Crosmun v. Trustees Of Fayetteville Technical Cmty. Coll.

IN THE COURT OF APPEALS OF NORTH CAROLINA

No. COA18-1054

Filed: 6 August 2019 Cumberland County, No. 16 CVS 8374

DR. SANDRA T. CROSMUN, DR. MICHAEL HESS, LESLIE KEENAN, DR. JOHN R. PARKER, III, JAMIE E. STEVENS and CHERYL J. THOMAS, Plaintiffs,

v.

THE TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE, DR. LARRY J. KEEN, DR. DAVID L. BRAND and CARL MITCHELL, Defendants.

Appeal by Defendants from an order entered 15 June 2018 by Judge Mary Ann Tally in Cumberland County Superior Court. Heard in the Court of Appeals 9 May 2019.

Tin, Fulton, Walker & Owen, PLLC, by S. Luke Largess, and Rabon Law Firm, PLLC, by Charles H. Rabon, Jr., Gregory D. Whitaker, and David G. Guidry, for Plaintiffs-Appellees.

Yates, McLamb & Weyher, LLP, by Sean T. Partrick and David M. Fothergill, for Defendants-Appellants.

INMAN, Judge.

Seeking justice often involves enduring tedium. Many attorneys and judges unsurprisingly consider the discovery stage of civil litigation among the most prosaic and pedestrian aspects of practice.¹ A single page among millions of records,

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court claim that certain responses were incomplete, and agreeing to produce newly discovered additional responsive documents. Dissatisfied with Defendants’ response, Plaintiffs’ counsel sent additional letters reiterating their discovery demands. Plaintiffs followed their letters with a motion to compel requesting the trial court “[o]rder that the parties identify a computer forensics entity or individual who, at Defendants’ cost, will search the computer servers at FTCC to determine if Defendants have deleted emails and files pertaining to these discovery requests.”

Plaintiffs’ motion came on for hearing on 26 February 2018 before Superior Court Judge Douglas B. Sasser. At that hearing, Judge Sasser issued an oral ruling requiring a forensic computer examination of FTCC’s servers and tasked the parties with submitting a proposed order.

Judge Sasser’s oral ruling did little to quell the parties’ disagreement, and instead shifted their focus from what should be produced to what should appear in the proposed order. Defendants objected to Plaintiffs’ first proposed order on the ground that general language permitting Plaintiffs to search FTCC’s “computer files” for “deleted material” was over-broad, as it required a search of all of FTCC’s systems for any and all documents without limitation. Plaintiffs refused to revise the proposed order and reiterated their belief that a search of FTCC’s entire system was both necessary and allowed by Judge Sasser’s ruling. Defendants then drafted their own proposed order. Plaintiffs then revised their proposed order slightly and

-6-

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court suggested Defendants draft a consent protective order to address concerns relating to the production of student information. Defendants objected that Plaintiffs’ revised order did not adequately protect privileged information or appropriately limit the scope of discoverable materials. But Defendants agreed to draft a protective order for consideration by the trial court and Plaintiffs.

While the above discussions were ongoing, and roughly two weeks after the hearing before Judge Sasser, Defendants provided Plaintiffs with a supplemental document production. Defendants also informed Plaintiffs that they had yet to complete a draft protective order, as the model protective orders they were working from “only covered inadvertent disclosure of confidential material[,]” and “[i]t has been much more difficult to address privilege issues under a forensic search situation.” Plaintiffs replied that they would draft a proposed protective order prohibiting the disclosure of information protected by the Family Educational Rights and Privacy Act of 1974 (“FERPA”). Counsel for Defendants rejected that offer, expressing concern about how to prevent disclosure of materials within the attorney-client privilege or work-product immunity. As discussions surrounding the protective order continued, Plaintiffs submitted the parties’ competing proposed orders on the motion to compel to Judge Sasser.

Judge Sasser entered Plaintiffs’ proposed order on the motion to compel on 16 April 2018 (the “Forensic Examination Order”). In it, Judge Sasser provided for “a

-7-

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court forensic examination of [FTCC’s] computer files” by a “forensic examiner.” The order also provided that “the parties shall work with the examiner to agree on key words and other search parameters to use in conducting this forensic review, which will cover the period from . . . July 2014 to the present[,]” and that “Plaintiff’s shall bear the initial costs of the forensic review.” However, the Forensic Examination Order did not address how a forensic examiner would be selected, whether the examiner would be an independent third party, or how the forensic examination itself would be conducted, and it left resolution of any confidentiality concerns to a future protective order to be submitted by the parties at a later date.

Plaintiffs retained Clark Walton (“Mr. Walton”), an expert in computer forensics and a licensed North Carolina attorney, to draft a proposed forensic examination protocol to effectuate the Forensic Examination Order. As part of that process, Defendants permitted Mr. Walton to question members of FTCC’s Information Technology department about the nature of the college’s computer systems. Plaintiffs then submitted a proposed forensic examination protocol to Defendants for their consideration on 21 May 2018.6 The proposed protocol, in pertinent part, provided for the following:

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

15. Review of the Confidential Information by those so authorized by this Order shall not waive the confidentiality of the documents or objections to production. Nothing contained in this Order and no action taken pursuant to it shall waive or prejudice the right of any party to contest the alleged relevancy, admissibility, or discoverability of the Confidential Information sought or provided in discovery.

16. Nothing in the foregoing provisions of this Order shall be deemed to waive any privilege, or to preclude any party from seeking and obtaining, on an appropriate showing, such additional protection with respect to Confidential Information as that party may consider appropriate.

....

17. In order to facilitate discovery, the inadvertent disclosure of documents or other information subject to confidentiality, a privilege, or other immunity from production shall be handled as follows:

a. From time to time during the course of discovery, one or more of the parties may inadvertently disclose documents or other information subject to confidentiality, a privilege, or other immunity from production. Any such disclosure shall not be deemed a waiver of the confidential, privileged, or immune nature of that document or information, or of any related subject matter.

b. To that end, if a producing party, through inadvertence, error or oversight, produces any document(s) or information that it believes is immune from discovery pursuant to any attorney-client privilege, attorney work product immunity or any other privilege or immunity, such production shall not be deemed a waiver, and the producing party may give written notice to the receiving party that the document(s) or information so produced is deemed privileged and that the return of the document(s) or information is requested. Upon receipt of such written

- 11 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

notice, the receiving party shall immediately undertake to gather the original and all such copies to the producing party, and shall promptly destroy any newly created derivative document such as a summary of or comment on the inadvertently produced information.

Four days after the hearing and entry of the Protective Order, the trial court entered its order on Plaintiffs’ combined motion (the “Protocol Order”). That order adopted the protocol proposed by Plaintiffs without alteration, and provided for Mr. Walton, as “Plaintiffs’ expert[,]” to conduct a three-week-long forensic examination of the Search Images at his offices. The trial court denied Plaintiffs’ motion for sanctions.

