In this case we address the applicability of the attorney-client privilege and the work product doctrine to an internal investigation conducted by the respondent, Facebook, Inc. (Facebook). After public reporting revealed potential widespread misuse of Facebook user data by third-party applications (apps), Facebook hired a law firm, Gibson, Dunn & Crutcher LLP (Gibson Dunn), to conduct a far-reaching investigation to identify the extent to which apps had misused user data and advise Facebook on potential resulting legal liabilities. This investigation is known as the app developer investigation (ADI). Around the same time, the Attorney General opened an investigation into Facebook under G. L. c. 93A, focusing on whether Facebook misrepresented the extent to which it protected or misused user data.
As part of that investigation, the Attorney General served Facebook with several civil investigative demands (demands). At issue are six requests contained within these demands that sought the identities of the apps and developers that Facebook reviewed at various stages of the ADI, other information associated with the review of the identified apps, and internal communications about those apps. Facebook asserted that both the attorney-client privilege and the work product doctrine protected this information. The Attorney General filed a petition in the Superior Court seeking an order compelling Facebook to comply with the disputed requests. A judge concluded that most of the information is neither privileged nor work product, as it was not prepared in anticipation of litigation, and that even if it was prepared in anticipation of litigation, it is all factual information.
We conclude that the Attorney General's targeted requests allow Facebook to tailor its responses to the first five of the six
1. Background. a. Facebook Platform. Facebook provides social networking services through its website and mobile app. It has over 1 billion daily users and over 2 billion active accounts. Users generate a variety of data through their use of Facebook. In 2007, Facebook launched the first version of the Facebook Platform. The Platform connects Facebook users with third-party app developers and enables users to share Facebook data with the apps and developers. The Platform allows these third parties to integrate their apps with the data generated by users and collected by Facebook. For our purposes, the practical effect of the Platform is that third-party developers are given access to Facebook user data. The Attorney General alleges that over 9 million apps and websites had integrated with the Platform as of March 31, 2012.
Use of the Platform by apps and developers is governed by various policies, including Facebook's Platform policy, terms of service, and data use policy. As relevant here, these policies prohibited third-party developers from selling or licensing the data they obtained from Facebook users. The policies also prohibited developers from sharing user data with "any ad network, data broker or other advertising or monetization-related service." A developer had to register to use the Platform and affirmatively agree to comply with the various policies governing use of the Platform;
Facebook has an internal enforcement program that monitors and responds to developer misuse of the Platform. This is known as its developer operations team.
In April 2014, Facebook revised its Platform and the accompanying policies to improve protections for user data.
b. Cambridge Analytica incident. In March 2018, several news outlets reported on an incident involving Facebook, an individual named Aleksandr Kogan, and a company named Cambridge Analytica. Briefly, Kogan used an app on the prior version of the Platform to access and collect the data of as many as 87 million Facebook users worldwide, roughly 70 million of whom were located in the United States. Kogan sold this data to Cambridge Analytica, a political data analytics and advertising firm, and other related entities. Cambridge Analytica used this data to create "psychographic profiles" on the Facebook users. Cambridge Analytica then used these profiles to target Facebook users with political advertising. According to Facebook, this conduct violated
The 2018 reporting of this incident sparked a wave of litigation against and investigations into Facebook. By the end of 2018, Facebook faced at least five securities class actions, eight derivative actions, three books and records actions, and thirty-nine consumer-based suits, most of which also were class actions.
Counsel also developed the framework for the ADI. In broad terms, the ADI consists of three separate phases. The first phase focuses on detection and identification. The goal of this phase is
The ADI involves various types of personnel. Facebook's in-house legal team and Gibson Dunn hired multiple forensic consulting firms to assist with the investigation. At times, the ADI has included as many as 300 internal and external experts. Despite the number of people involved in the investigation, Facebook represents that it has taken various steps to ensure that the ADI remains confidential. This includes limiting communications about the investigation and restricting access to documents.
d. Attorney General's investigation. Shortly after the media coverage of the Cambridge Analytica incident in March 2018, the Attorney General began investigating Facebook under G. L. c. 93A, § 6. The purpose of the investigation is to identify any other apps that misused user data and assess whether Facebook followed its policies and commitments to its users regarding user data. Over the course of the investigation, the Attorney General has issued three demands. The first demand was issued in April 2018. The second demand, issued in June 2018, sought information on the apps that Facebook had suspended and information on Facebook's internal policies and procedures surrounding apps. As part of its response, Facebook provided the Attorney General with detailed information on how it has conducted the ADI.
