Allied Debt Collection of Virginia, L.L.C. v. Nautica Entertainment, L.L.C. , 2019 Ohio 4055 ( 2019 )


Menu:
  • [Cite as Allied Debt Collection of Virginia, L.L.C. v. Nautica Entertainment, L.L.C., 
    2019-Ohio-4055
    .]
    COURT OF APPEALS OF OHIO
    EIGHTH APPELLATE DISTRICT
    COUNTY OF CUYAHOGA
    ALLIED DEBT COLLECTION OF                                 :
    VIRGINIA, L.L.C.,
    :
    Plaintiff-Appellee,
    :                   No. 107678
    v.
    :
    NAUTICA ENTERTAINMENT, L.L.C.,
    ET AL.,                                                   :
    Defendants-Appellants.                            :
    JOURNAL ENTRY AND OPINION
    JUDGMENT: AFFIRMED IN PART, REVERSED IN PART,
    AND REMANDED
    RELEASED AND JOURNALIZED: October 3, 2019
    Civil Appeal from the Cuyahoga County Court of Common Pleas
    Case No. CV-17-880787
    Appearances:
    Patrick J. Milligan Co., L.P.A., and Patrick J. Milligan, for
    appellees.
    Hahn Loeser & Parks, L.L.P., Eric B. Levasseur, Anna
    Leigh Gecht, and Dennis R. Rose, for appellants.
    MICHELLE J. SHEEHAN, J.:
    Defendants-appellants             Nautica       Entertainment,          L.L.C.,       Jacobs
    Entertainment, Inc., Jacobs Investments, Inc., and Mary Horoszko (collectively
    “Nautica” or “Nautica Defendants”) appeal from the trial court’s order compelling
    the production of the electronically stored information (“ESI”), or “mirror image,”
    of “all Nautica’s computers used by Mary Horoszko.” Because we find the trial
    court’s order was warranted under the circumstances, yet failed to establish
    adequate protections to safeguard the confidentiality of the information contained
    on the computer systems to be imaged, we affirm in part, reverse in part, and
    remand.
    Procedural History and Substantive Facts
    On May 23, 2017, plaintiff-appellee Allied Debt Collection of Virginia,
    L.L.C. (“Allied”) filed a complaint against the Nautica Defendants, Jeffrey
    Livingston, and Chad Barth for actions stemming from a Kid Rock concert held at
    the Jacobs Pavilion in the Nautica Entertainment Complex during the 2016
    Republican National Convention. Allied states that it is a Virginia limited liability
    company and assignee of any tort claims belonging to Blue Star Productions, L.L.C.
    (“Blue Star”). The complaint alleged tortious interference with a contract between
    Concerts for a Cause, Inc. (“CFAC”) and Blue Star, Virginia statutory business
    conspiracy, fraud, theft in violation of R.C. 2307.61, and civil conspiracy. Barth is
    President and a director of CFAC. Livingston is allegedly the fundraiser who handled
    all negotiations on behalf of CFAC and Barth.
    According to Allied, Blue Star had contracted Kid Rock, among other
    acts, to perform concerts during the convention, and Blue Star searched for a venue
    in Cleveland for its concerts. Blue Star ultimately rented Jacobs Pavilion, which is
    owned and operated by Nautica Entertainment, through CFAC, under a shared-use
    arrangement whereby Blue Star agreed to promote and produce its music concerts
    at Jacobs Pavilion in exchange for providing CFAC with 1,200 Blue Star issued
    tickets to the Kid Rock concert. CFAC could in turn allocate the tickets to sponsors
    and guests. Allied claims that Nautica Defendants tortiously interfered with Blue
    Star’s arrangement with CFAC and conspired with CFAC to circumvent Blue Star’s
    ticketing process by issuing unauthorized wristbands to third parties for entry to the
    concert. Allied maintains that this scheme resulted in thousands of people accessing
    the Kid Rock concert without a Blue Star ticket, in contravention of the Blue
    Star/CFAC arrangement.
    Discovery
    On September 6, 2017, the court held a case management conference
    during which the court scheduled a paper discovery cutoff of November 6, 2017.
    During the conference, the parties agreed to forego electronic discovery and would
    exchange paper discovery only.
    The parties exchanged written discovery. Discovery disputes ensued,
    with both sides claiming discovery abuses. On April 5, 2018, Allied filed a motion to
    compel Nautica Defendants and Jeffrey Livingston to respond to Allied’s request for
    interrogatories and requests for production of documents. Regarding Nautica
    Defendants, Allied claimed that Nautica failed to fully answer several interrogatories
    and failed to produce numerous requested documents. Both Nautica Defendants
    and Livingston opposed the motion. Thereafter, the parties entered into a stipulated
    protective order. On June 11, 2018, the trial court granted Allied’s motion to compel,
    ordering Nautica and Livingston to respond to discovery within five days from the
    date of the order or face sanctions. Nautica Defendants served amended and
    supplemental discovery responses, which included 2,495 additional pages of
    documents.
    Claiming Nautica’s amended and supplemental discovery responses
    were still deficient, Allied filed a motion to show cause on July 25, 2018. Within this
    motion, Allied requested ESI for the first time. In its motion to show cause
    concerning Nautica Defendants’ paper discovery, Allied claimed that Nautica
    Defendants “habitually engaged in dilatory tactics, failed to meet their discovery
    obligations, and engaged in a rolling document production.” In referencing the
    documents it had received in response to its requests, Allied noted that it had
    received a purportedly “altered email chain” between Horoszko and Chad Barth of
    CFAC. In a footnote to this reference, Allied explained that Barth’s email production
    included an email that contained the word “wristbands” in two locations, while
    Horoszko’s production of that same email exchange did not:
    Barth’s email production: Wire I’m working on as we speak…will let
    you know amount and confirmation # shortly. Wristbands we’re
    working on a plan and executing it within the next hour. * * * How
    many of those 4,450 do you have? How many are committed to
    sponsors? I need the wristbands and info about today’s wire. Please
    and thank you.
