F.4th 1088, 1092-94 (9th Cir. 2021), cert. granted sub nom. In re Jury, 143 S. Ct. 80 (2022), and cert. dismissed as improvidently granted, 143 S. Ct. 543 (2023) (describing and adopting the “primary purpose” test for dual-purpose communications). The attorney work product doctrine protects from discovery materials that are prepared by doctrine provides qualified protection against discovery of the legal strategies and mental impressions of a party’s counsel. Hickman v. Taylor, 329 U.S. 495, 508–10 (1947); Upjohn Co. v. United States, 449 U.S. 383, 390–91 (1981). It does not protect facts from disclosure unless disclosure of those facts would inherently reveal an attorney’s strategies or mental impressions. See, e.g., O’Toole v. City of Antioch, No. 11 CV 01502 PJH MEJ, 2015 WL 1848134, at *3 (N.D. Cal. Apr. 14, 2015); Hamilton v. RadioShack Corp., No. C 11-00888 LB, 2012 WL 2327191, at *4–5 (N.D. Cal. June 18, 2012). A party claiming that a document or information is privileged or protected from disclosure has the burden to establish that the privilege or protection applies. See United States v. Martin, 278 F.3d 988, 999–1000 (9th Cir. 2002). A party asserting privilege or work product protection may make a prima facie case that the privilege or protection applies by “describ[ing] the nature of the documents . . . in a manner that, without revealing information itself privileged or protected, will enable other parties to assess the claim.” Fed. R. Civ. P. 26(b)(5)(A); see also Burlington N. & Santa Fe Ry. Co. v. U.S. Dist. Court for Dist. of Mont., 408 F.3d 1142, 1148 (9th Cir. 2005). The Ninth Circuit has held a party can meet this burden by providing a privilege log that identifies “(a) the attorney and client involved, (b) the nature of the document, (c) all persons or entities shown on the document to have received or sent the document, (d) all persons or entities known to have been furnished the document or informed of its substance, and (e) the date the document was generated, prepared, or dated.” In re Grand Jury Investigation, 974 F.2d 1068, 1071 (9th Cir. 1992) (citing Dole v. Milonas, 889 F.2d 885, 888 n.3 (9th Cir. 1989)). However, a party may substantiate a claim of privilege by other means. Apple Inc. v. Samsung Elecs. Co., 306 F.R.D. 234, 237 (N.D. Cal. 2015) (“Briefs, declarations or other proof may establish the purpose of the communication or the specific role of the sender and each individual recipient.”). The Court considers below plaintiffs’ challenges to the merits of Google’s privilege claims regarding the nine documents that remain in dispute. A. Entries #4 and #41 Entries #4 and #41 are described on Google’s privilege log as “[d]raft memorand[a] reflecting legal advice . . . regarding privacy issues.” Dkt. No. 392-5. For both documents, Google identifies the same attorney as “involved.” Id. Plaintiffs object to Google’s privilege claims because neither document was authored by or sent to an attorney and because the subject matter of the purported legal advice—“privacy issues”—is too vague and generic to support such claims. Dkt. No. 393 at 12-13. In its opposition, Google describes both documents as “Privacy Design Documents” but does not provide any information regarding the purpose for which either document was prepared.1 Dkt. No. 396 at 9. For Entry #4, Google identifies the author of the memorandum as which it explains is an Dkt. No. 393 at 12; Dkt. No. 396 at 6. For Entry #41, Google identifies the author of the memorandum as but does not otherwise explain who this person is. Dkt. No. 392-5. However, Google points out that the name of the attorney it says is “involved” appears at the top of the document. Dkt. No. 396 at 9. With respect to Entry #4, the document submitted in camera does not match the “draft memorandum” description in the log. Rather, Entry #4 appears to be a fillable form with prompts directing the user to supply specific factual information about the user’s “project.” The form contains instructions for submission “for review.” All prompts that appear in the form in Entry #4 have been answered.2 Google notes that Entry #4 includes text that “addresses” See Dkt. No. 396 at 9. It is difficult for the Court to know what to make of these observations, however, because Google has provided no information about the purpose of the document or to whom it was (or was intended to be) submitted that would justify a conclusion that the entire document is a draft communication to counsel seeking legal advice. The Court concludes from its own in

1 Google says only that Entry #41 relates to “an aspect of RTB” and Entry #4 relates to “a proposed project.” camera review of Entry #4 that only discrete portions of this document might be considered legal advice or guidance: (1) the first sentence in grey text under prompt 4; and (2) all grey text under prompt 7. This material may be redacted, but Google has not met its burden to show that the remainder of Entry #4 is privileged and it must therefore be produced. With respect to Entry #41, the document submitted in camera is closer in form to a “memorandum” although it is missing the conventional “to” and “from” fields of a memorandum. However, it does identify the name of the “project” and the names of the “tech lead” and “PCounsel.” Entry #41 includes text that appears to be factual information responsive to some of the same prompts that appear in Entry #4. However, Entry #41 has none of the grey text that appears in Entry #4 and nothing that appears to be legal