The third demand, issued on November 5, 2018, is the subject of this dispute. In this demand, the Attorney General sought the
There are six contested requests at the center of this dispute. The judge below described these requests as follows:
For each of these five requests, the Attorney General provided that "[i]n lieu of documents in response to this Request, the Commonwealth will accept information in a spreadsheet format." Facebook therefore is not required to produce any existing documents sent to or created by the ADI team in regard to the first five requests; rather, it simply is required to assemble a list of apps that is responsive to each request and provide the additional requested information concerning those apps. The sixth request is different, however; it seeks internal communications about many of those apps.
e. Prior productions. Throughout the investigation, Facebook has engaged extensively with the Attorney General. Facebook has provided the Attorney General with the name of every app and developer that it has suspended from the Platform.
Facebook also has produced at least 15,000 documents across seven productions in response to the third demand. This includes communications with developers and requests for information. Similarly, Facebook has met with the members of the Attorney General's investigative team on numerous occasions.
f. Public statements about ADI. Facebook has made several public statements about the ADI since its inception. Facebook publicly announced its investigation into the Kogan incident on March 21, 2018. In this statement, Facebook said, "We will investigate all apps that had access to large amounts of information before we changed our platform in 2014 to reduce data access, and we will conduct a full audit of any app with suspicious activity. If we find developers that misused personally identifiable information, we will ban them from our platform." It also said that it would "tell people affected by apps that have misused their data" and expand its program for rewarding people who report data misuse by app developers.
In the months that followed, Facebook made other public statements about the ADI. On April 11, 2018, Mark Zuckerberg, the chief executive officer of Facebook, testified before Congress, stating,
He also told Congress that, at that time, "around 200 apps ... from a handful of developers" had been suspended pending investigation into whether they misused data.
Facebook provided another public update in August 2018. It stated that it had suspended an app "for failing to agree to our request to audit and because it's clear that [the app] shared information with researchers as well as companies with only limited protections in place." Facebook also informed the public, "Since launching our investigation in March, we have investigated thousands of apps. And we have suspended more than 400 due to concerns around the developers who built them or how the information people chose to share with the app may have been used — which we are now investigating in much greater depth."
Finally, in September 2019, Facebook announced:
g. Procedural history. In August 2019, the Attorney General filed a petition to compel compliance with the third demand in the Superior Court. Facebook opposed the petition, arguing that the requests sought information protected by the attorney-client privilege and work product doctrine. A hearing was held on the petition on November 7, 2019.
In January 2020, a Superior Court judge largely granted the Attorney General's petition. He first concluded that the work product doctrine did not apply because the ADI was a continuation of Facebook's ongoing app enforcement program, rather than done in anticipation of litigation. He also concluded that even if the app information was work product, it non-etheless was discoverable because it constituted fact work product and the Attorney
2. Discussion. a. Waiver of objections to demand. Before reaching the merits, we first address the Attorney General's argument that Facebook has waived its objections to the third demand by failing to move to modify or set it aside under G. L. c. 93, § 6(7). The Attorney General argues that § 6(7), as well as our decision in Attorney Gen. v. Bodimetric Profiles, 404 Mass. 152 (1989) (Bodimetric), require recipients of demands to file such a motion to preserve any objections to a demand, something that Facebook did not do here.
