Summary
In Landry v Union Planters Corp. (2003 WL 21355462, *6, 2003 US Dist LEXIS 10553, *20 [ED La, June 6, 2003]), a federal district court found no reason to address the scope of the "legal requirements" or "judicial process" exceptions since it found that the information sought therein did not contain personal identifiers such as account numbers, names, or addresses, and that such "blind data" is not considered "personally identifiable financial information," and, thus, is not defined as nonpublic information protected by the GLBA.
Summary of this case from Alpha Funding v. ContinentalOpinion
CIVIL ACTION NO. 02-3617, SECTION "C" (3).
June 6, 2003.
ORDER AND REASONS
Before the Court is defendants' Motion to Partially Quash Notice of FRCP 30(b)(6) Depositions and FRCP 30(b)(5) Requests for Document Production. Plaintiff's filed an opposition memorandum and the matter was the subject of an oral hearing before the undersigned Magistrate Judge on April 30, 2003. The Court granted the parties' requests for leave to file post-hearing memoranda and, having received those, the matter is now deemed submitted for decision. Having considered the filings of record, the argument of counsel, and the applicable law, the Court rules herein below, finding that the plaintiffs' alternative request that Union Planters Bank provide "blind" and aggregate data and documentation responsive to its request at item no. 2 does not contravene the applicable law or bank customers' rights to financial privacy with respect to "nonpublic information."
I. BACKGROUND
Representatives of the putative class seek to recover damages arising out of the defendants' alleged improper assessment of late fees on residential mortgages with a street address in Louisiana. The lawsuit was originally filed by the plaintiff's in the Twenty-Fourth Judicial District Court for the Parish of Jefferson, but was removed on the basis of "arising under" jurisdiction. 28 U.S.C. § 1331. Plaintiffs' discovery is aimed at satisfying the prerequisites of Rule 23 of the Federal Rules of Civil Procedure governing class action proceedings. Rule 23 requires that the court determine, "as soon as practicable" after an action brought on behalf of a class is commenced, whether the suit meets the class certification requirements such that the case should proceed as a class. A class action is not maintainable as such simply because the lawsuit designates the cause as a class action. It is not disputed that the class action proposed in this case must satisfy the requirements for certification outlined in Rule 23(a) and (b).
See Defendants' Notice of Removal at ¶ 6 (noting that the action involves two federal questions under the Federal Truth in Lending Act and the Federal Fair Debt Collection Practices Act, and thus, the action may be removed pursuant to the provisions of 28 U.S.C. § 1441) [Rec. Doc. No. 1]. Defendants' notice further avers that the court has supplemental jurisdiction over the plaintiffs' breach of contract claims and claims under La. Rev. Stat. § 51:1401, et seq., pursuant to 28 U.S.C. § 1367(a).
See Fed.R.Civ.P. 23(c)(1); Castano v. American Tobacco Company, 84 F.3d 734, 741 (5th Cir. 1996).
In ruling upon a motion for class certification, courts treat the substantive allegations contained in the plaintiffs' complaint as true. The issue is not whether the plaintiff's have stated a cause of action or will prevail on the merits, but rather whether the requirements of Rule 23 are met. The court may look past the pleadings to the record and any other completed discovery to make a determination as to the class certification issue.
Eisen v. Carlisle Jacquelin, 417 U.S. 156, 177-78, 94 S.Ct. 2140, 2153 (1974); see also Burrell v. Crown Central Petroleum, Inc., 197 F.R.D. 284, 286 (E. D. Tex. 2000); and In re Lease Oil Antitrust Litigation, 186 F.R.D. 403, 418 (S.D. Tex. 1999).
See General Telephone Company v. Falcon, 457 U.S. 147, 161, 102 S.Ct. 2364, 2371-72 (1982) (noting the district court's duty to conduct a "rigorous analysis" before granting class certification and holding that a decision on class certification remains a fact specific determination); Spence v. Clock, 227 F.3d 308, 310 (5th Cir. 2000); and Castano v. American Tobacco Co., 84 F.3d 734, 740 (5th Cir. 1996).
