Free Motion for Protective Order - District Court of Federal Claims - federal

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 1 of 12

EXHIBIT A

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 2 of 12

IN THE UNITED STATES COURT OF FEDERAL CLAIMS ) ) ) ) ) ) ) ) ) ) ) )

ATHEY, ROBERT M., et al., Plaintiffs, v.

C.A. No. 99-2051C (Senior Judge Smith)

THE UNITED STATES, Defendant.

PROTECTIVE ORDER Discovery and other proceedings in this case pending before the Court concerning the payment by the Department of Veterans Affairs ("VA") of a lump-sum payment to retired or separated, employees, pursuant to title 38 United States Code or title 5 United States Code, may require the parties to disclose confidential information (as defined herein) of the parties. Accordingly, it is hereby ORDERED BY THE COURT: 1. The term "Confidential Material" shall refer to confidential, privileged, or sensitive

personal information (as such term is defined in 38 U.S.C. § 5727 (19)), disclosed in discovery or other proceedings in this case. Subject to the provisions of Paragraph 10 below, material shall be deemed Confidential Material when so designated in the manner described in Paragraphs 3 and 4 below. After disclosure of any "Confidential Material," all copies made of that material, and all notes made therefrom and all references made thereto, of any kind whatsoever, shall also constitute "Confidential Material." 2. The term "Confidential Privacy Act Protected Material" shall refer to records

produced by the United States Government or the VA that fall within the scope of the Privacy Act, 5 U.S.C. § 552a, and that are disclosed in discovery or other proceedings in this case.

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 3 of 12

Subject to the provisions of Paragraphs 4 and 5(b) below, Confidential Privacy Act Protected Material shall be a subset of, and shall be treated under this Protective Order in the same manner as Confidential Material. 3. Subject to Paragraph 4 below, the designations of Confidential Material may be

made by the disclosing party by placing or affixing on documents disclosed the word "confidential" or by stating in a letter to counsel for the receiving party or parties that all or any portion of the documents accompanying that letter are "Confidential Material" within the meaning of this agreement and order. 4. The designation of Confidential Privacy Act Protected Material may be made by

defendant by placing or affixing on documents the word "confidential" - Privacy Act Protected" or by stating in a letter to counsel for the receiving party or parties that all or any portion of the documents accompanying that letter are "Confidential Privacy Act Protected Material" within the meaning of this order. 5. Each person receiving Confidential Material shall store and maintain such

Confidential Material in his or her possession at a location and in a manner sufficient to protect such material against unauthorized disclosure. a. Plaintiffs shall receive, gather, store, back up, maintain, use, disclose and

dispose of Confidential Material produced by the VA only in compliance with terms of this Protective Order and applicable federal information confidentiality and security laws, regulations, and policies. Applicable federal information security regulations include all Federal Information Processing Standards ("FIPS") and Special Publication issued by the National Institute of Standards and Technology ("NIST"). Specifically with regard to Confidential Material produced

2

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 4 of 12

by VA in this action on electronic storage media, plaintiffs must maintain, transmit and store such data only in encrypted form, using an encryption program certified by NIST as FIPS 140-2 compliant. b. All Confidential Privacy Act Protected Material produced by VA to plaintiffs,

together with any other Confidential Material that contains "sensitive personal information", as such term is defined in 38 U.S.C. § 5727(19), without regard to the media through which such Material was produced, must be stored and maintained at all times at the offices of plaintiffs' counsel. Further, all encryption keys supplied by defendant or defendant's agents with electronic storage media must be kept exclusively in the offices of plaintiffs' counsel and must be continuously protected in such a way as to not be disclosed to any other person under any circumstances. Absent prior approval of this Court, no person to whom plaintiffs are authorized to disclose such information pursuant to Paragraph 6 below, shall be allowed to remove Confidential Privacy Act Protected Material or any other Confidential Material containing sensitive personal information, including all copies, abstracts, compilations, summaries or any other form of reproducing or capturing such Material, from the offices of plaintiffs' counsel. c. In the event of a "data breach", as such term is defined in 38 U.S.C. § 5727(4), of

any Confidential Material in the possession, custody or control of plaintiffs, plaintiffs shall, immediately after discovery of such breach, notify (1) the Court, (2) the defendant and (3) appropriate law enforcement entity(ies) that such breach has occurred. To the extent possible, plaintiffs' notice shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when and where the Confidential Material was placed at risk or compromised), and any other information that plaintiffs consider relevant. Plaintiffs shall