In Bodimetric, we held that "failure to bring such a motion pursuant to [§ 6(7)] constitutes a waiver by the person to whom the [demand] is served." Bodimetric, supra at 154. The recipient of the demand in that case refused to comply with it and merely sent a letter stating its objections to the Attorney General. Id. at 155. We further explained that "[t]he recipient [of a demand] may not remain passive ... raising legal arguments only after the Attorney General brings a motion to compel." Id. Despite the fact that the recipient had "[sent] a letter to the Attorney General stating its objections to the [demand,] ... [m]erely informing the Attorney General of its refusal to comply [did] not suffice to shift the burden to the Attorney General to take the next legal step." Id. The judge below rejected this argument, concluding that, under Bodimetric, a judge has the discretion to deem a failure to file a timely motion for relief as a waiver of the right to object to the
We agree that Facebook has not waived its objections to the demand. Whereas the recipient of the demand in Bodimetric refused to comply altogether, Facebook's engagement with the Attorney General has been far from passive. Instead, Facebook has worked with the Attorney General and communicated its objections to the third demand, including its assertions of privilege. Facebook has also complied with the requests in the demand that Facebook believes call for nonprivileged information. Moreover, finding waiver here could discourage cooperation with the Attorney General and result in increased litigation whenever the Attorney General serves a demand. We therefore conclude that Facebook has not waived its objections to the demand.
b. Legal standards. This case implicates both the attorney-client privilege and the work product doctrine. We review the applicability of both de novo. Commissioner of Revenue v. Comcast Corp., 453 Mass. 293, 302 (2009) (Comcast). Facebook, as the party asserting the protections, bears the burden of proving that both the privilege and the work product doctrine apply. Id. at 304. See Clair v. Clair, 464 Mass. 205, 215 (2013) ("The party asserting attorney-client privilege has the burden of establishing that the privilege applies to the communications at issue").
c. Attorney-client privilege. We begin with the attorney-client privilege. The attorney-client privilege protects "all confidential communications between a client and its attorney undertaken for the purpose of obtaining legal advice." Suffolk Constr. Co. v. Division of Capital Asset Mgt., 449 Mass. 444, 448 (2007). See Comcast, 453 Mass. at 303 (elements of privilege). See also Mass. G. Evid. § 502(b) (2021).
Despite the strong protections given to material subject to the attorney-client privilege, "[w]e consistently have held that the privilege is to be construed narrowly." Clair, 464 Mass. at 215, citing Comcast, 453 Mass. at 304. We do so because the privilege "frustrate[s] the investigative or fact-finding process ... [and] create[s] an inherent tension with society's need for full and complete disclosure of all relevant evidence during implementation of the judicial process" (citation omitted). Comcast, supra. See Hanover Ins. Co., 449 Mass. at 615, quoting In re Grand Jury Investigation No. 83-2-35, 723 F.2d 447, 451 (6th Cir. 1983), cert. denied, 467 U.S. 1246 (1984). See also Lluberes v. Uncommon Prods., LLC, 663 F.3d 6, 24 (1st Cir. 2011) ("attorney-client privilege must be narrowly construed because it comes with substantial costs and stands as an obstacle of sorts to the search for truth" [citation omitted]). We also have recognized that the privilege can be waived. Comcast, supra at 303.
In balancing these competing concerns and determining whether the privilege applies, we focus on the distinctions between attorney-client communications and underlying facts. As we explained in Chambers v. Gold Medal Bakery, Inc., 464 Mass. 383, 392 (2013):
In Upjohn, supra, the United States Supreme Court explained this distinction:
This distinction is important and somewhat collapsed by the advocacy in the instant case. Facebook interprets the requests as seeking confidential communications between Facebook and its outside counsel or information that does not exist independently of such communications. This fails to take into account the fact that the underlying data about apps' breaches of privacy policies is all independently discoverable and cannot be protected by Facebook's initiation of its own factual investigation. The attorney-client privilege only protects communications between the attorney and the client about such factual information, not the facts themselves.
