Remand In Facebook Privilege Litigation

An opinion of the Massachusetts Supreme Judicial Court

In this case we address the applicability of the attorney-client privilege and the work product doctrine to an internal investigation conducted by the respondent, Facebook, Inc. (Facebook). After public reporting revealed potential widespread misuse of Facebook user data by third-party applications (apps), Facebook hired a law firm, Gibson, Dunn & Crutcher LLP (Gibson Dunn), to conduct a far-reaching investigation to identify the extent to which apps had misused user data and advise Facebook on potential resulting legal liabilities. This investigation is known as the app developer investigation (ADI). Around the same time, the Attorney General opened an investigation into Facebook under G. L. c. 93A, focusing on whether Facebook misrepresented the extent to which it protected or misused user data.

As part of that investigation, the Attorney General served Facebook with several civil investigative demands (demands). At issue are six requests contained within these demands that sought the identities of the apps and developers that Facebook reviewed at various stages of the ADI, other information associated with the review of the identified apps, and internal  communications about those apps. Facebook asserted that both the attorney-client privilege and the work product doctrine protected this information. The Attorney General filed a petition in the Superior Court seeking an order compelling Facebook to comply with the disputed requests. A judge concluded that most of the information is neither privileged nor work product, as it was not prepared in anticipation of litigation, and that even if it was prepared in anticipation of litigation, it is all factual information.

We conclude that the Attorney General's targeted requests allow Facebook to tailor its responses to the first five of the six requests to avoid disclosure of communications protected by the attorney-client privilege. We also conclude, however, that the documents sought by the first five requests were prepared in anticipation of litigation and therefore are covered by the work product doctrine. We further conclude that a remand is required to separate "opinion" work product from "fact" work product for at least some of these documents. To the extent the work product is fact work product, we conclude that the Attorney General has satisfied the heavy burden of demonstrating a substantial need for the information. Finally, as for the sixth request, seeking internal communications about the apps, we have determined that this request encompasses both privileged and nonprivileged communications, and therefore requires preparation of a privilege log and further review as determined by the judge.

The investigation arose from the Cambridge Analytica reportage

The 2018 reporting of this incident sparked a wave of litigation against and investigations into Facebook. By the end of 2018, Facebook faced at least five securities class actions, eight derivative actions, three books and records actions, and thirty-nine consumer-based suits, most of which also were class  actions. This number swelled to at least sixty-five litigations before the end of 2019. Facebook is also being investigated by a number of State, Federal, and foreign regulators.

Gibson Dunn led an app developer investigation ("ADI") team

Shortly after the media coverage of the Cambridge Analytica incident in March 2018, the Attorney General began investigating Facebook under G. L. c. 93A, § 6. The purpose of the investigation is to identify any other apps that misused user data and assess whether Facebook followed its policies and commitments to its users regarding user data. Over the course of the investigation, the Attorney General has issued three demands.

The first demand was issued in April 2018. The second demand, issued in June 2018, sought information on the apps that Facebook had suspended and information on Facebook's internal policies and procedures surrounding apps. As part of its response, Facebook provided the Attorney General with detailed information on how it has conducted the ADI.

The third demand, issued on November 5, 2018, is the subject of this dispute. In this demand, the Attorney General sought the identities of and information regarding the apps and developers that Facebook identified and reviewed as part of the ADI. Specifically, the Attorney General took the detailed descriptions of the ADI that Facebook provided and used that language in her requests. In response, Facebook provided updated information on suspended apps but refused to comply with several of the requests.

The court noted Facebook's extensive voluntary production and public statements concerning the ADI.

The first five requests do not require the production of any communications between Facebook and counsel during the ADI process.13 Rather, these requests only seek documents "sufficient to identify" the apps that fall within the five categories of requested documents identified  supra or lists of the apps themselves, and other information associated with those apps. While this certainly requires the production of factual information relevant to the Attorney General's investigation, and such factual information has almost certainly been contained in attorney-client communications, it does not require the production of the attorney-client communications themselves. This is a crucial distinction...

The sixth request broadly seeks "[a]ll of Facebook's internal communications and internal correspondence concerning" several categories of apps sought in the other requests. Facebook refused to comply with this request and asserted that it called for the production of privileged communications. The judge below ordered Facebook to produce a detailed privilege log identifying any documents it was withholding on the basis of the privilege. While this case proceeded on appeal, Facebook provided the Attorney General with at least two privilege logs responsive to this request.

...We...agree with the judge below that the appropriate course of action is for Facebook to prepare a detailed privilege log so that the Attorney General can challenge any assertions of privilege.

Work product

we conclude that the app information required to be produced is clearly covered by the work product doctrine. We also conclude that if this app information is not opinion work product, Facebook must disclose that information, because the Attorney General has demonstrated a substantial need for the information and could not obtain it without undue hardship. The difficult issue is separating fact from opinion work product in the first five requests. We set out the mode of analysis here but remand to the judge its application to the specific requests.

....In sum, we conclude the Attorney General has demonstrated both substantial need and undue hardship for the fact work product about the apps.

(Mike Frisch)