advice or guidance. The fact that an attorney’s name appears as “PCounsel” at the top of the document is suggestive that an attorney is involved in some way, but as with Entry #4, Google has provided no information about the purpose of the document or to whom it was (or was intended to be) submitted that would justify a conclusion that the entire document is draft communication to counsel seeking legal advice. Because Google has not met its burden to show that Entry #41 is privileged, it must be produced. B. Entry #660 Entry #660 is described on Google’s privilege log as “[m]emorandum reflecting legal advice of counsel regarding regulatory issues.” Dkt. No. 392-5. Google identifies the author of the document as and indicates that the identity of the attorney whose advice is reflected in the document is “not available.” Id. Plaintiffs object to Google’s privilege claim because Google does not identify the attorney or attorneys whose advice is supposedly reflected in the document and because the subject matter of the purported legal advice— “regulatory issues”—is too vague and generic to support such a claim. Dkt. No. 393 at 12-13. In its opposition, Google says that Entry #660 is marked “Attorney Client Privileged; Reflects Advice of Counsel.” Dkt. No. 396 at 8. To the extent Google means that this text actually appears on the face of the document itself, the Court found no such marking on the document during in camera review. Google also says that Entry #660 “involves a .” Id. The Court’s in camera review of Entry #660 confirms that it involves a However, it is not obvious from the document itself that it reflects any legal advice about GDPR compliance. Google has provided no declaration or any other evidence to support its claim that Entry #660 reflects legal advice. With one possible exception, Entry #660 appears to be a summary of technical and business actions to be taken in anticipation of the effective date of GDPR without regard to or commentary about any legal advice that may or may not have informed those actions. For example, the document refers to a key decision having been made, but that decision is described in the document as involving technical, strategic, and business concerns, not legal concerns. The possible exception concerns a reference to which Google emphasizes in its opposition. Having reviewed Entry #660 in camera, the Court accepts Google’s argument that the passage in which this reference appears refers to a legal evaluation of a particular course of action. Accordingly, the text that appears adjacent to the number “5” on the second page of Entry #660 may be redacted, but Google has not met its burden to show that the remainder of Entry #660 is privileged and it must therefore be produced. C. Entry #2813 Entry #2813 is described on Google’s privilege log as an “[e]mail reflecting legal advice of counsel regarding privacy issues.” Dkt. No. 392-5. Google identifies attorney Uchechi Chima- Okereke as “involved,” although his name does not appear anywhere in the document. Id. In advance of briefing on the motion, Google advised plaintiffs that Entry #2813 is a comments notification email aggregating comments from two non-attorneys , and that the underlying document was authored by non-attorney . Dkt. No. 393 at 13. Plaintiffs object to Google’s privilege claim because this document was not authored by or sent to an attorney and because the subject matter of the purported legal advice—“privacy issues”—is too vague and generic to 1 In its opposition, Google devotes only a single sentence to Entry #2813, describing it as 2 “an automated email with comments inserted to a Google Doc entitled ES 3 a” □□□ No. 4 396 at 9. Nothing more. 5 Google’s opposition provides no support for its privilege claim for Entry #2813. Having 6 reviewed the document in camera, the Court concludes that the comments in Entry #2813 are not 7 themselves obviously privileged communications, and it is umpossible to tell whether the 8 underlying document is privileged. At the hearing, the Court asked Google to submit the 9 underlying document to the Court for i camera review. The Court received that submission on 10 February 2, 2023.* The underlying document is clearly labeled “Privileged & Confidential” and 11 || refers | 12 remainder of the document appears to concern the implementation, at least in part, of counsel’s 13 advice. As the underlying document appears to be privileged, the Court concludes that Entry 14 #2813, aggregating comments on the underlying document, is privileged as well. Google may 15 || withhold Entry #2813 from production on this ground. a 16 D. Entry #3265 = 17 Entry #3265 is described on Google’s privilege log as an “[e]mail reflecting legal advice of Z 18 || counsel regarding privacy issues.” Dkt. No. 392-5. Google identifies attorney Uchechi Chima- 19 Okereke as “involved,” although the log does not indicate that he is a sender or receiver of the 20 email. Jd. Plaintiffs object to Google’s privilege claim because there is no indication that an 21 attorney participated in the communication and because the subject matter of the purported legal 22 advice—“privacy issues”—is too vague and generic to support such claims. Dkt. No. 393 at 12- 23 13. 24 In its opposition, Google argues that Entry #3265 is a privileged communication because 25 the email exchange “involves Google employees 2.6 ||| 27 28 3 The document does not bear any bates number and it is not clear whether it is separately identified on Google’s privilege log.