i. First five requests. The first five requests do not require the production of any communications between Facebook and counsel
The app information sought by the Attorney General in the first five requests differs from the type of information that has been deemed covered by the attorney-client privilege. For example, Upjohn involved responses to questionnaires and interview notes that included responses to questions. See Upjohn, 449 U.S. at 397. Corporate employees communicated factual information to the corporation's attorneys in response to requests from the attorneys for information. The Court held that such communications of factual information were covered by the privilege. Id. at 395. Similarly, in Federal Trade Comm'n v. Boehringer Ingelheim Pharms., Inc., 180 F.Supp.3d 1, 30-32 (D.D.C. 2016) (Boehringer III), aff'd, 892 F.3d 1264, 1266 (D.C. Cir. 2018) (Boehringer IV), the court held that the privilege shielded, among other things, PowerPoint presentations and spreadsheets that summarized facts and analyzed how various litigation and settlement outcomes would have an impact on the company financially. Company employees prepared the documents and sent them to the company's general counsel at her request to assist her with settlement negotiations. Boehringer III, supra at 32. In affirming the conclusion that the documents were privileged, the United States Court of Appeals for the District of Columbia Circuit emphasized:
Boehringer IV, supra at 1268.
In the first five requests, the Attorney General is not requiring the production of documents or communications that were exchanged between Facebook (including its employees) and its attorneys, and the requests permit Facebook to comply without disclosing any such communications. Therefore, Facebook cannot rely on the attorney-client privilege as a basis for refusing to comply with these requests. We reiterate that "[t]he client cannot be compelled to answer the question, `What did you say or write to the attorney,'" particularly where those communications occur during an internal investigation (citation omitted). See Upjohn, 449 U.S. at 396. Facebook is not being compelled to answer those questions, however, and it does not have to produce any communications with its attorneys. Given the flexibility provided to Facebook in its response, the factual information it is required to produce in response to the first five requests is thus not covered by the attorney-client privilege. As will be explained infra, however, as framed, the requests do implicate the work product doctrine.
ii. Sixth request. The sixth request broadly seeks "[a]ll of Facebook's internal communications and internal correspondence concerning" several categories of apps sought in the other requests. Facebook refused to comply with this request and asserted that it called for the production of privileged communications. The judge below ordered Facebook to produce a detailed privilege log identifying any documents it was withholding on the basis of the privilege. While this case proceeded on appeal, Facebook provided the Attorney General with at least two privilege logs responsive to this request.
As explained above, the attorney-client privilege certainly applies to communications between counsel and client made as part of an internal investigation that is undertaken to gather facts for the purposes of providing legal advice. See, e.g., Grand Jury
We therefore agree with the judge below that the appropriate course of action is for Facebook to prepare a detailed privilege log so that the Attorney General can challenge any assertions of privilege.
d. Work product doctrine. Facebook also argues that the app information requested is protected by the work product doctrine. The work product doctrine "protects (1) `documents and tangible things,' [prepared] (2) `by or for another party or by or for that other party's representative (including his attorney, consultant, surety, indemnitor, insurer, or agent),' and (3) `in anticipation of litigation or for trial.'" McCarthy v. Slade Assocs., Inc., 463 Mass. 181, 194 (2012), quoting P.M. Lauriat, S.E. McChesney, W.H. Gordon, & A.A. Rainer, Discovery § 4:5 (2d ed. 2008 & Supp. 2011).
A document is prepared in anticipation of litigation if, "in light of the nature of the document and the factual situation in the particular case, the document can be fairly said to have been prepared because of the prospect of litigation" (emphasis added). Comcast, 453 Mass. at 317, quoting United States v. Adlman, 134 F.3d 1194, 1202 (2d Cir. 1998) (Adlman II). Anticipation of litigation does not have to be the primary purpose or motivation. Comcast, supra at 317 n.28. But a document that would have been prepared "irrespective of the prospect of litigation" is not covered by the work product doctrine (citation omitted). Id. at 318-319. See Adlman II, supra at 1202 ("documents that are prepared in the ordinary course of business or that would have been created in essentially similar form irrespective of the litigation" not covered).