At the outset, Rule 23(a) sets forth four threshold requirements which must be met in every type of class action case. Rule 23(a) requires that a class: (1) be so numerous that joinder of all members is impractical [numerosity]; (2) have common questions of fact or law [commonality]; (3) have representative parties with typical claims or defenses [typicality]; and (4) have representative parties and counsel that will fairly and adequately protect the interests of the proposed class [adequacy]. The first two requirements focus on the characteristics of the class; the second two focus instead on the desired characteristics of the class representatives. The rule is designed "to assure that courts will identify the common interests of class members and evaluate the named plaintiffs' and counsel's ability to fairly and adequately protect class interests." If the Rule 23(a) criteria are satisfied, the plaintiff's must show that class treatment is appropriate under one of three alternative class categories prescribed by Rule 23(b). In the absence of proof of all required elements, the court may not certify a class.
See James v. City of Dallas, 254 F.3d 551, 569 (5th Cir. 2001), cert. denied, 122 S.Ct. 919, 151 L.Ed.2d 884 (2002).
See Fed.R.Civ.P. 23(a); Spence v. Glock, 227 F.3d at 310 n. 4; James v. City of Dallas, 254 F.3d at 569.
In re Lease Oil Antitrust Litigation, 186 F.R.D. at 419 (citing In re General Motors Corp. Pick-Up Truck Fuel Tank Litigation, 55 F.3d 768, 799 (3rd Cir. 1995)).
See Fed.R.Civ.P. 23(b); James v. City of Dallas, 254 F.3d at 568.
The defendants in the case at bar do not dispute that the discovery sought is relevant to the class certification issues presented in this case. In order to satisfy the aforesaid requirements, the plaintiff's noticed 30(b)(6) depositions of defendants, Union Planters Mortgage, Inc. and Union Planters and National Association (hereinafter referred to collectively as "Union Planters"). More specifically, putative class representatives seek production of all information relating to notes and loan agreements for individual and/or personal residences with street addresses in Louisiana made or generated or serviced by Union Planters Mortgage Inc., which (1) have payments made after the date of 12/31/95, (2) are secured by a mortgage or trust deed on real estate, and (3) pursuant to which a late fee or penalty was assessed any time after 12/31/95, including, but not limited to: a) the total number of such notes or loan agreements; b) the name and address of each payor or borrower; c) the original and each subsequent payee for each note, mortgage note, or loan agreement; and d) the date that each payment, which as assessed with a late fee was received and the amount each payor was charged. Defendants objected to item no. 2 on the basis that it seeks production of bank customers' "non-public information," arguing that both federal and state law require that its customers be provided notice and the opportunity to either opt-out or opt-in prior to disclosure of any response to the requested discovery. Moreover, defendants suggest that it is appropriate that the plaintiff's bear the expenses associated with compliance with the applicable laws ( i.e., the costs incurred by the defendant banks in complying with opt-in provisions of the federal and state laws governing disclosure of non-public information by financial institutions).
II. CONTENTIONS OF THE PARTIES
Putative class representatives submit that the Gramm-Leach-Bliley Act's opt-out provision, 15 U.S.C. § 6802(b)(1)(B), allows for disclosure of non-public information, if the consumer is given the opportunity to object. According to plaintiff's, the defendants have been given ample opportunity to advise consumers via notice and afford them the opportunity to object or opt out. They further submit that the defendants have failed to present any evidence that even one consumer has objected to the disclosure and that, absent an objection, § 6803(e) authorizes disclosure of non-public information. Additionally, plaintiff's argue that the following exceptions apply, to wit: (1) § 6803(e)(3)(D) authorizes disclosure to persons holding a legal or beneficial interest relating to a consumer and as putative class representatives they have a fiduciary duty with respect to the bank's customers; (2) § 6803(e)(3)(E) authorizes disclosure to persons acting in a fiduciary or representative capacity; and (3) § 6803(e)(8) authorizes disclosure of non-public information to "respond to judicial process."
Alternatively, plaintiff's submit that the defendants can provide "blind" data, deleting references to names, addresses, and account numbers of bank customers, which would ensure the privacy of the payor and borrower and substantially comply with the provisions of the Act. Plaintiff's suggest that it is appropriate for the bank to distinguish between customers by simply numbering them (i.e., Orleans Parish No. 1, Orleans Parish No. 2, Orleans Parish No. 3, . . ., Jefferson No. 1, etc.), and that, the such blind data would be sufficient for purposes of class certification discovery.