Defendants filed their notice of appeal from the Protocol Order and a motion to stay on 21 June 2018. On 3 July 2018, the trial court entered a consent order on Defendants’ motion to stay, requiring the immediate imaging of certain discrete computer systems but otherwise staying operation of the Protocol Order.8

II. ANALYSIS

A. Appellate Jurisdiction

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

Blanket assertions that production is not required due to a privilege or immunity are insufficient to demonstrate the existence of a substantial right. Sessions, 248 N.C. App. at 381, 789 S.E.2d at 853. But specific objection to a discrete enumerated request for production or a document-by-document identification of alleged privileged information may suffice. See, e.g., K² Asia Ventures, 215 N.C. App. at 446-48, 717 S.E.2d at 4-5 (holding that some appealing defendants demonstrated a substantial right by asserting work-product immunity and attorney-client privilege as to a specific request for production of documents in their discovery responses while other appealing defendants failed to show a substantial right by simply prefacing their discovery responses with a general objection on those grounds not particularized to any specific request).

Plaintiffs argue that Defendants have failed to demonstrate that enforcement of the Protocol Order will affect a substantial right because Defendants have yet to identify specific privileged documents that would be captured and produced under the protocol. A document-by-document assertion of privilege, however, is not strictly required. Although “objections made and established on a document-by-document basis are sufficient to assert a privilege[,]” Sessions, 248 N.C. App. at 381, 789 S.E.2d at 853 (citation and quotation marks omitted) (emphasis added), they are not the exclusive means of demonstrating the loss of a substantial right and the appealable nature of a discovery order. K2 Asia Ventures, 215 N.C. App. at 446, 717 S.E.2d at 4;

- 14 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court see also Friday Investments, LLC v. Bally Total Fitness of the Mid-Atlantic, Inc., 247 N.C. App. 641, 788 S.E.2d 170 (2016) (holding that a discovery order affected a substantial right and was immediately appealable under the circumstances even though the appellants failed to assert particularized claims of attorney-client privilege in their initial discovery responses), aff’d as modified on separate grounds, 370 N.C. 235, 805 S.E.2d 664 (2017). We base our determination on whether Defendants have legitimately asserted the loss of a privilege or immunity absent immediate appeal. See, e.g., Evans v. United States Auto. Ass’n, 142 N.C. App. 18, 24, 541 S.E.2d 782, 786 (holding an interlocutory discovery order was immediately appealable after determining the appellants’ assertion of privilege was neither frivolous nor insubstantial and that the privilege would be lost absent immediate review).

Defendants made their specific objections on privilege and immunity grounds early and often. In their responses to Plaintiffs’ requests for production of documents, Defendants particularized these objections to specific requests. When Plaintiffs first identified deficiencies in Defendants’ document production, Defendants responded that they would be “re-running all . . . discovery key word searches” but would require “some time to review [any newly discovered documents] for potential privilege issues before some documents will be produced.” Although we do not have a transcript of the hearing before Judge Sasser, Defendants communicated to Plaintiffs during the

- 15 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court proposed order drafting process that any forensic examination protocol and protective order would need to protect privileged information, as they did not “think [Judge Sasser] ordered disclosure of attorney/client or work product material.”

After Plaintiffs filed their combined motion to compel and motion for sanctions, Defendants filed a response objecting to the protocol because it “would require wholesale production of all of FTCC’s attorney/client privileged information to the Plaintiffs’ forensic agent.” (emphasis in original). Defendants likewise lodged that objection in a letter to Plaintiffs requesting certain changes to the protocol as proposed. Defendants also raised their privilege concerns directly with the trial court at the hearing on Plaintiffs’ combined motion to compel and for sanctions. Plaintiffs have never disputed that the forensic search and creation of the Search Images would capture potentially privileged information; to the contrary, they have simply argued that the protocol protects those privileged documents from production. Defendants’ particularized, continuous, and timely objections do not appear frivolous from this record, especially when Plaintiffs do not deny the possibility that the forensic search will capture privileged information.

It also appears that Defendants’ privileges will be lost absent immediate appeal. The Protocol Order requires the indiscriminate production of Defendants’ entire computer system via the Search Images to Plaintiffs’ expert, a process which, as explained infra, immediately violates Defendants’ privilege interests. As a result,

- 16 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court Defendants’ meritorious and substantial objections will be lost absent immediate review, and the Protocol Order constitutes an interlocutory order affecting a substantial right subject to immediate appeal. See Sharpe, 351 N.C. at 166, 522 S.E.2d at 581; K2 Asia Ventures, 215 N.C. App. at 446, 717 S.E.2d at 4; Sessions, 248 N.C. App. at 381, 789 S.E.2d at 853. B. Standard of Review

Discovery orders compelling production and applying the attorney-client privilege and work-product immunity are subject to an abuse of discretion analysis. Sessions, 248 N.C. App. at 381, 789 S.E.2d at 853-54. “Under an abuse of discretion standard, this Court may only disturb a trial court’s ruling if it was manifestly unsupported by reason or so arbitrary that it could not have been the result of a reasoned decision.” Id. at 381, 789 S.E.2d at 854 (citation and internal quotation marks omitted). “When discretionary rulings are made under a misapprehension of the law, this may constitute an abuse of discretion.” Gailey v. Triangle Billiards & Blues Club, Inc., 179 N.C. App. 848, 851, 635 S.E.2d 482, 484 (2006) (citations omitted). C. eDiscovery Orders and the Protection of Privilege

We write on a relatively blank slate regarding privileges in the forensic imaging and eDiscovery context. As our Business Court has observed, “North Carolina case law addressing problems inherent in electronic discovery, including

- 17 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court waiver arising from inadvertent disclosure of privileged information, is not yet well developed.” Blythe v. Bell, 2012 NCBC 42, 2012 WL 3061862, at *8 (N.C. Super. Ct. July 26, 2012).

North Carolina authority regarding eDiscovery is bare bones, generally providing that “discovery of [ESI] stands on equal footing with discovery of paper documents.” N.C. R. Civ. P. 34, Comment to the 2011 Amendment (2017); see also N.C. R. Civ. P. 26(b) (defining ESI and including it within the scope of discovery subject to the same privileges as paper documents).

No statute, procedural rule, or decision by this Court or the North Carolina Supreme Court has delineated the parameters of eDiscovery protocols with respect to the protection of documents and information privileged or otherwise immune from discovery.

Just as a producing party is responsible for collecting, reviewing, and producing responsive paper documents, it is generally understood that “[r]esponding parties are best situated to evaluate the procedures, methodologies, and technologies appropriate for preserving and producing their own electronically stored information.” Principle 6, Sedona Principles at 118. It behooves a responsive party’s attorneys, then, to engage with opposing counsel and jointly develop a mutually agreeable means of conducting eDiscovery when it is clear that litigation will involve ESI. See, e.g., Comment 3.b., Sedona Principles at 76-78 (noting that cooperation and

- 18 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court agreement on eDiscovery may reduce costs and expedite discovery for both parties while avoiding “expensive motion practice, which may lead to undesirable court orders”); N.C. R. Civ. P. 26(f) (providing a mechanism for discovery conferences to address production of ESI); N.C. R. Bus. Ct. 10.2-.³ (requiring a discovery conference that includes discussion of eDiscovery and detailing issues that should be addressed via an ESI production protocol).