If the work product doctrine applies, the court must determine what type of work product is at issue. Rule 26(b)(3) differentiates between two types of work product. The greatest protection is provided to opinion work product, or work product that conveys the "mental impressions, conclusions, opinions, or legal theories of an attorney or other representative of a party concerning the litigation." See Mass. R. Civ. P. 26(b)(3), 365 Mass. 772 (1974). Opinion work product "may be reflected in interviews, statements, memoranda, correspondence and in countless other tangible and intangible ways." Miller v. Holzmann, 238 F.R.D. 30, 32 (D.D.C. 2006). See Securities & Exch. Comm'n v. Collins
In contrast, all other work product is discoverable "upon a showing that the party seeking discovery has substantial need of the materials ... and that he is unable without undue hardship to obtain the substantial equivalent of the materials by other means." Mass. R. Civ. P. 26(b)(3). This type of work product is often referred to as fact work product. See Comcast, 453 Mass. at 314 (differences between opinion and fact work product); Cahaly v. Benistar Prop. Exch. Trust Co., 85 Mass.App.Ct. 418, 425 (2014) (same). Although it is discoverable in some circumstances, fact work product is still protected so that "each side must undertake its own investigation of the relevant facts and not simply freeload on opposing counsel." Boehringer II, 778 F.3d at 156.
The line between fact work product and opinion work product is not always clear. Indeed, "[w]hen a factual document selected or requested by counsel exposes the attorney's thought processes and theories, it may be appropriate to treat the document as opinion work product, even though the document on its face contains only facts." Id. at 151. Yet "not every item which may reveal some inkling of a lawyer's mental impressions, conclusions, opinions, or legal theories is protected as opinion work product." In re San Juan Dupont Plaza Hotel Fire Litig., 859 F.2d 1007, 1015 (1st Cir. 1988). The focus, selection, or arrangement of the facts must reflect the attorney's thought process in some "meaningful way." Boehringer II, supra. See Boehringer III, 180 F. Supp. 3d at 26, quoting Boehringer II, supra at 152 (fact information is not opinion work product where "[n]one of the documents reveal[s] how [the attorney] analyzed the data she requested or what data or scenarios she presented to her client. In other words, she did not `sharply focu[s] or wee[d]' the facts contained in these documents such that revealing these facts would reveal her legal impressions of the case"). Importantly, where a document contains both fact and opinion work product, a court may still order its production if the opinion portions can
Applying these principles, we conclude that the app information required to be produced is clearly covered by the work product doctrine. We also conclude that if this app information is not opinion work product, Facebook must disclose that information, because the Attorney General has demonstrated a substantial need for the information and could not obtain it without undue hardship. The difficult issue is separating fact from opinion work product in the first five requests. We set out the mode of analysis here but remand to the judge its application to the specific requests.
i. In anticipation of litigation. We begin with the threshold question whether the information is protected by the work product doctrine. In assessing whether the app information required to be produced is work product, the parties focus on the third element — whether the app information was prepared "in anticipation of litigation." The judge below did as well, concluding that Facebook's existing app enforcement efforts and its public statements about the ADI demonstrate that the ADI was not done in anticipation of litigation.
We disagree with the judge on this point. We recognize that the existence of an ongoing compliance program is an important consideration when assessing whether an internal investigation was undertaken in anticipation of litigation. Indeed, simply funneling an organization's investigation through outside counsel does not bring with it the protection of the work product doctrine
Here, however, the ADI is meaningfully distinct from Facebook's ongoing enforcement program. It is staffed by outside counsel and outside forensic consultants, and it has its own distinct methodology. It is focused on past violations, not ongoing operations, and it serves a very different purpose: defending Facebook against the vast litigation it is facing, rather than just improving its ongoing operations. The record here does not support the contention that Facebook's compliance and enforcement team could have or would have conducted a massive investigation into potential past misconduct in the ordinary course of business.
The Attorney General argues that "the purpose of the ADI was to improve the Platform and remedy the loss of user trust" and not because of impending litigation. The fact that the ADI also serves business purposes does not alter the analysis. In Comcast, 453 Mass. at 317 n.28, we rejected a formulation of the work product doctrine that excludes documents that were primarily prepared for a business or other nonlitigation purpose. Instead, we made clear that the work product doctrine applies as long the corporation "had `the prospect of litigation in mind.'" Id. at 318, quoting Adlman II, 134 F.3d at 1204. See Comcast, supra at 319 (documents "created `because of' the reasonable possibility of litigation" covered by doctrine). That the ADI also serves Facebook's business purposes independent of litigation, therefore, does not mean that the work product doctrine does not apply.
