In addition, some states have adopted specific statutes or procedural rules that are designed to protect the privacy interests of absent consumers. For example, California Civil Procedural Rule § 1985.3 prevents a party from issuing a subpoena for personal information from a variety of organizations including medical providers, banks, credit unions, lenders, brokerage firms, or insurance companies, unless the party issuing the subpoena provides a copy to the consumer whose records are sought, and informs them that they have a right to object to the organization furnishing information about them. The rule also requires that the party issuing the subpoena provide the consumer sufficient time to receive, and object, before production is anticipated. The following provides a snapshot of information concerning the number of cases filed in 2013 and 2015.
Nearly 100 Million
Number of Cases Opened in State Courts in 20131
Number of Cases filed in Federal District Courts in 2015.2
If you receive a subpoena or document request asking for personal information about consumers consider the following steps and questions:
- Does your organization maintain an internal procedure or protocol for how to respond to a subpoena or civil discovery request?
- Has your organization made any representations to consumers that might be interpreted as indicating that information will not be provided to a requesting party, or that your organization will take certain steps (g., informing them of the request) before producing such information?
- Does a law within the state in which the consumer is resident restrict or prevent you from complying with the subpoena?
- Does a law within the state from which the subpoena is issued restrict or prevent you from complying with the subpoena?
- Is a protective order in place that would mitigate against privacy harms that might occur from disclosure?
- If so, is the protective order sufficient to protect a consumer’s privacy interest?
- Has a court already evaluated the information request and weighed the privacy implications of production?