Absent controlling authority directly on point, we consider decisions by courts in other jurisdictions as well as the universally persuasive authority, common sense.

Forensic imaging of a recalcitrant responding party’s computers is one method of resolving a dispute over ESI. See, e.g., Feeassco, LLC v. Steel Network, Inc., ___ N.C. App. ___, ___, 826 S.E.2d 202, 209 (2019) (holding a trial court did not abuse its discretion in ordering an onsite audit of the producing party’s electronic sales and accounting systems for potentially responsive ESI by an independent auditor when the producing party conceded it had failed to comply with discovery requests). However, as has been recognized by various state and federal courts, “[a] Court must be mindful of the potential intrusiveness of ordering forensic imaging.” Wynmoor Community Council, Inc. v. QBE Ins. Co., 280 F.R.D. 681, 687 (S.D. Fla. 2012) (citing Bennett v. Martin, 186 Ohio App.3d 412, 425, 928 N.E.2d 763 (10th District 2009)); see also In re Ford Motor Co., 345 F.3d 1315, 1317 (11th Cir. 2003) (vacating the district court’s order to provide the requesting party unlimited, direct access to the

- 19 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court responding party’s databases without any protocol for the search, including no search terms, and finding that direct access is not permissible without a factual finding of non-compliance with discovery rules); Exec. Air Taxi Corp. v. City of Bismarck, 518 F.3d 562, 569 (8th Cir. 2008) (holding that the district court did not abuse its discretion in declining to order a forensic analysis of a computer because the responding party had provided all relevant documents in hard copy and forensic discovery could disclose privileged documents).9

Forensic examinations of ESI may be warranted when there exists some factual basis to conclude that the responding party has not met its duties in the production of discoverable information. Feeassco, ___ N.C. App. at ___, 826 S.E.2d at 209; see also N.C. R. Civ. P. 34, Comment to the 2011 Amendment (“If a party that receives produced information claims that it needs . . . access to the full database or system that generated the information, the question of . . . direct access will turn on whether the requesting party can show that there is some specific reason, beyond general suspicion, to doubt the information and that the burden of providing direct access is reasonable in light of the importance of the information and the circumstances of the case.”); Wynmoor Community Council, 280 F.R.D at 687 (allowing forensic imaging to recover potentially responsive deleted documents when

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court of produced documents solely because other protective and clawback orders entered in the case “protect any inadvertently produced privileged documents from waiver and any nonrelevant documents from use or disclosure outside this litigation”).11

A court-ordered eDiscovery protocol, no matter how protective of a party’s confidences, may result in the production of privileged information. See, e.g., Adair 2012 WL 2526982 at *⁴ (“To be sure, there is the potential for privileged or nonrelevant documents to slip through the cracks and be turned over to the other side.”). Federal district courts may turn to Rule 502(d) of the Federal Rules of Evidence to resolve the issue, which expressly permits “[a] federal court [to] order that the privilege or protection is not waived by disclosure connected with the litigation pending before the court—in which event the disclosure is also not a waiver in any other federal or state proceeding.” Fed. R. Evid. 502(d) (2019). North Carolina’s Rules of Evidence and Rules of Civil Procedure contain no direct analog, however; thus, litigants in our courts may wish to agree to protective orders to address additional privilege concerns when a forensic examination has been ordered. See N.C. R. P. C. 1.6(c) (2017) (“A lawyer shall make reasonable efforts to prevent the

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

(1) the relation of attorney and client existed at the time the communication was made, (2) the communication was made in confidence, (3) the communication relates to a matter about which the attorney is being professionally consulted, (4) the communication was made in the course of giving or seeking legal advice for a proper purpose although litigation need not be contemplated and (5) the client has not waived the privilege.

In re Miller, 357 N.C. 316, 335, 584 S.E.2d 772, 786 (2003). “[T]he [attorney-client] privilege belongs solely to the client.” Id. at 338-39, 584 S.E.2d at 788. Critically, it is the client’s alone to waive, for “[i]t is not the privilege of the court or any third party.” Id. at 338, 584 S.E.2d at 788 (citations and quotation marks omitted) (emphasis in original). Compulsory, involuntary disclosure may be ordered only “[w]hen certain extraordinary circumstances are present” and some applicable exception, such as the crime-fraud exception, apply. Id. at 335, 584 S.E.2d at 786.

Work-product immunity, which “protects materials prepared in anticipation of litigation from discovery,” Sessions, 248 N.C. App. at 383, 789 S.E.2d at 855, is also subject to a particularized test that asks:

Whether, in light of the nature of the document and the factual situation in the particular case, the document can fairly be said to have been prepared or obtained because of the prospect of litigation. But the converse of this is that even though litigation is already in prospect, there is no work product immunity for documents prepared in the regular course of business rather than for purposes of the litigation.

- 25 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court Cook v. Wake Cnty. Hosp. Sys., Inc., 125 N.C. App. 618, 624, 482 S.E.2d 546, 551 (1997) (emphasis omitted). This immunity, too, is waivable. See, e.g., State v. Hardy, 293 N.C. 105, 126, 235 S.E.2d 828, 841 (1977) (holding work-product immunity is waived when a party seeks to introduce its counsel’s work-product into evidence). Information covered by the doctrine may nonetheless be discovered if the requesting party demonstrates a “substantial need of the materials” and “is unable without undue hardship to obtain the substantial equivalent of the materials by other means.” N.C. R. Civ. P. 26(b)(3).

Both the work-product immunity and attorney-client privilege are subject to statutory modification. See, e.g., N.C. Gen. Stat. §§ 132-1.1 and 132-1.9 (2017) (altering the application and availability of attorney-client privilege and work-product immunity in the public records context). But neither statute nor caselaw has provided any parameters for eDiscovery protocols in these respects. E. The Protocol Order

This appeal does not, at its core, turn on the appropriateness of the Forensic Examination Order. Defendants have not appealed that order, nor do they present any argument that a forensic examination was inappropriate. As is the case with many discovery disputes, we have little doubt that information pertinent to Defendants’ conduct in discovery did not make its way into the printed record before us; Judge Sasser, as a judge of the trial division tasked with overseeing the discovery,

- 26 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court was well positioned to review the conduct of the parties before him—whether dilatory or otherwise—and determine in his discretion that the purposes of discovery were best served by entry of the Forensic Examination Order. Similarly, Judge Tally was in the best position to determine that, although sanctions were not appropriate, a court ordered protocol that weighed Plaintiffs’ discovery needs more heavily than Defendants’ was warranted. Although we ultimately vacate the Protocol Order for the reasons stated infra, this opinion should not be read on remand as questioning the necessity of either the Forensic Examination Order or entry of a protocol order favorable to Plaintiffs’ interests. See, e.g., Capital Resources, LLC v. Chelda, Inc., 223 N.C. App. 227, 234, 735 S.E.2d 203, 209 (2012) (“It is well-established that, because the primary duty of a trial judge is to control the course of the trial so as to prevent injustice to any party, the judge has broad discretion to control discovery.” (citations and quotation marks omitted)).

