IN RE: BRINKER DATA INCIDENT LITIGATION (2020)

ORDER

This data breach class action is before the Court on Defendant Brinker International, Inc.'s Motion for Protective Order (Doc. 84). Plaintiffs responded in opposition (Doc. 86) and Brinker, at the Court's direction, replied (Doc. 94).

Brinker seeks a protective order limiting the relevant period on which its Rule 30(b)(6) corporate representative must testify to January 1, 2017 through the present. (Doc. 84 at 4). Although the data breach occurred in 2018, Plaintiffs argue that documents received in discovery show that Brinker failed to comply with certain data security measures beginning at least as far back as 2014, and thus Brinker's historical practices are relevant to its actions in 2018. (Doc. 86 at 3, 8). Brinker contends that to adequately prepare its corporate representative for deposition it would face an extraordinary burden costing in excess of $500,000. (Doc. 84 at 10–11).

When faced with a motion for a protective order, a court must limit the extent of discovery otherwise allowed if:

(i) the discovery sought is unreasonably cumulative or duplicative, or can be obtained from some other source that is more convenient, less burdensome, or less expensive;

(ii) the party seeking discovery has had ample opportunity to obtain the information by discovery in the action; or

(iii) the proposed discovery is outside the scope permitted by Rule 26(b)(1).

Fed R. Civ. P. 26(b)(2)(C). The scope of allowable discovery under Rule 26(b)(1) is broad:

Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party's claim or defense and proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties' relative access to relevant information, the parties' resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit. Information within this scope of discovery need not be admissible in evidence to be discoverable.

Fed. R. Civ. P. 26(b)(1). However, Rule 26(b)(1) “crystalizes the concept of reasonable limits on discovery through increased reliance on the common-sense concept of proportionality.” In re: Takata Airbag Prod. Liab. Litig., No. 14-24009-CV, 2016 WL 1460143, at *2 (S.D. Fla. Mar. 1, 2016) (quotation marks omitted) (quoting Chief Justice John Roberts, 2015 Year–End Report on the Federal Judiciary 6 (2015)).

Here, the burden and expense of the proposed discovery outweighs its limited potential benefit. That Brinker may have been out of compliance with required security measures in 2014 has little relevance to whether it was implementing appropriate security measures in 2018. For example, Plaintiffs argue that in 2014, Brinker was required to confirm with First Data card services its compliance with Payment Card Industry Data Security Standards (“PCI DSS”), and that compliance with those standards would have prevented the breach in 2018. (Doc. 86 at 3; Doc. 84-11 at 2). Even if true, this does not mean the relevant period should now begin in 2014. Brinker was allegedly supposed to be PCI DSS compliant in 2018 and it allegedly was not—that is the main focus of the case.

Additionally, Plaintiffs argue that multi-factor authentication (“MFA”) was installed in 2017—allegedly three years late—but not implemented, enabling the hackers to gain access, and, therefore, Plaintiffs should be entitled to information from 2014 (the year MFA should have been installed). (Doc. 86 at 3; Doc. 84-11 at 2). However, this example, and all the others listed by Plaintiffs, are unpersuasive. Ultimately, if Brinker was violating industry standards or its own IT and data security policies in 2018, it does not greatly matter how long those violations were ongoing. See Doc. 84-11 at 2.

In sum, while there might be some slight probative value, blanket discovery going back to 2014 is not proportional to the needs of the case and expense on Brinker.¹ See Fed. R. Civ. P. 26(b)(1); (Doc. 84-13).

Accordingly, it is hereby

ORDERED:

1. Defendant Brinker International, Inc.'s Motion for Protective Order (Doc. 84) is GRANTED. Brinker's 30(b)(6) corporate representative's deposition is limited to the period originally agreed to by the parties beginning January 1, 2017. However, Plaintiffs can still ask Brinker's 30(b)(6) witness about why these security practices were not implemented before 2017 and pose questions based on documents already received in discovery.

2. If Plaintiffs have a good faith basis to do so, they may seek to expand the scope of discovery. However, in so doing, Plaintiffs shall fully explain how the expected discovery would relate to the elements for specific causes of action concerning the breach that occurred in 2018.

3. The parties may begin to schedule and propound further discovery pending the entry of a Case Management and Scheduling Order.

DONE AND ORDERED in Jacksonville, Florida this 5th day of March, 2020.

FOOTNOTES

1.   This ruling should not be construed to incentivize companies to utilize expensive and inefficient systems to store old electronic information in an effort to avoid producing the information in discovery. If the information sought here had a greater potential bearing on the facts at issue (i.e. was more proportional) Brinker would be required to bear the costs of producing it.

TIMOTHY J. CORRIGAN, United States District Judge