, whom Google identified as the attorney involved.” Dkt. No. 396 at 9. The Court has reviewed Entry #3265 in camera. While the Court agrees that it is a privileged communication, Google’s description of the document is not entirely accurate. The email includes no actual requests for advice or approval from an employee to an attorney. Rather, the email exchange is between and among five Google employees describing the matters on which they require legal advice in preparation for a discussion with Mr. Chima-Okereke, discussing information needed for purposes of obtaining legal advice, and reporting on legal advice already obtained. In these circumstances, the Court concludes that the document may fairly be considered a communication relating to the purpose of seeking or obtaining legal advice. Google may withhold Entry #3265 from production on this ground. E. Entries #285, #1231, and #1262 1. Purpose of the communication Entries #285, #1231, and #1262 are described on Google’s privilege log as emails seeking and/or reflecting “legal advice of counsel regarding privacy issues.” Dkt. No. 392-5. For Entries #285 and #1262, Google identifies the attorneys “involved,” but for Entry #1231, the log indicates that the identity of the attorney is “not available.” Id. Plaintiffs object to Google’s privilege claims because the subject matter of the purported legal advice—“privacy issues”—is too vague and generic to support such claims. Dkt. No. 393 at 12-13. In addition, plaintiffs object that these documents were circulated to many non-lawyers, sometimes as part of large email distribution lists (whose contemporaneous members cannot be identified), and therefore Google cannot establish that these purportedly privileged communications were made in confidence. Id. at 13-14. Further, with respect to Entry #1231, plaintiffs argue that Google cannot sustain a privilege claim as to this document because it has not identified the specific attorney involved in the purportedly privileged communication. Id. at 12-13. In its opposition, Google argues that Entries #285 and #1262 are privileged communications because they contain direct requests for legal advice from a specific attorney or #1231 also is a privileged communication because it reflects a non-attorney’s request for information at the direction of an attorney to assist the attorney in providing legal advice. Id. at 8. Finally, Google contends that circulation of these communications to an internal distribution list is not inconsistent with its privilege claims. Id. at 10-11. Having reviewed Entry #285 in camera, the Court agrees that the purpose of this single email communication is to seek legal advice. Entry #1231 is more difficult to assess. This document is a multi-part email string, but only the earliest portion of it appears to involve communications made at the direction of counsel for the purpose of obtaining legal advice. While plaintiffs are correct that Google has not identified the particular attorney involved by name, the communication clearly reflects that the employee who initiated the email exchange is seeking information that a Google attorney requested for the purpose of giving legal advice. Given the passage of time (the email is more than three years old), it is not surprising that Google is currently unable to identify the attorney involved in this particular communication, but it is nevertheless clear from the document itself that an attorney sought the information in question. The later portion of Entry #1231, beginning with an exchange between appears to be a purely technical discussion among employees; this portion of Entry #1231 is not privileged. Entry #1262 is also a multi-part email string, but only some of the exchanges are clearly for the purpose of giving and receiving of legal advice. Google provides no information about the email exchanges in which an attorney does not participate, and there is nothing in the document itself that supports Google’s contention that the entire email string is privileged. Based on its in camera review, the Court is able to determine only that the emails directly addressed to and sent from the attorney are privileged communications. 2. Confidentiality The Court considers next whether these communications were shared or distributed among employees in a manner that undermines or destroys the confidentiality that is necessary to maintain a privilege claim. Plaintiffs contend Google has not met its burden to show that employees who needed to know the contents of the privileged communications. Dkt. No. 393 at 14-16. Google responds that it “cannot reconstruct the precise membership of each of its internal distribution lists at the time of each privileged communication,” and argues that it need not provide any additional information beyond the current membership of the lists, the nature of the lists, and the assurance that the communications involved or were distributed to only Google employees. Dkt. No. 396 at 6. The Ninth Circuit has not addressed the circumstances under which a corporation may fail to meet the confidentiality requirement for asserting privilege because an otherwise privileged communication is distributed to too many employees.4 However, other courts that have addressed this issue, including district courts within the Ninth Circuit, consider whether the employees to whom the privileged communication was distributed had a “need to know” the information. See, e.g., F.T.C. v. GlaxoSmithKline, 294 F.3d 141, 147 (D.C. Cir. 2002) (“The applicable standard is . . . whether the documents were distributed