Litigants in a civil dispute often use subpoenas, subpoenas duces tecum, and discovery requests to obtain personal information about individuals who may not be present in the litigation. A request for documents and information that include personal information about third parties may conflict with legal obligations imposed upon an organization not to produce information. For example, if an organization promises within its privacy policy that it will never share personal information with a “third party,” and does not include an exception for requests made in civil litigation or through judicial process, a consumer could argue that by producing information pursuant to a subpoena or discovery request an organization has violated its privacy policy and committed an unfair or deceptive practice in violation of federal or state law.

In addition, some states have adopted specific statutes or procedural rules that are designed to protect the privacy interests of absent consumers. For example, California Civil Procedural Rule § 1985.3 prevents a party from issuing a subpoena for personal information from a variety of organizations including medical providers, banks, credit unions, lenders, brokerage firms, or insurance companies, unless the party issuing the subpoena provides a copy to the consumer whose records are sought, and informs them that they have a right to object to the organization furnishing information about them. The rule also requires that the party issuing the subpoena provide the consumer sufficient time to receive, and object, before production is anticipated. The following provides a snapshot of information concerning the number of cases filed in 2013 and 2015.

If you receive a subpoena or document request asking for personal information about consumers consider the following steps and questions:

1. Does your organization maintain an internal procedure or protocol for how to respond to a subpoena or civil discovery request?
2. Has your organization made any representations to consumers that might be interpreted as indicating that information will not be provided to a requesting party, or that your organization will take certain steps (g., informing them of the request) before producing such information?
3. Does a law within the state in which the consumer is resident restrict or prevent you from complying with the subpoena?
4. Does a law within the state from which the subpoena is issued restrict or prevent you from complying with the subpoena?
5. Is a protective order in place that would mitigate against privacy harms that might occur from disclosure?
6. If so, is the protective order sufficient to protect a consumer’s privacy interest?
7. Has a court already evaluated the information request and weighed the privacy implications of production?