    (Emphasis added.)
    Horoszko’s email production: Wire I’m working on as we speak…will
    let you know amount and confirmation # shortly. * * * How many of
    those 4,450 do you have? How many are committed to sponsors? I
    need info about today’s wire. Please and thank you.
    Allied had therefore surmised that Horoszko had altered her email to
    delete all references to “wristbands.” Consequently, within this footnote, Allied
    “request[ed] the court order Nautica to produce the doctored email in native
    format.” Nautica Defendants opposed Allied’s motion, along with this new request.
    On August 14, 2018, Nautica Defendants also filed a motion to compel responses to
    its written discovery requests propounded upon Allied, which the court ultimately
    held in abeyance.
    August Hearing
    The court held a hearing on August 15, 2018, during which the parties
    were scheduled to address Allied’s motion to show cause on the alleged discovery
    issues. At the hearing, however, the court informed the parties that the hearing
    would instead address “some emails that were exchanged that caused concern to
    [Allied], who is now asking for further information from [Nautica Defendants].”
    And the parties proceeded to address the purportedly altered email.
    During the hearing, Allied expanded its initial footnote request for “the
    doctored email in native format” to include all email communications, requesting
    “e-discovery with respect to Nautica’s emails” and “an order * * * requiring Nautica
    to produce the electronic email communications in their native e-discovery format.”
    (Emphasis added.) Allied argued that ESI discovery is inherent in its document
    request and that one altered email suggests there may be more, thus justifying the
    need for ESI. Nautica opposed Allied’s new request, arguing that the parties agreed
    at the case management conference that the parties would exchange paper discovery
    due to the timing and cost concerns associated with electronic discovery, the parties
    had not been previously subjected to produce any ESI, there had been no discussions
    concerning the proper ESI protocols, Allied had the opportunity to depose Horoszko
    on the altered email, and ordering ESI now would result in an undue burden and
    unfair cost to Nautica Defendants. Without offering any explanation concerning the
    conflicting emails, Nautica’s counsel stated only that Nautica Defendants “dispute
    that there was something inappropriate done with that email.”
    Acknowledging that this hearing pertained only to the allegedly
    altered email, the court inquired of Nautica whether there were any other reasons
    the court should not order ESI discovery in this matter, to which Nautica Defendants
    replied that they have abided by the previously agreed upon discovery procedure,
    discovery in the case has become extremely costly, and they believe ESI discovery
    would be unduly burdensome and inappropriate. The court then ordered ESI
    discovery “with respect to [Allied’s] request motion,” noting that it had not heard
    “any specific reasons why it’s too burdensome despite the normal, you know, costs
    of litigation that this is, according to Plaintiff seeking a $4.5 million verdict, that
    would require me to not order this.” After ordering the ESI discovery of “all the
    emails,” the court instructed the parties’ two IT experts to confer on the issue.
    Thereafter, the court advised the parties that its order would be journalized. A
    review of the record, however, reveals that no journal entry was entered.
    September Hearing
    On September 5, 2018, the court held a hearing on Allied’s motion to
    show cause regarding Nautica’s responses to Interrogatory Nos. 7 and 12-14 and
    Document Request Nos. 4, 30, and 36. During the hearing, the court found Nautica
    Defendants in contempt for their failure to sufficiently respond to Allied’s discovery
    requests, stating “It’s been admitted by both parties that they didn’t provide
    documents. They refer to someone else’s production of documents and that they
    didn’t understand what the word ‘communication’ meant and that — this has been
    going on long enough, and it needs to stop.” The court then instructed Allied to
    produce information pertinent to sanctions against Nautica, such as attorney fees.
    The court also discussed scheduling a hearing on Nautica Defendants’ motion to
    compel.
    Additionally, at the September hearing, the court addressed “the
    altered email issue.” In its opening statement, Allied’s counsel argued that there are
    two main issues the court should consider in granting its motion to show cause —
    the financial issues or records concerning Livingston that had not been fully
    produced and the communications between the parties that revealed a discrepancy
    in emails between Barth and Horoszko that referenced wristbands. Livingston’s
    counsel asserted that Allied indeed obtained all the requested records. Counsel for
    Nautica Defendants asserted that Nautica had fully responded to all discovery
    requests, including “thousands of emails.”
    In addressing Allied’s second issue, the altered email issue, Nautica’s
    counsel represented that the parties had numerous “productive discussions,”
    presumably off the record, regarding how to go about conducting the search,
    electronically, but the parties disagreed on the scope of the search. Counsel also
    informed the court that Allied apparently expanded its request for ESI once again,
    now seeking more than the emails associated with Horoszko:
    Your Honor, as I believe the court will hear, what the plaintiffs have
    proposed is effectively to have a third-party outside vendor come in
    and do a complete image of Ms. Horoszko’s computer. And it’s
    unclear to me whether they’ve suggested that the servers should also
    somehow be included. But they’ve at least I believe said Ms.
    Horoszko’s computer.
    Counsel then noted his concerns regarding potential attorney-client
    privilege and other confidential or proprietary information and the risk of placing
    this information in the hands of a third-party vendor with no restrictions. Counsel
    further argued that “anything beyond the email-related data would be wholly
    irrelevant, [] overbroad, and beyond what this court had ordered at the last hearing.”
    In response, the court stated:
    Okay. So I see a very simple and easy solution to solve these things.
