296 F. Supp. 3d 1230
D. Or.2017Background
- Premera disclosed a cybersecurity breach affecting ~11 million individuals; breach began May 2014 and was publicly revealed March 17, 2015.
- Plaintiffs brought a putative class action alleging Premera delayed notification and asserting state common-law and statutory claims.
- Plaintiffs moved to compel production of documents Premera withheld as attorney-client privileged or work-product, grouped into four categories (drafts incorporating counsel edits; documents prepared at counsel's request; third‑party vendor materials including Mandiant; and documents shared under asserted common‑interest agreements).
- Parties agreed Washington law (for privilege) and federal law (for work product) would govern the discovery disputes; Plaintiffs conceded no material conflict between Oregon and Washington on the privilege issues.
- The court evaluated whether documents were primarily business (discoverable) versus legal (privileged/work product), whether dual‑purpose materials met the "because of" test for work product, and whether common‑interest agreements legitimately prevented waiver.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Scope of attorney‑client privilege for non‑attorney drafts/communications (Category 1) | Premera cannot shield business drafts and communications simply because counsel reviewed them; plaintiffs seek production. | Premera says drafts incorporate counsel edits/are supervised by counsel so privileged. | Court: privilege is narrow; business‑purpose drafts are discoverable. Portions reflecting legal advice (attorney edits/redlines) may be withheld. |
| Documents prepared at counsel's request by non‑attorneys (Category 2) | Plaintiffs: these are routine business materials (PR, notices, remediation) and not privileged or work product. | Premera: documents were requested/overseen by counsel and are protected. | Court: most are business‑function materials and not privileged; work‑product requires showing "would not have been created in substantially similar form but for litigation." Specific documents meeting that showing may be protected. |
| Third‑party vendor reports (Mandiant and others) (Category 3) | Plaintiffs: Mandiant investigation and related vendor work are discoverable because performed for business purposes before counsel involvement. | Premera: Mandiant and other vendors worked for/at direction of counsel, so materials privileged/work product. | Court: Because Mandiant was retained initially by Premera and scope didn't change when counsel later supervised, Premera failed to show blanket protection; specific communications prepared solely for counsel or revealing counsel mental impressions may be withheld. Other vendors depend on their stated scope of work. |
| Common‑interest / joint defense protection for sharing with other carriers (Category 4) | Plaintiffs: sharing with other entities not party to this litigation waived privilege; common interest doesn't apply across different breaches. | Premera: entered common‑interest agreements with other Blue Cross entities and Anthem, so sharing did not waive privilege. | Court: common interest limited to parties with shared liability/common nucleus of operative facts. Agreements covering the same Premera intrusion are valid; sharing with entities regarding separate breaches is not protected. Court ordered production of the agreements. |
Key Cases Cited
- Newman v. Highland Sch. Dist. No. 203, 186 Wash.2d 769 (Wash. 2016) (Washington describes attorney‑client privilege as narrow; does not shield facts even if communicated to counsel)
- Upjohn Co. v. United States, 449 U.S. 383 (U.S. 1981) (corporate privilege may extend to communications from non‑managerial employees where Upjohn factors met)
- U.S. v. Richey, 632 F.3d 559 (9th Cir. 2011) (work‑product "because of" test for dual‑purpose materials)
- Admiral Ins. Co. v. U.S. Dist. Court for the Dist. of Ariz., 881 F.2d 1486 (9th Cir. 1989) (work‑product doctrine protects documents prepared in anticipation of litigation)
- Holmgren v. State Farm Mut. Auto. Ins. Co., 976 F.2d 573 (9th Cir. 1992) (heightened protection for opinion/core work product)
- United States v. Mett, 178 F.3d 1058 (9th Cir. 1999) (discusses "fiduciary exception" concept: trustee may not be the "real client" for plan‑administration advice)