Defendants insist that the information sought regarding late payment constitutes non-public information and that plaintiff's must comply the federal and state law regarding disclosure of bank customers' financial information. Union Planters contends that § 6802(b)(1)(B) "opt out" provisions only apply in the context of "initial disclosures." Instead, Union Planters submits that § 6802(b)(2)'s opt-in provision applies to the disclosures sought via discovery request and that the plaintiff's must bear the cost of compliance with that provision of the Act.
La. Rev. Stat. § 6:333(B) provides:
Notwithstanding any other provision of law to the contrary, except R.S. 9:151 et seq., R.S. 13:3921 et seq., Code of Civil Procedure Article 2411 et seq., and R.S. 46:236.1(D)(1)(d), no bank or its affiliate shall disclose any financial records to any person other than the customer to whom the financial records pertain, unless such financial records are disclosed:
(1) In response to a disclosure demand in accordance with the provisions of Subsection C of this Section.
(2) Pursuant to a written request or authorization for disclosure or waiver which meets the requirements of Section E of this Section.
La. Rev. Stat. § 6:333(C) requires that the disclosure demand be personally served upon each customer named in the disclosure demand pursuant to the Louisiana Code of Civil Procedure, whereas La. Rev. Stat. § 6:333(E) permits the use of a less stringent opt-in system, which does not require compliance with La. Code Civ. P. articles 1231 through 1235.
Defendants further argue that putative class representatives' alleged fiduciary duty toward the putative class members does not fall within the exceptions found in §§ 6803(e)(3)(D) and (E), and that the exceptions are premature at this time, or at least until a class is certified. Additionally, defendants submit that the exception § 6803(e)(8) (i.e., judicial process) does not apply to subpoenas issued in private civil litigation for monetary gain.
15 U.S.C. § 6803(e)(8) provides that the notice provisions of the GLBA does not apply when disclosure is necessary:
To comply with Federal, State, or local laws, rules, and other applicable legal requirements; to comply with properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities; to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.
Defendants further aver that plaintiffs' alternative request seeking disclosure of "blind" data/documents does not pass muster. In this vein, Union Planters notes that the GLBA defines "non-public personal financial information," such that it includes "[a]ny list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any nonpublic personal information other than publicly available information." See 15 U.S.C. § 6809(4)(c)(I). Union Planters avers that this definition easily encompasses any information regarding late fees assessed to its customers, regardless of how the information is sanitized.
Essentially, defendants remain steadfast in their contention that only a consent mail-out would comply with GLBA and state law. Union Planters admits that this is a costly method of compliance, but contends that it is the only acceptable method. This Court disagrees for the following reasons.
ANALYSIS
1. Gramm-Leach-Bliley Act (GLBA)
The Federal Financial Modernization Act, commonly known as the Gramm-Leach-Bliley Act ("GLBA") was passed by Congress and signed by President Clinton in November, 1999. The purpose of GLBA was "to enhance competition in the financial services industry by providing a prudential framework for the affiliation of banks, securities, firms, insurance companies, and other financial providers. . . ." H.R. Conf. Rep. No. 106-434, at 245 (1999), reprinted in 1999 U.S.C.C.A.N. 245, 245. To ensure that increased competition would enure to the benefit of consumers, Congress assuaged consumers' concerns regarding dissemination of personal financial information by providing them with the power to choose how their personal information will be shared by financial institutions. The Act states, "It is the policy of Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' non-public information." 15 U.S.C. § 6801. During the debates in Congress, legislators noted that the proposed Act would "provide some of the strongest privacy protections to ever be enacted into any federal law," and would "represent the most comprehensive federal privacy protection ever enacted by Congress."