    That is a confidentiality protective agreement with the third-party
    vendor which is done pretty routinely whenever there’s a third-party
    vendor who images a computer and also an opportunity for your IT
    person to identify as — in conjunction with the mirror image exactly
    what communications came from your firm. It’s not that hard to do.
    * * * Write up an agreement, and you’re done.
    Nautica’s counsel indicated that he would be willing to propose an
    order that would provide “strict limitations on what [the] third-party vendor could
    do with this information,” because the parties had yet to agree on the parameters for
    the ESI search. In response, Allied’s counsel once again linked the ESI issue with
    its original motion to compel interrogatories, noting that the altered email was
    revealed during the initial discovery exchange, and counsel agreed that there should
    be an order in place concerning the ESI.
    After the majority of the September hearing was spent discussing
    specific interrogatories and document requests and the court found Allied’s motion
    well taken and found Nautica in contempt concerning “document dumps” and
    “misunderstanding communications,” Allied’s counsel raised the ESI issue. The
    court asked Nautica Defendants if there was any reason they could not create a
    confidentiality agreement concerning the ESI. Nautica objected on the grounds that
    the request for ESI was overbroad and not consistent with what had been discussed
    at the August hearing; however, counsel indicated that he would work with opposing
    counsel to craft an order that would ensure the necessary confidentiality safeguards.
    At this point, the court stated, “You had this opportunity for all this time, and now
    we’re down to this where I have to order a mirror image of a computer to get this
    information to Plaintiffs. I’m not going to take it anymore. Write an order,
    protective order. I’ll sign it, and we’ll just get it done.” The court then noted that
    “[w]e’ll sort out attorney-client privileges, in camera inspections. Just bring them
    to me.”
    According to Nautica Defendants, they attempted in good faith to
    reach an agreement with Allied on a joint stipulated ESI order but were ultimately
    unable to agree on the terms, including the time in which Nautica could conduct a
    privilege review and the search methodology utilized to protect against the
    disclosure of proprietary and confidential information. Thereafter, the parties each
    filed a proposed ESI order. Nautica objected to Allied’s proposed order.
    The Trial Court’s Discovery Order
    On September 12, 2018, the court issued the following order:
    Hearing held for plaintiff’s motion to show cause why defendants
    should not be held in contempt for violating this court’s order
    compelling discovery. Defendants found in contempt of court for
    their failure to respond with particularity to interrogatories and
    requests for documents. Plaintiff to propose any adverse inference of
    fact relative to documents/information not produced to be considered
    by the jury and provide defense counsel with affidavit detailing
    attorney fees and expenses related to the efforts to compel discovery,
    preparation of the motion, and prosecuting the show cause hearing.
    Attorney fees hearing to be set. Defendant’s duty to comply with all
    discovery continues and is ongoing.
    Defendants ordered to provide mirror image of all Nautica’s
    computers used by Mary Horoszko through third-party vendor. See
    ESI order adopted and incorporated herein and entered under
    separate entry.
    Expanding Allied’s request for “e-discovery with respect to Nautica’s
    emails,” the trial court ordered Nautica Defendants to produce a “mirror image of
    all Nautica’s computers used by Mary Horoszko.” In so doing, the trial court adopted
    and incorporated into its order Allied’s entire proposed ESI order verbatim. That
    order compelled ESI, utilizing the third-party vendor engaged by Allied, Vestige,
    with the following limitations and conditions:
    1. Vestige shall collect the requested ESI from Nautica and Horoszko
    by imaging and inventorying (i) the Nautica computer regularly used
    by Horoszko and (ii) any production/non-backup server where
    e-mails associated with her e-mail account * * * (or any other e-mail
    account she has used to conduct business on behalf of Nautica, if any)
    (collectively, the “Horoszko Accounts”) might otherwise be
    electronically stored (collectively, the “Imaged ESI”). With respect to
    the imaging of any server, such imaging shall be limited to those ESI
    files associated with the Horoszko Accounts or where such ESI might
    be electronically stored. Vestige shall be responsible for collecting the
    ESI within five (5) days of the entry of this Order at a place, date and
    time mutually agreeable between Vestige and Nautica’s information
    technology (“IT”) personnel. Nautica and/or Nautica and Horoszko’s
    counsel’s IT personnel shall have the right to be present and supervise
    the imaging and inventorying of any ESI collected by Vestige, and
    shall be provided an exact copy of any ESI forensically imaged by
    Vestige prior to departing the collection locale.
    2. Nautica and Horoszko’s counsel shall have the right to review the
    Imaged ESI for any information protected by the attorney-client
    privilege (The “Protected Information”) and shall create and produce
    a log of any such Protected Information for delivery to Vestige and
    Allied’s counsel within three (3) day thereof. Upon receipt of the log
    identifying Protected Information, Vestige shall separate the
    Protected Information from the Imaged ESI for purpose of production
    and promptly produce to Allied all other ESI for the period October 1,
    2014 through the present date. Allied’s counsel may request any
    information withheld from production by Nautica and Horoszko to be
    submitted by Vestige to the Court for determination of whether the
    Protected Information is attorney-client privileged.
    3. All ESI (i) collected by Vestige, and (ii) provided to Allied as part of
    the Production Image, shall be deemed and treated as “confidential
    Information” under the Court’s previously entered Stipulated
    Protective Order (“SPO”). At all times while in possession of the ESI,
    Vestige and Allied shall be bound by the SPO, a copy of which shall be
    provided by Allied’s counsel to Vestige before it collects any ESI.
    Vestige shall review and execute Exhibit A to the SPO and provide an
    original executed copy of the same to Nautica and Horoszko’s counsel
    and/or IT personnel prior to the collection of any ESI.
    4. Within five (5) days of the final disposition of this action, whether
    by entry of judgment or settlement, Vestige shall destroy (and attest
    by affidavit to the destruction) or return to Nautica and Horoszko’s
    counsel any ESI.