We identify error in two interrelated provisions of the Protocol Order. First, it allows Plaintiffs’ expert, rather than an independent third party, the authority to directly access and image the entirety of Defendants’ computer systems absent regard for Defendants’ privilege. Second, it orders the delivery of responsive documents to Plaintiffs without allowing Defendants an opportunity to review them for privilege. In both instances, the protocol compels an involuntary waiver, i.e., a violation of Defendants’ privileges. Because North Carolina law is clear, albeit only in the analog

- 27 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court discovery context until now, that a court cannot compel a party to waive or violate its own attorney-client privilege absent some prior acts constituting waiver or an applicable exception, In re Miller, 357 N.C. at 333-35, 584 S.E.2d at 786-87, those two provisions of the Protocol Order were entered under a misapprehension of the law constituting an abuse of discretion. Because production of information subject to the work-product immunity can only be compelled upon a showing of substantial need and undue hardship, N.C. R. Civ. P. 26(b)(3), requiring the production of any work-product documents to Mr. Walton and Plaintiffs without any such showing is similarly improper.

The Protocol Order, as recounted supra, describes Mr. Walton as “Plaintiffs’ expert[.]” Plaintiffs have acknowledged that Mr. Walton is their agent and not Defendants’, and conceded at oral argument that appointment of a special master would be “more neutral” than the present arrangement. Further, although Plaintiffs were unsure whether an attorney-client relationship exists between themselves and Mr. Walton, retaining an attorney as an eDiscovery expert provides the opportunity for creation of an attorney-client relationship. See, e.g., Jay E. Grenig et al., Electronic Discovery & Records & Information Management Guide: Rules, Checklists, and Forms § 8:3 (2018-2019 ed.) (“Perhaps one of the key and often overlooked benefits of e-discovery counsel is the protection of the attorney-client and work-product privileges, as well as the e-discovery counsel’s ability to offer legal advice.

- 28 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court Vendors who sell e-discovery products often offer consulting services with the products, but are prohibited from offering legal advice. While the advice of consultants may not be protected, legal advice from e-discovery counsel will have the protection of privilege.”).13

The Protocol Order tasks Mr. Walton with creating the Search Images, which contain all of FTCC’s data, by mirror imaging FTCC’s systems. The order provides for him to take those Search Images to his own office and conduct a forensic examination of those images pursuant to the protocol over the course of three weeks. A comparable protocol for a paper production would allow Plaintiffs’ expert to photocopy all of Defendants’ documents (including those in their in-house counsel’s file cabinets), take those copies off-site, and then review those files for responsive documents, both privileged and non-privileged, without Defendants having had an opportunity to conduct their own review of those copies first. Such a process would violate Defendants’ attorney-client privilege as a disclosure to the opposing party. See, e.g., Industrotech Constructors, Inc. v. Duke University, 67 N.C. App. 741, 743, 314 S.E.2d 272, 274 (1984) (“It is well established in this state that even absolutely

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court to the requesting party); Wynmoor Community Council, 280 F.R.D at 688 (providing for the same).

The singular case identified by Plaintiffs in which no prior review was allowed, Adair, is immediately distinguishable because it did not involve a compulsory forensic examination by the requesting party or its agent. Adair instead involved an order compelling the responding party to produce certain documents through a protocol imposed on it by the trial court. Adair, 2012 WL 2526982 at *2-3. Also, the parties in Adair had entered into both a clawback order and a protective order to avoid waiver. The clawback order provided that “[t]he producing party is specifically authorized to produce Protected Documents without a prior privilege review, and the producing party shall not be deemed to have waived any privilege or production in not undertaking such a review.” Id. at *1. The protective order prohibited use of the documents in any other action and designated all documents produced under the court’s order as confidential. Id. at *4, n.⁶. In ordering a production without prior privilege review, the district court wrote that “this approach would not be appropriate without the existence of the Protective Order and Clawback Order.” Id. at *4.

Although the parties in this case did enter into the Protective Order, unlike the protective order in Adair, it does not apply to all documents produced pursuant to the Protocol Order. Instead, it contemplates the parties having an opportunity to designate a document as “confidential” at the time of production—an opportunity that

- 32 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court is denied to Defendants under the automatic production of the Keyword Search Hits by Mr. Walton to Plaintiffs pursuant to the Protocol Order. And, although the Protective Order allows for a clawback of privileged documents, it does not contain the language, relied on by the court in Adair, providing that production of documents without prior privilege review would not constitute a waiver. Instead, the clawback here applies only to privileged documents produced “through inadvertence, error or oversight,” and it is not immediately clear whether production of any privileged information not captured in the Privilege Search Hits and delivered to Plaintiffs as part of the Keyword Search Hits would fall within that language.¹⁵ Assuming arguendo that such a production would be inadvertent and subject to the clawback provision’s language, the Protocol Order nevertheless compels Defendants to violate their privilege as to any documents given to Mr. Walton and Plaintiffs that are not

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court responsive documents without providing Defendants an opportunity to examine them for privilege. If, following that continued violation, Plaintiffs—their agent notwithstanding—receive privileged documents, Defendants must attempt to clawback that information, reducing their privilege to a post-disclosure attempt at unringing the eDiscovery bell. Such compelled disclosure of privileged information is contrary to our law concerning both attorney-client privilege and work-product immunity. Cf. In re Miller, 357 N.C. at 333-35, 584 S.E.2d at 786-87; N.C. R. Civ. P. 26(b)(3). As a result, we hold the trial court misapprehended the law concerning attorney-client privilege and the work-product immunity (however understandably given its undeveloped state within the eDiscovery arena), vacate the Protocol Order, and remand for further proceedings. F. Disposition on Remand

Because we recognize the complexity of privilege in the eDiscovery context, and given the extensive investment of time and resources by the parties and the trial court to date, we identify several nonexclusive ways in which the trial court could resolve the discovery dispute in light of this decision.

First, the trial court may wish to employ a special master or court-appointed independent expert—such as Mr. Walton, provided his agency relationship to

- 35 -

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court Plaintiffs is severed—to perform the forensic examination as an officer of the court 16 consistent with the cases cited by Plaintiffs on appeal. Bank of Mongolia, 258 F.R.D. at 521; Wynmoor Community Council, 280 F.R.D at 688. Such an appointment appears to be the commonly accepted approach in other jurisdictions and is consistent with the recommendations of the leading treatises on eDiscovery. See, e.g., Comment 10.e., Sedona Principles at 152-53 (noting that forensic examination orders “usually should provide that either a special master or a neutral forensic examiner undertake the inspection”). And, by restricting the expert’s relationship to that of an independent agent of the trial court, Defendants can safely disclose any and all privileged information to him without endangering confidentiality. Cf. In re Miller, 357 N.C. at 337, 584 S.E.2d at 787 (noting that privileged information disclosed to the trial court for in camera review “retains its confidential nature”).