145 Cong.Rec. H 1, 539-40 (daily ed. Nov. 4, 1999) (statement of Rep. Vento).
145 Cong.Rec. HI 1, 544 (daily ed. Nov. 4, 1999) (statement of Rep. Sandlin).
The GLBA restricts the ability of a "financial institution" to disclose non-public information ("NPI") to a non-affiliated third party by requiring (subject to certain exceptions) that the financial institution provide the consumer with notice of the institutions disclosure policies and the opportunity for the consumer to "opt-out" of disclosure. 15 U.S.C. § 6802(a)-(b), (e). The GLBA further mandates that an unaffiliated third party recipient of NPI "shall not, directly or through an affiliate of such receiving third party, disclose such information to any other person that is a non-affiliated third party of both the financial institution and such receiving third party, unless such disclosure would be lawful if made directly to such other person by the financial institution." Id. at 6802(c).
2. Definition of Nonpublic Information
To implement its disclosure restrictions, the GLBA gives the Federal Trade Commission ("FTC") and other agencies broad rule making authority. See 15 U.S.C. § 6804(a)(1). Federal regulations prescribe the conditions under which financial institutions may disclose nonpublic personal information about consumers to non-affiliated third parties, require such institutions to provide notice to their customers about privacy policies, and subject to certain exceptions, permit the consumer to opt out of the transmission of information. Federal regulations define the limits on the disclosure of nonpublic personal information by financial institutions, define nonpublic personal information, and set out the conditions under which a nonaffiliated third party that receives this information may re-disclose it or use it. See, e.g., 16 C.F.R. § 313.10 — 16 C.F.R. § 313.12 (2000).
Both the GLBA and federal regulations define nonpublic information (NPI) in terms of personally identifiable financial information (PIFI). In 15 U.S.C. § 6809(4)(A), Congress defined non-public information as follows: personally identifiable financial information —
(i) provided by a consumer to a financial institution; —
(ii) resulting from any transaction with th customer or any service performed for a customer; or
(iii) otherwise obtainable by the financial institution.15 U.S.C. § 6809(4)(A). The GLBA provides no definition of PIFI; however, the FTC regulations fill in the gap and provide that "personally identifiable financial information" means any information:
Compare 16 C.F.R. § 313.3(n)(1), the Federal Trade Commission (FTC) regulations, which defines NPI as follows:
(i) Personally identifiable financial information; and
(ii) Any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available.16 C.F.R. § 313.3(n)(1).
(i) A consumer provides to [a regulated financial institution] to obtain a financial product or service from you;
(ii) About a consumer resulting from any transaction involving a financial product or service between [a regulated financial institution] and a consumer; or
(iii) [A regulated financial institution] otherwise obtain[s] about a consumer in connection with providing a financial product or service to that consumer."16 C.F.R. § 313.3( o)(1)(i)-(iii). This regulation provides a number of examples of PIFI, for instance: information a consumer provides on a loan application, account balance information, payment history, overdraft history, the fact that an individual has been or is a client of the financial institution, any information about a consumer if it is disclosed in a manner to indicate that the individual is or has been a consumer of the financial institution, and information from a consumer report, inter alia. See 16 C.F.R. § 313.3( o)(2)(i). The regulation expressly excludes the following from the definition of PIFI, to wit:
(A) A list of names and addresses of customers of an entity that is not a financial institution; and
(B) Information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names or addresses.16 C.F.R. § 313.3( o)(2)(ii) (bolding emphasis added).
See also Trans Union LLC v. Federal Trade Commission, 295 F.3d 42, 50 n. 6 (D.C. Cir. 2002) (upholding the constitutionality of FTC regulations and rejecting plaintiff's argument that the FTC's definition of PIFI is ultra vires because the GLBA does not expressly define the term "publicly available information"). The Trans Union court explained that the term "PIFI" is not without ambiguity, and, given the broad rulemaking authority the GLBA confers upon the FTC and other agencies, the FTC is authorized to define the term and that definition is entitled to deference. Id. (citing 15 U.S.C. § 6804(a)(1) and Chevron USA, Inc. v. Natural Resources Defense Counsel, Inc., 467 U.S. 837, 843-44 (1984)).