    5. Although all ESI produced to Allied by Vestige shall be deemed and
    treated as Confidential Information under the SPO, Allied may
    petition the Court to deem some of the ESI collected by Vestige and
    produced to Allied non-confidential, if necessary, pursuant to Section
    15 of the SPO.
    On September 13, 2018, Nautica Defendants appealed the trial court’s
    order pertaining to the ESI.1
    Assignments of Error
    On appeal, Nautica Defendants assign three errors for our review,
    which we will address together:
    I. The trial court abused its discretion in ordering the Nautica
    Defendants to produce forensic mirror images of their computers and
    servers to Allied without satisfying the first step of the Bennett test.
    II. The trial court abused its discretion in ordering the Nautica
    Defendants to produce forensic mirror images of their computers and
    servers to Allied without instituting adequate procedural safeguards
    to protect their privileged, proprietary, personal, and confidential
    electronically stored information (“ESI”).
    III. The trial court abused its discretion in ordering the Nautica
    Defendants to produce forensic mirror images of their computers and
    servers to Allied without limiting the scope of the production to only
    1  On September 20, 2018, this court sua sponte dismissed Nautica’s appeal for lack
    of final appealable order, finding that “the mere adjudication of contempt of court is not
    a final appealable order until a sanction or penalty is imposed.” Nautica Defendants filed
    a motion for reconsideration of the dismissal. The motion clarified that Nautica’s appeal
    concerns only the second part of the trial court’s order that compelled the production of
    a “mirror image of all Nautica’s computers * * *,” which is a final appealable order because
    the order compels the production of forensic imaging of a computer hard drive and the
    disclosure of privileged and/or confidential material. In support, Nautica cited Fasteners
    for Retail, Inc. v. Dejohn, 8th Dist. Cuyahoga No. 100333, 
    2014-Ohio-1729
    , and Bennett
    v. Martin, 
    186 Ohio App.3d 412
    , 
    2009-Ohio-6195
    , 
    928 N.E.2d 763
     (10th Dist.). Nautica’s
    motion was unopposed. Upon reconsideration, we reinstated Nautica’s appeal.
    the ESI reasonably calculated to lead to the discovery of admissible
    evidence.
    Law and Analysis
    Nautica Defendants contend that the trial court abused its discretion
    in compelling the forensic mirror imaging of “all Nautica’s computers used by Mary
    Horoszko.”   They argue that the trial court failed to conduct the appropriate
    balancing test, which includes weighing the parties’ interest in discovery against
    Nautica Defendants’ competing interests in privacy and confidentiality; the court
    failed to institute adequate procedural safeguards for the protection of Nautica’s
    privileged, proprietary, and confidential information; and the court’s order was
    overbroad and unduly burdensome.
    Civ.R. 26
    The Ohio Rules of Civil Procedure provide a right to the “liberal
    discovery of information.” Ward v. Summa Health Sys., 
    128 Ohio St.3d 212
    , 2010-
    Ohio-6275, 
    943 N.E.2d 514
    , ¶ 9, citing Moskovitz v. Mt. Sinai Med. Ctr., 
    69 Ohio St.3d 638
    , 661-662, 
    635 N.E.2d 331
     (1994). This discovery may be obtained through
    “deposition upon oral examination or written questions; written interrogatories;
    production of documents, electronically stored information, or things or permission
    to enter upon land or other property, for inspection and other purposes; physical
    and mental examinations; and requests for admission.” Civ.R. 26(A).
    Civ.R. 26(B) governs the scope of the information that a party may
    obtain through discovery:
    [A]ny matter, not privileged, which is relevant to the subject matter
    involved in the pending action, whether it relates to the claim or
    defense of the party seeking discovery or to the claim or defense of any
    other party, including the existence, description, nature, custody,
    condition and location of any books, documents, electronically stored
    information, or other tangible things and the identity and location of
    persons having knowledge of any discoverable matter.
    Civ.R. 26(B)(1). Additionally, the information sought must “appear[] reasonably
    calculated to lead to the discovery of admissible evidence.” 
    Id.
    Specifically    regarding     electronically   stored    information,
    Civ.R. 26(B)(4) provides as follows:
    A party need not provide discovery of electronically stored
    information when the production imposes undue burden or expense.
    On motion to compel discovery or for a protective order, the party
    from whom electronically stored information is sought must show
    that the information is not reasonably accessible because of undue
    burden or expense. If a showing of undue burden or expense is made,
    the court may nonetheless order production of electronically stored
    information if the requesting party shows good cause. The court shall
    consider the following factors when determining if good cause exists:
    (a) whether the discovery sought is unreasonably cumulative or
    duplicative;
    (b) whether the information sought can be obtained from some
    other source that is less burdensome, or less expensive;
    (c) whether the party seeking discovery has had ample
    opportunity by discovery in the action to obtain the information
    sought; and
    (d) whether the burden or expense of the proposed discovery
    outweighs the likely benefit, taking into account the relative
    importance in the case of the issues on which electronic
    discovery is sought, the amount in controversy, the parties’
    resources, and the importance of the proposed discovery in
    resolving the issues.
    In ordering production of electronically stored information, the court
    may specify the format, extent, timing, allocation of expenses and
    other conditions for the discovery of the electronically stored
    information.
    Civ.R. 26(B)(4); Townsend v. Ohio DOT, 10th Dist. Franklin No. 11AP-672, 2012-
    Ohio-2945, ¶ 15; Loc.R. 21.3(F)(2)(c) of the Court of Common Pleas of Cuyahoga
    County, General Division (detailing similar factors for the court to consider when
    determining if good cause exists for the production of ESI).