The determinative question is whether Facebook compiled the app information because of the prospect of litigation or whether it would have compiled the app information regardless of the prospect of litigation. See Comcast, 453 Mass. at 318-319 (document prepared "irrespective of the prospect of litigation" is not covered by work product doctrine). Given the focus of the ADI, its structure and design, and its litigation purposes, we conclude
ii. Fact or opinion work product. The next issue is whether the app information is properly considered opinion work product, which is only discoverable in extreme circumstances, or fact work product, which is discoverable if the Attorney General demonstrates a substantial need and undue hardship. See Mass. R. Civ. P. 26(b)(3). The judge below concluded that the app information is not opinion work product, because the requests seek "indisputably factual information" like the identity of apps or developers. Facebook counters that "but for the involvement, analysis, and advice of counsel, the [app information] the Attorney General seeks would not exist," because it is the product of "criteria designed by, and reflecting the legal judgment of, Facebook's counsel." For this reason, Facebook argues that the app information should be considered opinion work product.
In deciding whether this is opinion work product, we focus on what the specific information requested would reveal and not on the ADI as a whole. We also focus on what the requested information would divulge about the confidential as opposed to the publicly revealed aspects of the ADI process, that is, whether the documents required to be produced reveal confidential aspects of the ADI process or just those publicly announced.
We begin with the recognition that the underlying factual information about the apps, and the potential privacy violations, that the Attorney General sought was not protected by the work product doctrine. Had Facebook not informed the Attorney General how it conducted its own factual investigation, the Attorney General would have been free to perform her own thorough investigation of all the underlying factual information to uncover data misuse by apps.
The requests, however, do seek the names of the apps, and other associated information, identified by Facebook's own investigatory process. They do so tracking Facebook's own methodology and public disclosures. This clearly asks for work product; the only question is whether it is fact or opinion work product.
In answering this question, we focus on the flexibility allowed in the response, the particular factual information requested, and the previous public disclosures. As drafted, the requests allow Facebook to tailor its response to remove any and all notes, impressions,
Facebook also previously has publicized general statements regarding the ADI reflected in the five requests, thereby further reducing the risk that the disclosure of the names of the apps and some of the additional factual information requested about those apps will reveal confidential opinion work product. See New York Times Co. v. United States Dep't of Justice, 939 F.3d 479, 496 (2d Cir. 2019) ("We first evaluate whether ... public statements about the memoranda were specific enough to have effectuated disclosure of parts of the memoranda and accompanying exhibits, thereby waiving the work product privilege with respect to those parts"). That being said, the specifics of the five requests and additional information requested must be considered to determine whether fact or opinion work product is being sought, or whether further review is required to make this determination.
We begin with the five requests, and the names of the apps that fall into these requests. They are:
All these public disclosures are important because a corporate defendant cannot publicize its "internal investigation to assert the propriety of its actions to third parties and simultaneously... block third parties from testing whether its representations about the internal investigation are accurate." Grand Jury Investigation, 437 Mass. at 354. Facebook also has provided to the Attorney General more specific information on the ADI framework and an overview of the types of criteria that guide each phase. See In re Steinhardt Partners, L.P., 9 F.3d 230, 235 (2d Cir. 1993) (disclosure of protected thought processes to adversary waives work product protection). This more specific information also helped the Attorney General frame the five requests. In this unusual context, where (1) the underlying facts on the apps and their data breaches are discoverable; (2) the general scope and methodology, and some of the results, of Facebook's internal investigation have been made public as part of its defense of its actions; and (3) Facebook already explained its more specific methodology for conducting its factual investigation to its adversary the Attorney General, it is difficult to discern how opinion work product would be divulged by production of the names of the apps, and most of the other purely factual information requested in the first five categories of apps. See Boehringer II, 778 F.3d at 152, quoting In re San Juan Dupont Plaza Hotel Fire Litig., 859 F.2d at 1015 ("There is no `real, nonspeculative danger of revealing the lawyer's thoughts' when the thoughts are already well-known"). See also New York Times Co., 939 F.3d at 495, quoting Rockwell Int'l Corp. v. United States Dep't of Justice, 235 F.3d 598, 605 (D.C. Cir. 2001) ("common sense suggests that verbal description of the contents of a document, if sufficiently specific, is as `inconsistent