For purposes of class certification, discovery plaintiff's submit that blind and/or aggregate information may be sufficient to secure evidence necessary to demonstrate that the prerequisites of Rule 23 are met. More particularly, plaintiff's submit that rather than providing the name and address of the payor or borrower, defendants can simply provide "blind" data i.e., data that does not contain personal identifiers such as account number, names or addresses, and which is instead solely identified by a number and parish of residence (i.e., Orleans Parish No. 1, Orleans Parish No. 2, etc.). The FTC's implementing regulations expressly exclude the provision of such "blind" data from the definition of PIFI. Considering that "non-public information" (NPI) is defined in terms of "personally identifiable information" (PIFI) by the GLBA, the plaintiff's alternative request does not require notice and the opportunity to either "opt-out" or "opt-in" pursuant to the GLBA or Louisiana's financial privacy law. Information and documentation which has been purged of personal identifiers, whether grouped or considered individually, is not "nonpublic information" and its production without notice to the customer is not proscribed by the Act. Redaction of personal identifiers excludes discovery responses sought from the umbrella of protection afforded by the GLBA to certain "nonpublic information" as defined by the Act and federal regulations implementing the Act.
See 15 U.S.C. § 6809(4)(A) (defining non-public information as "personally identifiable financial information — (i) provided by a consumer to a financial institution; (ii) resulting from any transaction with the customer or any service performed for a customer; or (iii) otherwise obtainable by the financial institution").
As the jurisprudence discussing "privacy interests" have recognized, most people do not object solely to the disclosure of personal information. Rather, it is the combination of the personal information with identifying information to which people object. With the elimination of identifying information from the records also goes the privacy interest, for all intents and purposes.
See, e. g., United States of America ex rel. Roberts v. QHG of Indiana, Inc., 1998 WL 1756728 * 8 (N.D. Ind.) (collecting cases holding that as to patient's privacy interests, once identifying information is removed from the record, the patient's privacy interest is essentially eliminated).
The court's decisions in Union Planters Bank, N.A. v. Gavel 2002 WL 975675 (E.D. La. May 9, 2002) (Porteous, J.) and Union Planters Bank, N.A. v. Gavel 2003 WL 1379182 (E.D. La.) are not dispositive of the issues before the undersigned Magistrate Judge. In the Gavel case, Union Planters filed suit in this court seeking an injunctive decree, preventing the bank's agent from responding to a subpoena for certain information regarding (1) the placement or purchase of flood coverage relating to customers of Union Planters, (2) the names, addresses and telephone numbers of any party currently or formerly indebted to Union Planters because of a residential mortgage/deed of trust, and (3) any records showing the mortgage balance.
Unlike the case at bar, the information which Gavel was asked to produce was clearly "nonpublic personal information," falling within the provisions of the GLBA prohibiting disclosure without notice and the opportunity to "opt out." Most notably, in the Gavel case, Union Planters actually offered to contact its customers and, in cooperation with the Salih plaintiff's attorneys, to solicit their consent to the release of personal information. Moreover, in the Gavel litigation, Union Planters did not deprive the Salih plaintiff's of any document sought in discovery. In its Reply in Support of Entry of a Permanent Injunction, Union Planters recounted as follows:
See Defendant Union Planters Reply in Support of Motion for Entry of Permanent Injunction [Rec. Doc. No. 31 in the Gavel, CA No. 02-1224 "T" on the docket of this Court].
It bears repeating that the scope of information covered by the Court's injunction is quite narrow. The Salih plaintiff's have been deprived of no document or deposition as a result of the injunction. As this Court has repeatedly stressed at oral argument, the parties are conducting discovery in an orderly manner in the state court proceeding, unimpaired by the injunction. The only effect of the injunction — critical for federal privacy law purposes, but irrelevant to the Salih plaintiffs' ability to prepare their case for state court — is that, when Union Planters or Mr. Gavel produces volumes of customer-related documents and computer data, personal identification data is redacted. That information has no bearing on the merits of the plaintiffs' allegations. . . .
Id. at p. 3 (emphasis added).
Albeit in the alternative, putative class representatives in the case at bar seek no more than Union Planters produced without objection in the state court proceedings in Gavel, supra, i.e., customer related documents and computer data with the personal identification data redacted. That information ( i.e., personal identification data such as names, addresses, and phone numbers) has no bearing on the merits of the class certification issues.