    An appellate court generally reviews a discovery dispute for an abuse
    of discretion. Ward, 
    128 Ohio St.3d 212
    , 
    2010-Ohio-6275
    , 
    943 N.E.2d 514
    , at ¶ 13;
    Fasteners for Retail, Inc., 8th Dist. Cuyahoga No. 100333, 
    2014-Ohio-1729
    , at ¶ 19
    (reviewing the trial court’s order of forensic imaging of a computer’s hard drive
    under the abuse of discretion standard). An “abuse of discretion ‘connotes more
    than an error of law or judgment; it implies that the court’s attitude is unreasonable,
    arbitrary, or unconscionable.’” Blakemore v. Blakemore, 
    5 Ohio St.3d 217
    , 219, 
    450 N.E.2d 1140
     (1983), quoting State v. Adams, 
    62 Ohio St.2d 151
    , 157, 
    404 N.E.2d 144
    (1980).   And absent an abuse of discretion, we must affirm the trial court’s
    disposition on discovery matters. Lightbody v. Rust, 
    137 Ohio App.3d 658
    , 663, 
    739 N.E.2d 840
     (8th Dist.2000).
    Forensic Imaging
    The trial court ordered Nautica Defendants to produce “all Nautica’s
    computers used by Mary Horoszko” for a forensic examination. A forensic image,
    also known as a “mirror image,” will “‘replicate bit for bit, sector for sector’” all
    allocated and unallocated space on a computer’s hard drive, including any
    embedded, residual, and deleted data. Bennett, 
    186 Ohio App.3d 412
    , 2009-Ohio-
    6195, 
    928 N.E.2d 763
    , at ¶ 40, quoting Balboa Threadworks, Inc. v. Stucky, D.Kan.
    No. 05-1157-JTM-DWB, 
    2006 U.S. Dist. LEXIS 29265
    , 7 (Mar. 24, 2006); Ferron v.
    Search Cactus, L.L.C., S.D.Ohio No. 2:06-CV-327, 
    2008 U.S. Dist. LEXIS 34599
    , 10,
    fn. 5 (Apr. 28, 2008) (“A mirror image copy represents a snapshot of the computer’s
    records. * * * It contains all the information in the computer, including embedded,
    residual, and deleted data.”).
    Courts are generally reluctant to compel forensic imaging “largely due
    to the risk that the imaging will improperly expose privileged and confidential
    material contained on the hard drive.” Bennett at ¶ 40. To determine whether
    forensic imaging is warranted, as opposed to standard discovery procedures, the
    trial court must (1) weigh the parties’ interest in obtaining discovery against privacy
    concerns; and (2) institute a protective protocol to ensure that forensic imaging is
    not unduly intrusive. Bennett at ¶ 41, 47. This court has adopted the Bennett two-
    part test utilized by the Tenth District Court of Appeals in Fasteners for Retail, Inc.
    at ¶ 21.
    Weighing of Interests
    Before compelling forensic imaging, a trial court must first weigh the
    necessity of obtaining the electronic discovery against any privacy concerns:
    “[A] court must weigh ‘the significant privacy and confidentiality
    concerns’ inherent in imaging against the utility or necessity of the
    imaging. * * * In determining whether the particular circumstances
    justify forensic imaging, a court must consider whether the
    responding party has withheld requested information, whether the
    responding party is unable or unwilling to search for the requested
    information, and the extent to which the responding party has
    complied with discovery requests. * * * When a requesting party
    demonstrates either discrepancies in a response to a discovery request
    or the responding party’s failure to produce requested information,
    the scales tip in favor of compelling forensic imaging.”
    (Citations omitted.) Fasteners for Retail, 8th Dist. Cuyahoga No. 100333, 2014-
    Ohio-1729, at ¶ 24, quoting Bennett at ¶ 41; see also Scott Process Sys. v. Mitchell,
    5th Dist. Stark No. 2012CA00021, 
    2012-Ohio-5971
    , ¶ 37-38 (finding the order for
    forensic imaging in error where the requesting party failed to demonstrate that
    paper production of records was insufficient or that the requesting party’s need for
    forensic imaging outweighed the party’s privacy interests); Nithiananthan v.
    Toirac, 12th Dist. Warren No. CA2011-09-098, 
    2012-Ohio-431
    , ¶ 9 (the party
    requesting forensic imaging must demonstrate a “background of noncompliance”
    with discovery under part one of the Bennett framework); Scotts Co., L.L.C. v.
    Liberty Mut. Ins. Co., S.D.Ohio No. 3:06-CV-899, 
    2007 U.S. Dist. LEXIS 43005
    , 4-
    5 (June 12, 2007), quoting Diepenhorst v. Battle Creek, W.D. Mich. No. 1:05-CV-
    734, 
    2006 U.S. Dist. LEXIS 48551
    , 10-11 (June 30, 2006) (expressing reluctance to
    permit intrusive forensic imaging as a matter of course on a requesting party’s “mere
    suspicion” the opponent is withholding information or to “address the bare
    possibility of discovery misconduct”).
    Step One: Necessity of the Imaging vs. Privacy Concerns
    In Bennett, the court found that the defendants repeatedly
    represented that they had disclosed all responsive documents when they had not.
    Bennett, 
    186 Ohio App.3d 412
    , 
    2009-Ohio-6195
    , 
    928 N.E.2d 763
    , at ¶ 42.
    Additionally, the court noted that the defendants had a “lackadaisical and dilatory
    approach to providing discovery” when they engaged in last-minute discovery
    practice. 
    Id.
     Thus, after applying the balancing factors, the court determined that
    the defendants demonstrated a “willful disregard of the discovery rules,” and given
    their “background of noncompliance,” the trial court properly ordered forensic
    imaging. 
    Id.