Second, the trial court may wish to provide Defendants with some opportunity, however expedited given the position of the case, to review the Keyword Search Hits prior to production to Plaintiffs. Such an approach is, again, consistent with both the cases dealing with forensic examinations cited by Plaintiffs on appeal and pertinent commentaries on eDiscovery. Bank of Mongolia, 258 F.R.D. at 521; Wynmoor Community Council, 280 F.R.D at 688. See, e.g., Comment 6.d., Sedona Principles at

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

CROSMUN V. TRUSTEES OF FAYETTEVILLE TECHNICAL COMMUNITY COLLEGE

Opinion of the Court

Footnotes

[1] Appellate courts are generally inoculated from directly engaging in discovery by virtue of their distance from pre-trial proceedings. Cf. Barnette v. Woody, 242 N.C. 424, 430, 88 S.E.2d 223, however—even one dismissed as irrelevant by the withholding party—may be considered a “smoking gun” to the party seeking its disclosure. Our discovery rules “facilitate the disclosure prior to trial of any unprivileged information that is relevant and material to the lawsuit so as to permit the narrowing and sharpening of the basic issues and facts that will require trial,” Am. Tel. & Tel. Co. v. Griffin, 39 N.C. App. 721, 726, 251 S.E.2d 885, 888 (1979), and are designed to encourage the “expeditious handling of factual information before trial so that critical issues may be presented at trial unencumbered by unnecessary or specious issues and so that evidence at trial may flow smoothly and objections and other interruptions be minimized.” Willis v. Duke Power Co., 291 N.C. 19, 34, 229 S.E.2d 191, 200 (1976). These vital purposes are no less present when electronic discovery (“eDiscovery”) is concerned; in many instances, their importance is heightened.2 Electronically stored information, or ESI, “has become so pervasive that the volume of ESI involved in most cases dwarfs the volume of any paper records. This makes ESI the driving force behind the scope of preservation and discovery 227 (1955) (“[I]t would require a tedious and time-consuming voyage of discovery for us to ascertain upon what the appellant is relying to show error, and our Rules and decisions do not require us to make any such voyage.”).

[2] Also no less present in eDiscovery is the monotony of document review. See, e.g., Lola v. Skadden, Arps, Slate, Meagher & Flom LLP, 620 Fed. App’x 37, 45 (2d Cir. 2015) (interpreting North Carolina law and holding that a California attorney, unlicensed in North Carolina, was not engaged in the practice of law in this State when he served as a contract attorney sorting electronic documents into categories devised by trial counsel, as he “exercised no legal judgment whatsoever” and “provided services that a machine could have provided”). -2- requirements in many cases[.]” The Sedona Principles, Third Edition: Best Practices, Recommendations & Principles for Addressing Electronic Document Production, 19 Sedona Conf. J. 1, 56 (2018) (hereinafter the “Sedona Principles”);3 see also Analog Devices, Inc. v. Michalski, 2006 NCBC 14, 2006 WL 3287382, at *5 (N.C. Super. Ct. Nov. 1, 2006) (“It is an inescapable fact that ninety-nine percent of all information being generated today is created and stored electronically. That fact may be shocking to judges who still find themselves buried in paper, but even our court systems are moving, albeit reluctantly, into the age of technology.” (citation omitted)).4

[3] The Sedona Principles, first published in 2004, seek to “serve as best practice recommendations and principles for addressing ESI issues in disputes—whether in federal or state court, and whether during or before the commencement of litigation.” Sedona Principles at 29. They were drafted and published by The Sedona Conference, “a 501(c)(3) research and educational institute that exists to allow leading jurists, lawyers, experts, academics, and others at the cutting edge of issues in the areas of antitrust law, complex litigation, and intellectual property rights, to come together in conferences and mini-think tanks . . . to engage in true dialogue—not debate—in an effort to move the law forward in a reasoned and just way.” Id. at 8. The Sedona Principles and other publications of The Sedona Conference have been relied upon by federal and state courts nationwide, including North Carolina’s trial courts. See, e.g., Country Vintner of North Carolina, LLC v. E. & J. Gallo Winery, Inc., 718 F.3d 249 (4th Cir. 2013) (relying on a glossary of eDiscovery terms published by The Sedona Conference); Race Tires America, Inc. v. Hoosier Racing Tire Corp., 674 F.3d 158 (3d Cir. 2012) (citing various publications of The Sedona Conference concerning eDiscovery); John B. v. Goetz, 531 F.3d 448, 460 (6th Cir. 2008) (relying in part on the Sedona Principles in setting aside a trial court’s orders compelling forensic imaging of the defendants’ computer hard drives where the orders “fail[ed] to account properly for the significant privacy and confidentiality concerns present”); In re Queen’s University at Kingston, 820 F.3d 1287 (Fed. Cir. 2016) (citing a publication of The Sedona Conference on ESI retention); In re State Farm Lloyds, 520 S.W.3d 595, 60 Tex. Sup. Ct. J. 1114 (2017) (utilizing the Sedona Principles to resolve an eDiscovery issue governed by Texas law); Tumlin v. Tuggle Duggins, P.A., 2018 NCBC 49, 2018 WL 2327022, at *10 (N.C. Super. Ct. May 22, 2018) (relying on the Sedona Principles to determine whether sanctions for spoliation in eDiscovery were proper).

[4] Our Supreme Court, recognizing the continuous stream of cases involving ESI in the North Carolina Business Court, has promulgated a series of Business Court rules expressly requiring counsel to discuss ESI with their clients and conduct a conference with the opposing party to fashion an ESI production protocol. N.C. R. Bus. Ct. 10.2-.8 (2019). -3- Despite the general disdain of courts for discovery disputes, in the words of Dorothea Dix, “[a]ttention to any subject will in a short time render it attractive, be it ever so disagreeable and tedious at first.” Dorothea L. Dix, Conversations on Common Things; Or, Guide to Knowledge. With Questions. For the Use of Schools and Families. 270 (4th ed. 1832). This appeal presents this Court with our first opportunity to address the contours of eDiscovery within the context of North Carolina common and statutory law regarding the attorney-client privilege and work- product doctrine. Defendants appeal from an order compelling discovery that allows Plaintiffs’ discovery expert access to Fayetteville Technical Community College’s (“FTCC”) entire computer system prior to any opportunity for Defendants to review and withhold documents that contain privileged information or are otherwise immune from discovery. Defendants argue that the order compelling discovery constitutes an impermissible involuntary waiver of those privileges.5 Plaintiffs argue that the trial court’s order, in conjunction with a stipulated protective order consented to by the parties, adequately protects Defendants’ privileges such that no waiver will occur. After careful review, we hold that the trial court abused its discretion by compelling