Louisiana's statute is intended to protect both the customer's privacy and the bank from liability for releasing records regarding specific customer information. Neither goal is implicated here. The customer's privacy is protected by the provision of "blind" information with all personal identifiers redacted. The bank is protected from liability because the "blind" information is being provided pursuant to a federal court order to provide such redacted documentation relevant to the class certification issues.
La.Rev.Stat. § 6:333, as follows:
6:333. Subpoena of records; reimbursement for records produced
A. A bank shall disclose financial records of its customers pursuant to a lawful subpoena, summons, or court order served upon one of the registered agents for service of process of the bank only if the bank is furnished by the person requesting the subpoena, summons, or court order with an affidavit that such subpoena, summons, or court order has also been served upon the customer whose records are sought at least ten days prior to the date on which the records are to be disclosed. No bank, director, officer, employee, or agent thereof, shall be held civilly or criminally liable for disclosure of financial records of such a customer pursuant to a subpoena, summons, or court order which on its face appears to have been issued upon lawful authority and is accompanied by such an affidavit.
B. (1) Nothing in this Section shall be construed to apply to general credit information relating to promptness of payments, limits of credit, or general information normally furnished to a credit reporting agency or among financial institutions for use in establishing an individual's credit rating or to any other business entity who has a legitimate business need for it.
(2) Nothing in this Section shall be interpreted or construed to apply to any authorization or approval of a specific extension of credit directly or indirectly by a credit card company or a business offering credit or the exchange of information between business organizations solely as to transactions or experiences between the consumer and such business organizations.
C. Prior to making disclosure, the bank shall be reimbursed by the requesting person for the reasonable costs incurred or to be incurred by it in the course of compliance, including but not limited to document reproduction costs, personnel costs, and travel expenses.
CONCLUSION
"Blind" and/or aggregate financial data and documentation does not constitute "nonpublic information," and thus, does not implicate the provisions of the GLBA, Louisiana's financial privacy law § 6:333, or such statutes' opt-out or opt-in methods of notification of customers. Indeed, Union Planters provided such "blind" documentation without objection in the state court litigation which presaged the federal injunctive proceedings in Gavel; the plaintiff bank did so without insisting on compliance with either the opt-in or the opt-out provisions of either federal or state law. Federal injunctive proceedings ensued only because the plaintiff's persisted in seeking disclosure of "non-public information" (i.e., specific customer information replete with personal identifiers), refusing to comply with the notification provisions of the GLBA and declining Union Planter's offer to initiate the requisite mail-out necessary to provide its customers with notice and an opportunity to opt-out.
Mindful of the logistical difficulties associated with completing the discovery task in this case, the Court provides the following directives as to how this discovery is to proceed. First, counsel for the defendants shall be permitted a reasonable amount of time to identify the documents sought, and then, a reasonable period of time to redact personal identifiers as discussed above. Given the rather broad reach of the putative class representatives discovery requests, the Court will exercise its discretion pursuant to Rule 26(b)(2) and, at least initially, require that plaintiff's bear the reasonable cost associated with the producing and redacting documents responsive to their discovery requests. The ultimate cost of producing and redacting the documents will be determined by the Court at a later time, subject to the outcome of the case. Given the confidential nature of even the redacted discovery sought, insofar as the defendants are concerned, a mutually agreeable protective order should be prepared to control access to the redacted documents following their discovery production, if this has not previously been accomplished. Accordingly,
These initial costs, which concern discovery in a federal case asserting federal claims, are not controlled or set by any state statute. Rather, these costs should reflect the reasonable costs associated with production and redaction of the documents.
IT IS ORDERED that the Defendants' Motion to Quash is GRANTED IN PART and DENIED IN PART. More specifically, to the extent that the defendants object to providing the requested "blind" and/or "aggregate" information and documentation with all personal identifiers redacted which information and documentation is responsive to the Plaintiff's Notice of FRCP 30(b)(6) Depositions and 30(b)(5) Requests for Production of Documents, the defendants' objection is OVERRULED, and thus, the defendants' shall comply with the plaintiffs' alternative discovery request in the manner discussed more extensively hereinabove.