    In Fasteners, we determined that the record concerning discovery did
    not demonstrate the requisite showing of the defendants’ noncompliance with
    discovery under the first prong of the Bennett test. Specifically, we noted that the
    record did not demonstrate that the documents sought by the plaintiff “were being
    unlawfully withheld and not available from [Plaintiff’s] own information or other
    sources.” Fasteners for Retail at ¶ 29.
    Nautica Defendants contend that the trial court failed to satisfy the
    first step of the Bennett analysis.       In support, they claim that their conduct
    concerning Allied’s request for ESI was not improper and therefore forensic imaging
    was not warranted and the court “ignored” their privacy concerns. We find Nautica
    Defendants’ argument unpersuasive.
    Here, the record shows that in the course of Nautica Defendants’
    document production, Allied discovered two conflicting emails between Horoszko
    and Barth. Barth’s copy of the email included references to wristbands, while
    Horoszko’s copy contained no references to wristbands. This discovery, Allied
    contends, led to its belief that the email chain had been altered, and Allied became
    concerned that there were other “altered” emails of which Allied was unaware. In
    response to this discovery, Allied made a new motion (within its motion for
    sanctions regarding the paper discovery, albeit in a footnote) requesting the court
    compel forensic imaging of Nautica computers used by Horoszko. In addition, the
    record shows that following a hearing on Allied’s motion to show cause regarding
    certain paper discovery, the trial court found Nautica Defendants in contempt for
    failing to fully and properly answer several interrogatories and failing to produce
    numerous requested documents, namely Interrogatory Nos. 7 and 12-14 and
    Document Request Nos. 4, 30, and 36.
    Nautica Defendants argue that the court’s sanctions applied only to
    Nautica’s paper discovery and their conduct relating to this new request for ESI was
    not improper. We agree that the court’s sanctions appear to pertain to Nautica’s
    conduct in responding to Allied’s paper discovery requests. The trial court’s order
    at issue here, rather, is an ESI order in response to the alleged “altered email chain.”
    The newly discovered “altered email chain,” however, demonstrates a
    discrepancy in discovery that weighs in favor of compelling forensic imaging.
    Bennett, 
    186 Ohio App.3d 412
    , 
    2009-Ohio-6195
    , 
    928 N.E.2d 763
    , at ¶ 41 (finding
    “the scales tip in favor of compelling forensic imaging” when a requesting party
    demonstrates discrepancies in a response to a discovery request); see also Simon
    Property Group L.P. v. MySimon, Inc., 
    194 F.R.D. 639
    , 641 (S.D.Ind.2000)
    (permitting the plaintiff to inspect the defendant’s deleted computer files where the
    plaintiff demonstrated “troubling discrepancies” concerning the defendant’s
    document production); Playboy Ents., Inc. v. Welles, 
    60 F.Supp.2d 1050
    , 1054-55
    (S.D. Cal. 1999) (permitting forensic imaging of a defendant’s computer where the
    parties, pursuant to a document request, discovered an email chain produced by one
    defendant that was not produced by a codefendant and where the parties later
    learned that the defendant customarily deleted emails after litigation had
    commenced). Nautica Defendants do not dispute the existence of the discrepancy,
    yet they offer no explanation for the apparent conflict. And forensic imaging may
    reveal other deleted emails or altered emails on the Nautica computers used by
    Horoszko. When the court considered the Barth/Horoszko email discrepancy along
    with the history of Nautica Defendants’ discovery violations concerning paper
    discovery, where in fact the court found that Nautica Defendants repeatedly failed
    to produce documents, an order compelling forensic imaging was not unreasonable.
    Regarding Nautica Defendants’ privacy concerns, as discussed below,
    the record reflects the court considered Nautica Defendants’ privacy and
    confidentiality concerns and instituted certain protective protocols. But the unique
    discrepancy in discovery and the history of discovery violations weighed in favor of
    forensic imaging.
    In light of the foregoing, we cannot find the trial court abused its
    discretion in ordering forensic imaging under the circumstances. Viewing the
    record in its entirety, the showing required under the first prong of the Bennett
    analysis has been satisfied.
    Step Two: Protective Protocol
    “Even when a defendant’s misconduct in discovery makes forensic
    imaging appropriate, a court must protect the defendant’s confidential information
    as well as preserve any private and privileged information.” Bennett, 
    186 Ohio App.3d 412
    , 
    2009-Ohio-6195
    , 
    928 N.E.2d 763
    , at ¶ 47. A party’s purported failure
    to produce discovery as requested or ordered “will rarely warrant unfettered access
    to a party’s computer system.” 
    Id.
     A trial court abuses its discretion when “its
    judgment entry permits unfettered forensic imaging of a party’s electronic devices
    and contains none of the Bennett protections required to conduct such forensic
    analysis. Fasteners for Retail, 8th Dist. Cuyahoga No. 100333, 
    2014-Ohio-1729
    , at
    ¶ 33, citing Scott Process Sys., 5th Dist. Stark No. 2012CA00021, 
    2012-Ohio-5971
    ,
    at ¶ 36.
    The Bennett court suggested, and this court followed, a protocol for
    forensic imaging:
    “[A]n independent computer expert, subject to a confidentiality order,
    creates a forensic image of the computer system. The expert then
    retrieves any responsive files (including deleted files) from the
    forensic image, normally using search terms submitted by the
    plaintiff. The defendant’s counsel reviews the responsive files for
    privilege, creates a privilege log, and turns over the nonprivileged files
    and privilege log to the plaintiff.”
    Fasteners for Retail at ¶ 32, quoting Bennett at ¶ 47; Nithiananthan, 12th Dist.