[5] We recognize that the work-product doctrine is “not a privilege, but a ‘qualified immunity.’ ” Evans v. United Serv. Auto. Ass’n, 142 N.C. App. 18, 28, 541 S.E.2d 782, 788 (2001) (quoting Willis v. Power Co., 291 N.C 19, 35, 229 S.E.2d 191, 201 (1976)). Because the issues raised in this appeal require no analysis differentiating attorney-client privilege and work-product immunity, to avoid confusion and for ease of reading, we use the word “privilege” broadly to encompass both traditional privileges, such as attorney-client privilege, and the qualified work-product immunity. -4- production through a protocol that provides Plaintiffs’ agent with direct access to potentially privileged information and precludes reasonable efforts by Defendants to avoid waiving any privilege. We therefore vacate the order and remand for further proceedings not inconsistent with this opinion. I. FACTUAL AND PROCEDURAL HISTORY Plaintiffs, who are former employees of FTCC, filed suit against Defendants on 7 December 2016, alleging retaliatory dismissals from FTCC in violation of the North Carolina Whistleblower Protection Act. See N.C. Gen. Stat. § 126-84 (2017). One week later, Plaintiffs’ counsel mailed a letter to each Defendant concerning the complaint and informing them of their obligation to preserve ESI in light of the litigation. As the action advanced to discovery, Plaintiffs served two sets of interrogatories and requests for production of documents on Defendants in April and October of 2017. Defendants responded to both sets of discovery requests but objected to certain requests based on attorney-client, attorney work-product, and state and federal statutory privileges. In January 2018, Plaintiffs served Defendants with a third set of interrogatories and requests for production; Plaintiffs also mailed Defendants’ counsel a letter asserting their discovery responses were incomplete and expressing concern that Defendants had destroyed responsive ESI. In February 2018, Defendants’ counsel responded by letter denying any spoliation, rejecting Plaintiffs’ -5-

[6] The protocol provided to and adopted by the trial court was not drafted solely by Mr. Walton; rather, it appears from the hearing transcript that Mr. Walton provided certain model protocols for use by Plaintiffs’ counsel, who then crafted the protocol with input from Mr. Walton. -8- (1) Mr. Walton would physically access, either at his offices or at FTCC, all FTCC devices on which responsive material might be found or from which responsive material may have been deleted; (2) From those devices, Mr. Walton would create searchable mirror images7 and keep those images in his custody (the “Search Images”); (3) Mr. Walton would run search terms “and other search parameters” desired by Plaintiffs through the Search Images to identify responsive data (the “Keyword Search Hits”); (4) Mr. Walton would then remove non-user and other non-responsive system files from the Keyword Search Hits consistent with standard computer forensics practice; (5) Using six search terms identified by Plaintiffs in their proposed protocol, Mr. Walton would then screen out any potentially privileged documents from the Keyword Search Hits (the “Privilege Search Hits”); (6) Mr. Walton would immediately deliver those documents not flagged in the Privilege Search Hits to Plaintiffs for their review, while Defendants would review the Privilege Search Hits and create a privilege log for all items in the Privilege Search Hits that they believed to be privileged; (7) Finally, Defendants would provide Plaintiffs with the privilege log and any documents from the Privilege Search Hits that Defendants determined were not actually subject to a privilege. Plaintiffs also submitted a proposed stipulated protective order to Defendants on 24 May 2018. By 4 June 2018, Defendants had not responded to the protocol or followed up with Plaintiffs about the joint protective order. Plaintiffs filed a combined motion to

[7] In eDiscovery parlance, a “mirror image” is “[a] bit by bit copy of any storage media. Often used to copy the configuration of one computer to anther [sic] computer or when creating a preservation copy.” The Sedona Conference Glossary: E-Discovery & Digital Information Management (Fourth Edition), 15 Sedona Conf. J. 340 (2014) (citation omitted). -9- compel and motion for sanctions requesting that the trial court: (1) adopt the proposed protocol; (2) enter the proposed protective order; (3) shift the costs of discovery to Defendants; and (4) as a sanction for Defendants’ alleged violation of prior court orders, award Plaintiffs their attorneys’ fees incurred in obtaining the discovery. On the same day Plaintiffs filed the combined motion, Defendants faxed a letter objecting to the protocol, noting that their “main concern still lies with the improper protection of files that could be potentially privileged. . . . It is FTCC’s position that none of the documents . . . may be viewed by anyone who is not part of the FTCC privilege [group] prior to the files being reviewed and approved by FTCC.” Defendants also attached a red-lined version of the protocol identifying various provisions that they believed endangered their privileges. The parties appeared before the trial court for a hearing on Plaintiffs’ combined motion on 11 June 2018. They presented a stipulated protective order (the “Protective Order”) for entry by the trial court. The Protective Order covers personnel and any other information “generally treated as confidential[,]” and, if designated confidential upon production or within 21 days of discussion in deposition testimony, precludes dissemination of that information to outside parties except as necessary to the litigation. It also addresses, in limited respects, the production of privileged information as follows: - 10 -

[8] On appeal, Plaintiffs argue that the specific systems listed in the order granting the stay are the only systems subject to forensic examination under the Protocol Order. This does not appear to be the case, however, as neither the Forensic Examination Order nor the Protocol Order contains any such limit, and the stay does not modify the prior orders. The record reflects that Plaintiffs rejected Defendants’ request to include such a limit in their proposed order submitted to Judge Sasser, which was later entered as the Forensic Examination Order. Applying their plain language, we interpret both the Forensic Examination and Protocol Orders as requiring a complete imaging of all of Defendants’ systems. - 12 - Interlocutory orders, or those orders entered in the course of litigation that do not resolve the case and leave open additional issues for resolution by the trial court, are ordinarily not subject to immediate appeal. Sessions v. Sloane, 248 N.C. App. 370, 380, 789 S.E.2d 844, 853 (2016). Such orders are appealable, however, “when the challenged order affects a substantial right of the appellant that would be lost without immediate review.” Campbell v. Campbell, 237 N.C. App. 1, 3, 764 S.E.2d 630, 632 (2014) (citations and quotations omitted). That said, “[a]n order compelling discovery is interlocutory in nature and is usually not immediately appealable because such orders generally do not affect a substantial right.” Sessions, 248 N.C. App. at 380, 789 S.E.2d at 853 (citing Sharpe v. Worland, 351 N.C. 159, 163, 522 S.E.2d 577, 579 (1999)). An interlocutory order compelling discovery affects a substantial right when “a party asserts a statutory privilege which directly relates to the matter to be disclosed under an interlocutory discovery order, and the assertion of such privilege is not otherwise frivolous or insubstantial[.]” Sharpe, 351 N.C. at 166, 522 S.E.2d at 581. This rule applies to attorney work-product immunity and common law attorney-client privilege. See, e.g., K2 Asia Ventures v. Trota, 215 N.C. App. 443, 446, 717 S.E.2d 1, 4 (2011) (holding an interlocutory order requiring production over the producing party’s objections on attorney-client privilege and work-product immunity grounds affected a substantial right subject to immediate appeal). - 13 -