Nonetheless, a careful comparison of the specific factual information requested, and the particular public statements already made regarding the investigatory process, is necessary to determine whether the information requested will reveal counsel's thought processes as well as purely factual information. If undisclosed strategic decision-making by counsel, including the assessment of legal risk or liability, is revealed by the factual analysis, such factual analysis may be classified as opinion work product. A good example of a request posing such risk is the second request, which would force Facebook to identify which apps it determined, based on its "`past investigative experience,' present[ed] an elevated risk of potential policy violations." This reference to past investigatory experience and evaluation of elevated risk of violations appears to seek to reveal undisclosed aspects of the ADI process that may divulge counsel's investigatory practices, legal risk assessment, and other thought processes and impressions. This is quite different from some of the more straightforward factual requests, seeking for example the names and details concerning the 6,000 apps that Facebook has targeted for having a large number of users or the groups of apps that were reported to Facebook outside the ADI process.
Some of the categories of additional factual information requested raise similar concerns. In particular, for some of the apps, the Attorney General is seeking the "basis and initial source(s) of reports, allegations or concerns of data misuse of user information obtained or accessed through the app." Whether at least this last category of additional information seeks to probe into counsel's undisclosed thought processes requires further investigation by the judge.
In sum, we cannot conclude on the record before us that none of the information requested falls into the category of opinion work product, as the judge determined. It is true that the app information here is readily distinguishable from more typical examples of opinion work product, such as the memorandum in Comcast that contained "a detailed analysis of various corporate entities and address[ed] various options, and attendant litigation risks, for [a] stock sale in light of applicable Massachusetts law," Comcast, 453 Mass. at 300, or the memorandum in Schaeffler v. United States, 806 F.3d 34, 43-45 (2d Cir. 2015), that analyzed the tax implications of business transactions and included advice related to potential
iii. Substantial need and undue hardship. Although further line drawing is required by the judge to determine what information requested is fact work product and what is opinion work product, we recognize, based on the record before us, that a significant amount of information ultimately will be determined to be fact work product. We therefore address the issue whether the fact work product must be produced. This requires the Attorney General to demonstrate substantial need and undue hardship. See Mass. R. Civ. P. 26(b)(3). Absent such substantial need and undue hardship, the Attorney General would be expected and required to do her own investigation. See Baker v. General Motors Corp., 209 F.3d 1051, 1054 (8th Cir. 2000) (fact work product "not discoverable unless the party seeking discovery has a substantial need for the materials and the party cannot obtain the substantial equivalent of the materials by other means" [emphasis added]).
Here, several considerations support the Attorney General's claim of a substantial need for the fact work product. The app information is certainly relevant and important; it is central to the Attorney General's investigation, as it identifies apps that may have misused user data on the prior version of the Platform. See Cahaly, 85 Mass. App. Ct. at 425, citing McCarthy, 463 Mass. at 195 (substantial need exists where work product at issue central to claims). The Attorney General has a mandate to investigate such potential misuse of Massachusetts users' data as well as potential misrepresentations by Facebook, and considerable authority with which to do so. See Exxon Mobil Corp. v. Attorney Gen., 479 Mass. 312, 323-324 (2018), cert. denied, 139 S.Ct. 794 (2019) (Attorney General has "manifest interest in enforcing G. L. c. 93A"). There is also a strong public interest in disclosure in cases in which the Attorney General is investigating potential unfair or deceptive trade practices involving Massachusetts consumers that is absent in a typical civil dispute. See Boehringer III, 180 F. Supp. 3d at 14, quoting Boehringer II, 778 F.3d at 157 ("in the investigatory context here," Federal Trade Commission "was entitled to learn facts on a broader scale than [that] available to a typical civil litigant").