    Warren No. CA2011-09-098, 
    2012-Ohio-431
    , at ¶ 19 (adopting the protocol
    suggested in Bennett and holding that “at minimum, several protective measures
    must be enforced when ordering forensic imaging”); Scott Process Sys., supra
    (adopting the Bennett protocol and reversing the trial court’s order for forensic
    imaging where the order contained “none of the Bennett protections”).
    In Bennett, the appellate court found that the trial court did not abuse
    its discretion in ordering forensic imaging as a sanction for the defendants’
    noncompliance with the trial court’s orders. Bennett at ¶ 49. The appellate court
    determined, however, that the trial court erred “in not providing adequate
    protections to safeguard the confidentiality of the information contained on the
    computer systems to be imaged.” Id. Finding insufficient the trial court’s safeguards
    for privileged and confidential information, which included permitting the party to
    redact privileged information and designating certain confidential and personal
    information “for attorneys’ eyes only,” the appellate court stressed the importance
    of a proper protocol where forensic imaging is ordered, even where a party engages
    in misconduct:
    [W]e believe that more comprehensive protection is necessary,
    particularly given the sensitivity of the information at issue here.
    Bennett deserves a remedy for the prejudice caused by defendants’
    misconduct, but that remedy should not require defendants to
    sacrifice highly-sensitive, confidential information that has no
    bearing on Bennett’s claims. Additionally, private information of the
    computers’ users — such as personal financial information and
    communications with friends and family — should not be subject to
    disclosure. Therefore, we conclude that the trial court abused its
    discretion in devising the procedure for the forensic imaging. We urge
    the trial court to adopt a protocol similar to the one described above.
    We believe that such a protocol would allow Bennett sufficient access
    to the computer systems to recover useful information, while also
    providing defendants with an opportunity to identify and protect
    privileged and confidential matter.
    Id. at ¶ 48.
    Mindful of the “potential intrusiveness” of a forensic examination,
    federal courts likewise utilize a “collection and review protocol” when compelling a
    forensic examination, such as the following:
    1. An independent computer expert shall be appointed by the Court
    and shall mirror image [the party’s] computer system.
    2. The parties have [a designated time in which to] meet and confer
    regarding their designation of an independent computer expert. If the
    parties cannot agree, on or before [a set date], each party shall submit
    its recommendation to the Court, and the Court will select the expert.
    3. The appointed expert shall serve as an Officer of the Court. Thus, to
    the extent that this computer expert has direct or indirect access to
    information protected by attorney-client privilege, such disclosure
    will not result in any waiver of the [party’s] privilege.
    4. The independent expert shall sign a confidentiality order.
    Additionally, the expert shall be allowed to hire other outside support
    if necessary in order to mirror image the [party’s] computer system.
    Any outside support shall be required to sign the same confidentiality
    order.
    5. The expert shall mirror image the [party’s] computer system.
    6. The [requesting party] shall provide a list of search terms to the
    Court to identify responsive documents to its document requests on
    or before [a set date]. After [the requesting party] has submitted the
    search terms to the Court, [the party] shall have 5 days to submit their
    objections to the Court regarding any of the search terms, which the
    court will rule upon. The Court will provide the search terms to the
    independent expert.
    7. Once the expert has mirror imaged the [party’s] computer system,
    the expert shall search the mirror image results using the search
    terms. The results of the search terms and an electronic copy of all
    responsive documents shall be provided to the [party] and to the
    Court.
    8. The [party] shall review the search term results provided by the
    independent expert and identify all responsive documents. The
    [party] shall either produce all responsive documents to the
    [requesting party] or identify those responsive documents not
    produced on a privilege log to the [requesting party] within 20 days of
    the date that the [party] receives the search term results from the
    independent expert. Any privilege log produced shall comply strictly
    with the [the rules of court].
    9. [The requesting party] shall pay for all fees and costs of hiring the
    independent expert at this time. However, if at a later time there is
    evidence of the [party’s] improper deletion of electronic documents or
    any other associated improper conduct, the Court will revisit this issue
    and consider charging [that party] for the fees and costs of the
    independent expert or imposing the fees and costs on the parties in a
    duly appropriate apportioned manner.
    10. The independent expert shall provide a signed affidavit detailing
    the steps he or she took in mirror imaging the [party’s] computer
    system and searching the mirror image for the search terms within 5
    days of providing the [party] and the Court with the results of the
    search for search terms in the mirror image.
    Wynmoor Community Council, Inc. v. QBE Ins. Corp., 
    280 F.R.D. 681
    , 687-688
    (S.D.Fla.2012); Bank of Mongolia v. M&P Global Fin. Servs., 
    258 F.R.D. 514
    (S.D.Fla.2009).
    Nautica Defendants contend that the trial court’s discovery order
    lacks adequate protective protocols to safeguard its privileged and confidential ESI.
    In support, Nautica argues that the court’s order contains no search methodology or
    search terms; the order does not exclude from the search information that is not
    privileged but is otherwise confidential, such as personal or proprietary information
    irrelevant to the underlying action; and the order’s provision of three days in which
    to conduct a privilege review of potentially hundreds of gigabytes of data is
    insufficient and unreasonable. Nautica Defendants also contend that the trial
    court’s order is overbroad and permits the production of irrelevant and confidential
    information that is not reasonably calculated to the discovery of admissible
    evidence. Thus, according to Nautica, the order exceeds the scope of discoverable
    information.
    Upon review, we find the trial court included some safeguards for
    Nautica Defendants’ privileged and confidential matter. The record shows that the
    court addressed Nautica Defendants’ privacy concerns, at least to some degree.
    During the September hearing, the court engaged in a colloquy with counsel for
    Nautica, during which counsel advised the court of his concern regarding protecting
    confidential information, attorney-client privilege, and other personal and private
    information arguably contained on Nautica’s computers. The court then instructed
    the parties to fashion a protective order and the court would sign it. The court
    further stated that the parties could address any issues concerning attorney-client
    privileges through in camera inspections, instructing, “Just bring them to me.” The
    court also executed an ESI order deeming all ESI produced to Allied as “Confidential
    Information” under the court’s previously entered Stipulated Protective Order.