[9] The Sedona Principles likewise caution that “[i]nspection of an opposing party’s computer system under Rule 34 [of the Federal Rules of Civil Procedure] and state equivalents is the exception and not the rule for discovery of ESI.” Comment 6.d., Sedona Principles at 128. - 20 - the producing party was “either unwilling or unable to conduct a search of their computer systems for documents responsive to . . . discovery requests”). Even when a forensic examination is proper and necessary, any protocol ordered must take into account privileges from production that have not been waived or otherwise lost. Broadly speaking, courts ordering forensic examinations should be mindful of: a) revealing trade secrets; b) revealing other highly confidential or private information, such as personnel evaluations and payroll information, properly private to individual employees; c) revealing confidential attorney-client or work-product communications; d) unreasonably disrupting the ongoing business; e) endangering the stability of operating systems, software applications, and electronic files if certain procedures or software are used inappropriately; and f) placing a responding party’s computing systems at risk of a data security breach. Comment 6.d., Sedona Principles at 128-29.10 As the Sixth Circuit has observed, “even if acceptable as a means to preserve electronic evidence, compelled forensic imaging is not appropriate in all cases, and courts must consider the significant

[10] These interests are certainly present in this case, as FTCC maintains significant amounts of personal data concerning its students that are subject to FERPA requirements. - 21 - interests implicated by forensic imaging before ordering such procedures.” John B., 531 F.3d at 460 (citation omitted). To resolve these concerns, it is recommended that a trial court’s chosen forensic examination protocol: “(1) be documented in an agreed-upon (and/or court-ordered) protocol; (2) recognize the rights of non-parties, such as employees, patients, and other entities; and (3) be narrowly restricted to protect confidential and personally identifiable information and system integrity as well as to avoid giving . . . access to information unrelated to the litigation.” Comment 6.d., Sedona Principles at 129. In every decision cited favorably by Plaintiffs for ordering a forensic examination or other eDiscovery protocol, the trial court also took pains to address at least some of the above concerns. See Bank of Mongolia v. M & P Global Fin. Servs., Inc., 258 F.R.D. 514, 520-21 (S.D. Fla. 2009) (adopting a protocol that contained provisions designed to protect the producing parties’ privileges, including an express holding that production to a court-appointed third-party expert would not constitute waiver and allowing the producing parties to conduct a prior privilege review of all documents to be produced); Wynmoor Community Council, 280 F.R.D. at 687-88 (adopting the Bank of Mongolia protocol while acknowledging the “potential intrusiveness of . . . compelling a forensic examination”); Adair v. EQT Prod. Co., Nos. 1:10CV00037, 1:10CV00041, 2012 WL 2526982, *4 (W.D. Va. June 29, 2012) (ordering an eDiscovery protocol that did not include an opportunity for prior privilege review - 22 -

[11] Adair did not allow the requesting party direct access to the responding party’s systems through a forensic examination, and instead established a protocol by which the responding party would conduct a review of its own ESI. If the district court in Adair had ordered a forensic review by the requesting party without offering the producing party an opportunity to review any eventual production for privilege, it would have been outside the norm, as “courts that have allowed [forensic access] generally have required that . . . no information obtained through the inspection be produced until the responding party has had a fair opportunity to review that information.” Comment 6.d., Sedona Principles at 129. - 23 - inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”). A court ordering a forensic examination should encourage parties to enter into a protective order before requiring a forensic examination “to guard against any release of proprietary, confidential, or personally identifiable ESI accessible to the adversary or its expert [in the course of the forensic examination].” Comment 10.e., Sedona Principles at 152. D. North Carolina Law on Privileges from Production Although the advent of eDiscovery has undeniably altered how discovery is conducted by parties and overseen by courts, it has not thus far influenced North Carolina law regarding privileges.12 Fundamentally, the attorney-client privilege and work-product immunity doctrine attach to ESI in the same manner and to the same extent they apply to paper documents or verbal communications. See, e.g., N.C. R. Civ. P. 26(b)(5) (providing a mechanism for asserting privilege or work-product immunity as to “information otherwise discoverable[,]” which includes ESI under the Rule). Determining whether the common law attorney-client privilege attaches to discoverable information—including ESI—depends on the following five criteria: 12We acknowledge that this may change if and when cases concerning the involuntary disclosure of privileged ESI make their way to our appellate courts. See, e.g., Blythe, 2012 WL 3061862, at *8-14 (discussing in detail inadvertent waiver of privilege in the eDiscovery context). Because no inadvertent disclosure has yet occurred in this case, this particular question of inadvertent waiver under North Carolina common law is not squarely before this Court, and we do not resolve it here. - 24 -

[13] eDiscovery Attorneys are subject to fiduciary and ethical professional standards provided by our common law and the North Carolina Rules of Professional Conduct, including those that require the eDiscovery attorney to place his clients’ interests over his own and those of the opposing party. - 29 - privileged matter may be inquired into where the privilege has been waived by disclosure”). The digital equivalent does so as well.14 Plaintiffs contend that the Protocol Order’s provision for a privilege screen prior to any production from Mr. Walton to Plaintiffs adequately protects Defendants’ privilege. We disagree. The Protocol Order requires Mr. Walton to use search terms to scan the Search Images for any potentially responsive files—the Keyword Search Hits—and then tasks him with searching the Keyword Search Hits with different search terms to identify and segregate potentially privileged files—the Privilege Search Hits. The Protocol Order allows Defendants to review the Privilege Search Hits for privileged documents to withhold under a privilege log, while Mr. Walton would turn over any Keyword Search Hits not identified as Privilege Search Hits directly to Plaintiffs. Plaintiffs argue that because Mr. Walton is prohibited from sharing the Privilege Search Hits with Plaintiffs and Defendants will have an opportunity to review the Privilege Search Hits prior to production, Defendants’ privilege will not be violated. We are unconvinced. While the use of search terms assists in preventing disclosure of privileged materials, it is far from a panacea. “[A]ll keyword searches are not created equal; and there is a growing body of literature that highlights the

[14] Nothing in this opinion should be read to call into question the competency or integrity of Mr. Walton. Our holding would not change no matter who the Plaintiffs had selected to serve as their expert, as the error present in the Protocol Order is a legal one, independent of the individuals tasked with carrying the order out. - 30 - risks associated with conducting an unreliable or inadequate keyword search or relying exclusively on such searches for privilege review.” Victor Stanley, Inc. v. Creative Pipe, Inc., 250 F.R.D. 251, 256-57 (D. Md. May 29, 2008). Selecting the appropriate keywords and search parameters requires special care, as “there are well- known limitations and risks associated with [keyword searches], and proper selection and implementation obviously involves technical, if not scientific knowledge.” Id. at 260 (citations omitted). To determine whether or not selected search terms are adequate to screen for privilege, parties should “test and re-test samples to verify that the search terms used . . . ha[ve] a reasonably acceptable degree of probability of identifying privileged or protected information[,]” Comment 10.g., Sedona Principles at 157, and should “perform some appropriate sampling of the documents determined to be privileged and those determined not to be in order to arrive at a comfort level that the categories are neither over-inclusive nor under-inclusive.” Victor Stanley, Inc., 250 F.R.D. at 257. With one exception, the decisions cited by Plaintiffs in support of the Protocol Order allowed for the producing party to engage in this kind of quality control before any responsive documents identified in the forensic examinations were produced. See Bank of Mongolia, 258 F.R.D. at 521 (allowing the producing party to review the responsive documents identified by keyword search for privilege prior to production - 31 -