The great difficulty in obtaining this information also is obvious. Given the scope of the ADI, the millions of apps to be analyzed, and the vast quantity of information at issue, uncovering this otherwise discoverable factual information would be a
Finally, it is unlikely that the Attorney General would be able to obtain the substantial equivalent of this app information, even with extraordinary efforts. As the Attorney General argues, only Facebook has access to the information and data that are necessary to identify the apps that have potentially misused user data. An important part of the ADI framework is Facebook's own knowledge of and experience with the Platform and the apps and developers that operate on it. Through its design of the Platform and its ongoing efforts to police the Platform, Facebook has developed valuable expertise that has guided the ADI, relying on its own internal knowledge and expertise regarding its Platform and apps to guide its internal searches. Without such expertise, therefore, it is unclear whether the Attorney General would be able to replicate the work of the ADI and identify many of the apps and developers that may be misusing user data.
This is not a case where the internal investigation involved simply interviewing key employees and other witnesses or reviewing a manageable number of documents, tasks that can be easily replicated by third parties or government investigators. See, e.g., In re Int'l Sys. & Controls Corp. Sec. Litig., 693 F.2d 1235, 1240 (5th Cir. 1982) ("discovery of work product will be denied if a party can obtain the information he seeks by deposition"); Gay v. P.K. Lindsay Co., 666 F.2d 710, 713 (1st Cir. 1981), cert. denied, 456 U.S. 975 (1982) ("there is in general no justification for discovery of the statement of a person contained in work product materials when the person is available to be deposed"). Rather, it is an enormously complex effort in which counsel and the ADI team analyzed millions of apps and enormous amounts of data. This analysis was also enabled in large part by Facebook's prior expertise in developing and policing the Platform. Facebook is not only in a far better position than the Attorney General, but also essentially uniquely positioned to identify which apps potentially misused user data. Therefore, we are persuaded that the Attorney General would be unable to otherwise obtain the substantial equivalent of the factual app information, even with an extraordinary expenditure of time and resources. See Ward v. Peabody, 380 Mass. 805, 817-818 (1980) (that materials are not available from any other source is "favorable to requiring production").
As explained above, the Attorney General undoubtedly would incur enormous costs and delay in her investigation if the app information is not disclosed. Through the ADI, Facebook has reviewed millions of apps to determine whether they potentially misused user data. When the Attorney General filed the petition to compel in August 2019, the ADI had been operating for nearly one and one-half years. Moreover, so great was the task of the ADI that the investigative team has at times swelled to include hundreds of outside experts. There is no other way for the Attorney General to try to obtain this information other than to essentially recreate and duplicate the work of the ADI. See, e.g., In re Chrysler Motors Corp. Overnight Evaluation Program Litig., 860 F.2d at 846 (undue hardship exists where "replication of the [work product] would involve duplication of effort and considerable delay and expense"); Washington Bancorp. v. Said, 145 F.R.D. 274, 279 (D.D.C. 1992) ("the time and money it would take" to review 2,400 boxes of documents to create document index constitutes undue hardship because "no value and only waste in requiring such a duplicative effort"). Facebook acknowledges this reality; its position is simply that the Attorney General must conduct her own independent investigation for reasons of adversarial fairness. To seek to obtain the app information, therefore, the Attorney General would have to expend an
In sum, we conclude the Attorney General has demonstrated both substantial need and undue hardship for the fact work product about the apps.
3. Conclusion. For the reasons described above, we conclude that the first five requests are not covered by the attorney-client privilege, as they do not require the production of communications between Facebook and its counsel. As the sixth request does include communications covered by the attorney-client privilege, Facebook must produce a privilege log as required by the Superior Court judge. We therefore affirm the judge's order in these respects.
We also conclude, however, that the work product doctrine applies to the documents requested, and a remand is required to determine whether some of the documents requested constitute opinion work product. We therefore reverse and remand the decision of the Superior Court judge concluding that the work product doctrine does not apply and that, even if it did, none of the documents required to be produced would reveal opinion work product. Finally, we conclude that the Attorney General has demonstrated that there is substantial need and undue hardship requiring the production of the documents that do constitute fact work product.