on a ‘need to know’ basis or to employees that were ‘authorized to speak or act’ for the company.”) (internal citations omitted); Diversified Indus., Inc. v. Meredith, 572 F.2d 596, 609 (8th Cir. 1977) (en banc) (corporation has the burden of showing “the communication is not disseminated beyond those persons who, because of the corporate structure, need to know its contents”); Garvey v. Hulu, LLC, No. 11-CV-03764-LB, 2015 WL 294850, at *2 (N.D. Cal. Jan. 21, 2015) (“The plaintiffs rightly note that a ‘need to know’ standard generally governs whether the privilege shields communications that are disseminated to corporate employees.”) (citing cases). Entry #285 is copied to 21 non-attorney employees. See Dkt. No. 393 at 16. Google says that the communication in question “was circulated to a group of non-attorney employees who needed to know about that legal advice given their roles in implementing privacy protections on Google’s platform.” Dkt. No. 396 at 12. Plaintiffs respond that this assertion is conclusory and fails to show that each recipient of the email needed to know the information in the communication. Dkt. No. 401 at 10. The Court agrees that Google’s showing is conclusory and unsupported. However, the Court has reviewed this document in camera and observes that the document itself identifies the roles of many of the recipients with respect to the contents of the communication, and also indicates why employees with strategy, operations, and engineering responsibilities are included as recipients. The author of the communication labeled it “privileged” and “confidential.” Given the nature of the communication and the limited number of employees to whom it was distributed, the Court concludes that Google’s privilege claim for Entry #285 is not undermined by a failure to meet the confidentiality requirement. As explained above, Entry #1231 is a multi-part email string, but only the earliest portion of it is privileged. Google’s privilege log indicates that the email exchange included 12 employees as well as a distribution list that currently has approximately 13 non-attorney members—all software engineers. See Dkt. No. 393 at 13. Google does not explain who the employees are or why they needed to participate in the communication. However, as the earliest portion of the email string in Entry #1231 is a privileged communication seeking technical information at the request of an attorney, it makes sense that such an inquiry would go to a distribution list comprised of employees with potentially responsive technical information. Thus, the fact that the communication involved as many as 25 software engineers does not undermine Google’s privilege claim as to the earliest portion of Entry #1231. Google may redact this portion of Entry #1231, but must produce the remainder (i.e. beginning with the exchange between Entry #1262 is another multi-part email string, a portion of which includes communications with Mr. Chima-Okereke, one of Google’s attorneys. Although it is not entirely clear, it appears that different people may have been added to the email exchange as it progressed, including at some point people who are members of three distribution lists with 75 current members, for up to perhaps 94 non-attorney employees. See Dkt. No. 393 at 15. Google says that the legal advice reflected in Entry #1262 “relates to privacy issues and was distributed to groups of Google employees, including those in Google’s advertising group and those responsible for particular advertising partnerships, who needed to know about the advice given their roles in 1 explanation is conclusory and unsupported. While Google is correct that sharing a communication 2 with a large number of employees is not necessarily fatal to a privilege claim, that observation is 3 nota sufficient response to plaintiffs’ challenge to the merits of the claim. Google does not 4 distinguish between the different parts of the email exchange or the different employees involved, 5 and it provides no supporting declaration or other evidence showing that any of these employees 6 had a need to know the purportedly privileged portions of the exchange. In the case of Entry 7 #1262, the Court cannot infer the necessary information from an in camera review of the 8 document itself. As Google has failed to meet its burden to show that otherwise privileged 9 communications in Entry #1262 were made and maintained in confidence, Google may not 10 withhold Entry #1262 from production. It must be produced. 11 F. Entry #9955 12 Entry #9955 is an automated email aggregating comments on an underlying document that 13 concerns the Dkt. No. 396 at 9. Plaintiffs initially challenged Google’s 14 privilege claims regarding Entry #9955. However, in their reply, plaintiffs indicate that, based on 3 15 Google’s description of the investigation at issue, they do not challenge redactions to this 16 document to the extent they concern that investigation. Dkt. No. 401 at 13. 3 17 The Court’s in camera review of Entry #9955 reveals that all comments concern the yyy 18 SM Accordingly, Google may withhold Entry #9955 from production on this ground. 19 IV. CONCLUSION 20 The Court grants plaintiffs’ motion to compel, as explained above, as to Entries #4 21 (redaction permitted), #41, #660 (redaction permitted), #1231 (redaction permitted), and #1262. 22 Google must produce these documents to plaintiffs by February 21, 2023. 23 The Court denies plaintiffs’ motion as to Entries #285, #2813, #3265, and #9955. 25 Dated: February 6, 2023 26

28 VIRGINIA K. DEMARCHI United States Magistrate Judge