    However, the trial court’s ESI order lacks sufficient protective
    protocols intended by Bennett and numerous other courts to safeguard Nautica
    Defendants’ confidential information. For example, the trial court’s order in this
    case failed to include a list of search terms in its order to narrow the production of
    documents. The court’s order also failed to outline a process by which the parties
    could submit search terms to identify responsive documents, provide objections to
    proposed search terms, and provide the search terms to an independent third-party
    computer expert. Allied suggests that a search term protocol using the term
    “wristbands” would not have exposed the “altered email chain” or any others from
    which Nautica deleted the term “wristbands” and therefore would not have been
    fruitful. We find no reason the parties are limited to one relevant search term. Given
    the opportunity, the parties could agree upon other equally availing search terms
    that would likely produce responsive documents. And having a procedure in place
    by which the parties can object to proposed search terms ensures that the parties’
    interests are protected.
    Moreover, we find the lack of search terms and search protocol has
    resulted in an overbroad order that risks including information irrelevant to the
    underlying claims and information that may be personal, private, proprietary, or
    otherwise confidential. “Courts have been cautious in requiring the mirror imaging
    of computers where the request is extremely broad in nature and the connection
    between the computers and the claims in the lawsuit are unduly vague or
    unsubstantiated in nature.” Balboa Threadworks, Inc., D.Kan.No. 05-1157-JTM-
    DWB, 
    2006 U.S. Dist. LEXIS 29265
    , at 3. Likewise, where courts do compel forensic
    imaging, courts must utilize a protective protocol “to ensure that the forensic
    imaging is not unduly intrusive,” which protocol serves to protect the defendant’s
    confidential, private, and privileged information. Nithiananthan, 12th Dist. Warren
    No. CA2011-09-098, 
    2012-Ohio-431
    , at ¶ 19, 20.
    Here, the record shows that Allied’s initial request for “the doctored
    email in native format” (noted within a footnote in Allied’s motion for sanctions
    regarding paper discovery) developed into a request for “e-discovery with respect to
    Nautica’s emails” (at the August hearing) and ultimately resulted in the court’s order
    of “a mirror image of all Nautica’s computers used by Mary Horoszko.” Although
    the court’s ESI order provided a protocol in which the parties could arguably prevent
    the disclosure of attorney-client privilege (i.e. the creation of a privilege log), there
    is nothing in the order — through search terms or other instructions — that expressly
    required the third-party vendor or expert to limit its search to information relevant
    to Allied/Blue Star’s claims against Nautica Defendants or to exclude personal or
    confidential information, such as Horoszko’s personal or financial information or
    Nautica’s proprietary information. Rather, the order broadly states that the expert
    shall collect “ESI files associated with the Horoszko accounts or where such ESI
    might be electronically stored.” Without relevant search terms, or other limiting
    instructions, the court is essentially permitting unfettered access to irrelevant and
    confidential information contained in the Nautica computers used by Horoszko.
    Additionally, we find the trial court’s order failed to provide Nautica
    Defendants sufficient time in which to review responsive documents for privileged
    information. The court’s order provides that “counsel shall have the right to review
    the Imaged ESI for any information protected by the attorney-client privilege (The
    ‘Protected Information’) and shall create and produce a log of any such Protected
    Information for delivery to Vestige and Allied’s counsel within three (3) days
    thereof.” The record shows that thousands of documents have been produced in the
    course of paper discovery, and Nautica Defendants assert that forensic imaging
    could access hundreds of gigabytes of data. Given this large amount of data, the
    court’s allowance of only three days to review the records for privilege and
    responsiveness, appropriately supplement Nautica’s responses to discovery
    requests, and create a privilege log that expressly describes the nature of the
    documents or communications that are protected is unreasonable. See Ameriwood
    Industries v. Liberman, E.D.Mo. No. 4:06CV524-DJS, 
    2006 U.S. Dist. LEXIS 93380
     (Dec. 27, 2006) (outlining a three-step procedure for forensic imaging and
    including in its “disclosure step” a period of 20 days for review and creation of
    privilege log); see also Wynmoor, 
    280 F.R.D. 681
     (S.D.Fla.2012) (20 days for review
    and creation of privilege log); Bank of Mongolia, 
    258 F.R.D. 514
     (20 days for review
    and creation of privilege log).
    Conclusion
    Based upon the discovery of a purportedly altered email chain and
    Nautica Defendants’ history of noncompliance with the trial court’s previous
    discovery orders, we find the trial court did not abuse its discretion in compelling
    forensic imaging of Nautica computers. We find, however, that the trial court
    abused its discretion in failing to establish the proper protective protocols that
    would allow Allied sufficient access to recover useful, relevant information, while
    also providing Nautica Defendants an opportunity to identify and protect privileged
    and/or confidential matter.
    We therefore affirm in part and reverse in part, and we remand to the
    trial court for further proceedings consistent with this opinion. In remanding, we
    urge the trial court to adopt a protocol similar to the protocols utilized by the cases
    referenced in this opinion.
    It is ordered that appellants and appellee share the costs herein taxed.
    The court finds there were reasonable grounds for this appeal.
    It is ordered that a special mandate issue out of this court directing the
    common pleas court to carry this judgment into execution.
    A certified copy of this entry shall constitute the mandate pursuant to Rule
    27 of the Rules of Appellate Procedure.
    ___________________________
    MICHELLE J. SHEEHAN, JUDGE
    EILEEN T. GALLAGHER, P.J., and
    RAYMOND C. HEADEN, J., CONCUR