3

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 5 of 12

cooperate with defendant and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any data breach. Plaintiffs will also cooperate with defendant in any civil litigation to recover Confidential Information, to obtain monetary or other compensation from a third party for damages arising from any data breach, and to obtain injunctive relief against any third party arising from, or related to, the data breach. d. In the event of a data breach, plaintiffs shall use their best efforts further

undertake the following actions: (1) as soon as possible after the data breach, engage an independent company, which company shall be pre-approved by VA, to conduct a risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any Confidential Material involved in the data breach; (2) promptly upon the conclusion such risk analysis, provide detailed findings of such independent company to VA; and (3) if VA determines, based on the findings of such risk analysis that a reasonable risk exists for the potential misuse of Confidential Material involved in the data breach, provide credit protection services in accordance with 38 C.F.R. § 75.118(a) and (b). 6. Confidential Material shall be used by the receiving party solely for the purpose of

conducting litigation in this case, Athey v. United States, Case No. 99-2051C (Fed.Cl.), pending in the United States Court of Federal Claims and not for any business or other purpose whatsoever, except as provided in this Protective Order. Confidential Material shall be disclosed only to attorneys for plaintiffs, attorneys for the United States, persons regularly employed in such attorneys' offices, or, subject to the provisions of Paragraph 7 below, and other persons as reasonably necessary for the litigation of this action. Nothing contained in this Protective Order

4

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 6 of 12

shall prevent or in any way limit or impair the right of counsel for the United States to disclose to any agency of the United States (including other divisions and branches of the Department of Justice) any document or information regarding any potential violation of law or regulation or, subject to procedures that maintain the confidentiality of Confidential Material consistent with this agreement and Protective Order, prevent or limit in any way the use of such documents and information by an agency in any proceeding regarding any potential violation of law or regulation. 7. With the exception of attorneys for plaintiffs in the Athey case, attorneys for the

United States, and persons regularly employed in such attorneys' offices, any person to whom Confidential Material is to be disclosed by the receiving party, including any plaintiff who is a party to this action, shall first be advised by an attorney for the receiving party or parties that pursuant to this Protective Order such person may not divulge any such Confidential Material to any other person not authorized under Paragraph 6 above to have access to such Confidential Material. The attorney shall secure from each person a declaration in the form attached hereto, stating that such person has read this Protective Order and agrees to be bound by it. Such declaration shall be maintained in the possession of the attorney securing the declaration until further order of the Court. 8. Subject to order of the Court, all Confidential Material submitted to or filed with

the Court or used in any deposition, together with that portion of any pleading, motion, deposition transcript or other document submitted or presented to or filed with the Court containing Confidential Material shall be placed under seal and shall not be available to persons other than the Court and authorized employees of the Court, the attorneys of record for the parties, and

5

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 7 of 12

persons authorized by this Protective Order. a. Should a party seek to use Privacy Act protected records or other records

containing "sensitive personal information" in open Court or at trial, orally or through documents, including as trial exhibits, or seek to file such information as part of a public filing (e.g., a pleading, motion, exhibit or expert report), that party must first either (1) seek an Order from the Court ruling that such Confidential Material can be publicly filed pursuant to the prior authorization of the person(s) identified in such Confidential Material, attaching to any such motion a legally sufficient written authorization of such person(s); or (2) file a copy of such Confidential Material that is sufficiently redacted to meet requirements of 45 C.F.R. § 164.514(b). b. In the event that a party seeks to use any Confidential Material other than

Privacy Act protected records or other records containing "sensitive personal information" in open Court or at trial, orally or through documents, including as trial exhibits, or seek to file such information as part of a public filing, the parties shall attempt to further stipulate as to the procedures for use of Confidential Material in such proceedings. If necessary, any dispute regarding the procedures for use of such Confidential Material in deposition or Court proceedings shall be submitted to the Court for resolution. 9. Nothing in the foregoing provisions of this Protective Order shall be deemed to

preclude plaintiffs, the United States, or third parties from seeking and obtaining, on an appropriate showing, additional protection with respect to the confidentiality of documents or other discovery material or from seeking and obtaining leave to disclose documents or other discovery material beyond the terms of this Protective Order.

6

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 8 of 12

10.

If a party determines that a previously produced document inadvertently was not

identified as containing protected information, the producing party shall give notice in writing that the document is to be treated as containing protected information, and thereafter the designated document shall be treated in accordance with this Protective Order or returned to the producing party if the material is identified as privileged. 11. Nothing in the foregoing provisions of this Protective Order shall be deemed to

preclude plaintiffs or the United States from objecting to the designation of documents or other discovery material as Confidential Material. In such event, the party designating the documents or other discovery materials as Confidential Material shall have the burden to file a motion for a Protective Order with the Court demonstrating that there is good cause to designate the documents or materials as such and that they properly are subject to treatment under this Protective Order. a. The party seeking to challenge a designation must make such challenge

within thirty (30) days of receipt of the challenged information. b. A party that elects to initiate a challenge to a producing party's

confidentiality designation must do so in good faith and must begin the process by conferring with counsel for the producing party. In conferring, the challenging party must explain the basis for its belief that the confidentiality designation was not proper and must give the producing party an opportunity to review the designated material, to reconsider the circumstances, and, if no change in designation is offered, to explain the basis for the chosen designation. A challenging party may proceed to the next stage of the challenge process only if it has engaged in this meet and confer process first.