[15] The parties disagree on this question, though neither cites any caselaw as to whether a court compelled disclosure constitutes an inadvertent disclosure, either for purposes of the Protective Order or similar clawback language found in N.C. R. Civ. P. 26(b)(5)b. Various federal courts had, prior to enactment of Rule 502 of the Federal Rules of Evidence, held that a court compelled disclosure is an inadvertent production subject to clawback by interpreting and applying Rule 501 of the Federal Rules of Evidence and a proposed rule of evidence that Congress ultimately declined to adopt. See, e.g., Hopson v. Mayor and City Council of Baltimore, 232 F.R.D. 228, 246 (D. Md. 2005) (holding that the federal common law rule of privilege applicable through Rule 501 permitted consideration of the proposed, but never enacted, federal rule concerning court compelled production and concluding such a production would not waive privilege). With the advent of Rule 502, federal courts need not grapple directly with the question any longer, and can simply state in their orders that any disclosure pursuant thereto does not constitute a waiver. Fed. R. Evid. 502(d). North Carolina, however, expressly declined to adopt either Rule 501 as adopted by Congress or the proposed rules Congress rejected, see Official Commentary, N.C. R. Evid. 501 (2017), and our legislature has not yet enacted an equivalent to Federal Rule 502(d). Thus, federal caselaw is of questionable assistance. In any event, the question has not been squarely presented here, as no inadvertent disclosure has yet occurred and it is unclear whether the issue will arise between the parties. We therefore decline to reach that question on the merits. - 33 - contained within the Privilege Search Hits, leaving Defendants with, at best, an imperfect clawback remedy to rectify the compulsory violation. See, e.g., Blythe, 2012 WL 3061862, at *10 (“Protections to guard against privilege cannot be deferred by first addressing the risk of waiver only after a production has been made.”); Parkway Gallery Furniture, Inc. v. Kittinger/Pennsylvania House Group, 116 F.R.D. 46, 52 (M.D. N.C. 1987) (“[W]hen disclosure is complete, a court order cannot restore confidentiality and, at best, can only attempt to restrain further erosion.”). Under the circumstances presented here, the Protective Order is inadequate to protect Defendants’ privilege, and it does not avoid the compulsory violation of that privilege under the Protocol Order. Cf. In re Dow Corning Co., 261 F.3d 280, 284 (2d Cir. 2001) (“[C]ompelled disclosure of privileged attorney-client communications, absent waiver or an applicable exception, is contrary to well established precedent. . . . [W]e have found no authority . . . that holds that imposition of a protective order . . . permits a court to order disclosure of privileged attorney-client communications. The absence of authority no doubt stems from the common sense observation that such a protective order is an inadequate surrogate for the privilege.”). In short, the Protocol Order provides Plaintiffs’ agent direct access to privileged information, which disclosure immediately violates Defendants’ privileges. It furthers that violation by directing that agent, having attempted to screen some privileged documents out through the use of search terms, to produce potentially - 34 -

[16] Mr. Walton, as a licensed attorney, is already an officer of the court. That status, however, does not inherently deprive him of his agency relationship with Plaintiffs or resolve the privilege issue. Plaintiffs’ attorneys, too, are officers of the court, but disclosure of Defendants’ privileged information to them may nonetheless serve as a waiver of attorney-client privilege and work-product immunity. - 36 - 129 (“[C]ourts that have allowed access [for forensic examinations] generally have required . . . that no information obtained through the inspection be produced until the responding party has had a fair opportunity to review that information.”). In addition, the trial court may wish to order that any documents produced under the protocol adopted are confidential within the meaning of the Protective Order and that any disclosure of privileged information under the protocol is subject to clawback without waiver of any privilege or work-product immunity.17 Provisions such as those outlined here have been recognized by courts in other jurisdictions as sufficient to prevent any compulsory violation of Defendants’ privilege. See, e.g., Playboy Enterprises, Inc. v. Welles, 60 F. Supp. 2d 1050, 1054 (S.D. Cal. 1999) (holding that because the forensic examination would be performed by an independent third party and the producing party would have the opportunity

[17] It may be that this modification alone could, in certain circumstances, be sufficient to protect the producing party’s privilege. We do not resolve the question here, but note that North Carolina’s legislature has not seen fit to adopt analogs to Rules 501 and 502 of the Federal Rules of Evidence that have assisted in addressing the court compelled disclosure of privileged information in the federal courts. Furthermore, we observe that such agreements appear to be generally disfavored as the exclusive means of protecting privilege in most contexts. See Comment 10.e., Sedona Principles at 153-56 (reviewing the drawbacks of clawback or “quick peek” agreements and concluding “[i]t is inadvisable for a fully-informed party to enter a ‘quick peek’ agreement unless either the risks of disclosure of privileged and work-product protected information, as well as commercial and personally sensitive information, are non-existent or minimal, or the discovery deadline cannot otherwise be met . . . and alternative methods to protect against disclosure are not available”). Such agreements, then, are best considered as an additional protective measure rather than the primary prophylactic. Compare N.C. R. Bus. Ct. 10.3(c)(3) (requiring counsel to discuss as part of an ESI protocol methods for designating documents as confidential) and N.C. R. Bus. Ct. 10.5(b) (encouraging parties to agree on implementation of privilege logs to protect privileged information), with N.C. R. Bus. Ct. 10.6 (“The Court encourages the parties to agree on an order that provides for the non-waiver of the attorney- client privilege or work-product protection in the event that privileged or work-product material is inadvertently produced.”). - 37 - to review for privilege prior to any production, their “privacy and attorney-client communications will be sufficiently protected”); Genworth Financial Wealth Mgmt., Inc. v. McMullan, 267 F.R.D. 443, 449 (D. Conn. 2010) (ordering a forensic examination by a neutral, court-appointed expert and allowing the producing party an opportunity to review for privilege prior to production). We cite these cases as examples rather than offering them as the as the exclusive means of resolving the parties’ dispute. The trial court is in the best position to fashion any other or additional provisions not inconsistent with this opinion. All that is required on remand is that the protocol adopted not deprive the Defendants of an opportunity to review responsive documents and assert any applicable privilege, whether that be through the use of the inexhaustive suggestions enumerated above or some other scheme of the trial court’s own devise.18 Cf. Playboy Enterprises, 60 F. Supp. 2d at 1053-54 (noting that discovery of ESI through a forensic examination is permissible but that “[t]he only restriction in this discovery is that the producing party be protected against undue burden and expense and/or invasion of privileged matter”). III. CONCLUSION

[18] Of course, the trial court may also, in its discretion, wish to address other aspects of the protocol not discussed herein, such as the shifting of costs, the manner in which search terms are selected, additional protections for information covered by FERPA, the timeline of production, or the limitation of the search to certain computers, servers, or hard drives. We stress, however, that the trial court need not reinvent the wheel, and the only issue that must be addressed on remand is the avoidance of compulsory waiver and the violation of Defendants’ privilege as described herein. - 38 - For the foregoing reasons, we vacate the Protocol Order for an abuse of discretion and remand for further proceedings not inconsistent with this opinion. VACATED AND REMANDED. Judges STROUD and ZACHARY concur. - 39 -