7

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 9 of 12

c.

A party that elects to press a challenge to a confidentiality designation after

considering the justification offered by the producing party may file and serve a motion that identifies the challenged material and sets forth in detail the basis for the challenge. Each such motion must be accompanied by a competent declaration that affirms the movant has complied with the meet and confer requirements imposed in the preceding paragraph and that sets forth with specificity the justification for the confidentiality designation that was given by the producing party in the meet and confer dialogue. The burden of persuasion in any such challenge proceeding shall be on the party advocating the inclusion of a confidentiality designation on Confidential Material. Until the Court rules on the party's challenge, all parties shall provisionally treat that challenged material as Confidential Material. 12. Within ninety (90) days after the conclusion of this litigation, the parties shall

undertake reasonable and prudent efforts to either return all original Confidential Material to the disclosing party, or destroy such materials, and to destroy all copies of and all notes, summaries, and references relating to such Confidential Material and, further, the parties shall certify to the Court that such reasonable and prudent efforts have been undertaken; EXCEPT THAT each party may maintain one copy of any Confidential Material in its master file for this case, including one copy of any notes or summaries relating to such Confidential Material, provided that any copies of any Confidential Material or notes or summaries relating to such Confidential Material are clearly stamped "Confidential" Or "Confidential ­ Privacy Act Protected," or affixed with a similar legend indicating that the materials are subject to this Protective Order. 13. If the party receiving any Confidential Material is served with a subpoena or an

Order issued in other litigation that would compel disclosure of any such Material, the receiving

8

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 10 of 12

party must so notify the producing party, in writing (by facsimile, if possible) immediately and in no event more than three (3) court days after receiving the subpoena or Order. The receiving party also must immediately inform in writing the party who caused the subpoena or Order to issue in the other litigation that some or all of the material covered by the subpoena or Order is the subject of this Protective Order. In addition, the receiving party must deliver a copy of this Protective Order promptly to the party that caused the subpoena or Order to issue in the other action. The purpose of imposing these duties is to alert the interested parties to the existence of this Protective Order and to afford the producing party in this case an opportunity to try to protect its confidentiality interests in the court from which the subpoena or Order issued. The producing party shall bear the burdens and the expenses of seeking protection of its confidential material in that court ­ and nothing in these provisions should be construed as authorizing or encouraging a receiving party in this action to disobey a lawful directive from another court. 14. For information sought that is or may be covered by the Privacy Act, defendant, in

response to any discovery properly propounded pursuant to the Rules of the United States Court of Federal Claims, is hereby authorized, pursuant to 5 U.S.C. § 552a(b)(11), to release to opposing counsel in these cases records which are relevant to this action, and which may be subject to the Privacy Act, without obtaining prior written consent of the individual to whom such records pertain. Such disclosures shall be deemed authorized by law. IT IS SO ORDERED.

__________________________ Loren A. Smith Senior Judge 9

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 11 of 12

IN THE UNITED STATES COURT OF FEDERAL CLAIMS ) ) ) ) ) ) ) ) ) ) ) )

ATHEY, ROBERT M., et al., Plaintiffs, v.

C.A. No. 99-2051C (Senior Judge Smith)

THE UNITED STATES, Defendant.

DECLARATION OF___________________________________ 1. 2. My name is _____________________________________. My business address is _____________________________ ______________________________________________. 3. My present employer is ____________________________ _______________________________________________. 4. My present occupation or job description is _________ ______________________________________________. 5. I have received a copy of the Protective Order entered by the Court in connection

with the above-captioned matter. 6. 7. I have carefully read and understand the provisions of the Protective Order. I certify that I am eligible to have access to the Confidential Material under

paragraph 4 of the Protective Order. 8. 9. I will comply with all of the provisions of the Protective Order. I will hold all Confidential Material and any duplicates, notes, abstracts or

summaries thereof in confidence, will not disclose such information to anyone not specifically

Case 1:99-cv-02051-LAS

Document 60-2

Filed 06/26/2008

Page 12 of 12

entitled to access under the Protective Order, and will use the information solely for purposes of this litigation, except as provided by the Protective Order. 10. At the conclusion of this litigation, I will return all originals of all Confidential

Materials and any duplicates, notes, abstracts or summaries thereof, whether prepared by me or anyone else, to counsel for the party by whom I am employed or retained. Further declarant sayeth naught. ______________________________ (signature) DATED:_______________________

11