11.3 Privacy Protection Act and E-Discovery
Key Takeaways
- The Privacy Protection Act of 1980 (42 U.S.C. § 2000aa) is Congress’s response to Zurcher v. Stanford Daily and generally bars federal, state, and local officers from searching or seizing a journalist’s work-product or documentary materials intended for public dissemination; a subpoena is the preferred tool
- Civil discovery runs on Federal Rules of Civil Procedure 26 (scope and proportionality), 34 (party document and electronically stored information requests), and 45 (nonparty subpoenas), plus protective orders under Rule 26(c)
- The Stored Communications Act generally blocks a civil litigant from compelling a public provider to disclose the contents of another person’s communications; the litigant must obtain that content from the account holder under Rule 34
- A litigation hold attaches when litigation is reasonably anticipated; Federal Rule of Civil Procedure 37(e) supplies the federal spoliation framework for lost electronically stored information
- Cross-border discovery collides with General Data Protection Regulation Article 48 and foreign blocking statutes; the CLOUD Act reaches data in a U.S. provider’s possession, custody, or control regardless of storage location, subject to a comity challenge
11.3 Privacy Protection Act and E-Discovery
Competency III.C is court access that is not ordinary criminal ECPA process: the Privacy Protection Act of 1980 (PPA) and civil electronic discovery (e-discovery). The privacy professional’s value on these items is classification. A search of a newsroom, a Rule 45 subpoena to a cloud provider, a Rule 34 request to the company’s own employees, and a foreign-blocking-statute letter look similar in a Slack channel. They are different statutes with different objections.
Privacy Protection Act — Zurcher and the newsroom
In Zurcher v. Stanford Daily, 436 U.S. 547 (1978), the Supreme Court held that the Fourth Amendment does not forbid a warranted search of a newspaper office for evidence of a third party’s crime merely because the occupant is the press. Police with a warrant had searched the Stanford Daily for unpublished photographs of a demonstration. Congress responded with the PPA, 42 U.S.C. § 2000aa et seq. CRS Legal Sidebar LSB11393 (February 2026) is a current official summary: the PPA limits federal, state, and local officers — unlike the RFPA, which is federal-only — in searches and seizures that implicate First Amendment publishing.
The PPA protects two categories of materials possessed by a person reasonably believed to have a purpose to disseminate to the public a newspaper, book, broadcast, or similar public communication in or affecting interstate or foreign commerce:
| Category | What it covers | Default rule |
|---|---|---|
| Work-product materials (§ 2000aa(a)) | Materials (other than property used to commit a crime) created in anticipation of public communication that contain the author’s impressions, opinions, conclusions, or theories — drafts, notes, outtakes | Search or seizure is generally unlawful |
| Documentary materials (§ 2000aa(b)) | Materials upon which information is recorded that are possessed in connection with a purpose to disseminate to the public — raw footage, interview recordings, document sets gathered for a story | Search or seizure is generally unlawful; the statute is slightly more permissive than the work-product bar but still prefers a subpoena |
The Senate report’s preference is the exam’s operational rule: use voluntary production or a subpoena, which the publisher can move to quash, rather than a surprise search that rummages a newsroom. Exceptions matter. The government may still seize work product if immediate seizure is necessary to prevent death or serious bodily injury. A suspect exception allows a search when there is probable cause that the person possessing the materials committed the offense to which the materials relate — but that exception generally does not apply to mere receipt, possession, or communication of the materials (so a reporter who received a stolen corporate report is not automatically searchable). It does apply to specified possession crimes such as child sexual abuse material and certain national-defense information. Customs searches at the border have their own carve-out. The PPA is a damages statute against the government, not a suppression statute in the criminal case.
Compelled disclosure of media information in criminal investigations still usually proceeds by subpoena, plus Department of Justice internal news-media policies that are stricter than the Constitution and that also address process served on third-party providers (telephone and email records that would identify a source). Those policies are not a private right of action. The PPA is.
Civil discovery: Rules 26, 34, and 45
Civil e-discovery is the Federal Rules of Civil Procedure, not ECPA’s warrant ladder.
Rule 26(b)(1) defines scope: nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case, considering the importance of the issues, the amount in controversy, the parties’ relative access to information, the parties’ resources, the importance of discovery in resolving the issues, and whether the burden or expense outweighs the likely benefit. Proportionality is the privacy professional’s first civil objection. A request for “all customer data for ten years” in a two-plaintiff billing dispute is a 26(b) problem before it is a GDPR problem.
Rule 26(c) authorizes protective orders against annoyance, embarrassment, oppression, or undue burden or expense. Privacy teams use them to restrict who may see medical, financial, or children’s data, to require attorneys’-eyes-only tiers, and to police onward use. A protective order is not a public-records statute and does not bind the world; it binds the parties and those who sign on.
Rule 34 is how a party demands documents, electronically stored information, and inspection from another party. The producing party searches its own systems, applies objections (privilege, proportionality, undue burden), and produces in a reasonably usable form. This is the lawful path to an employee’s work email or a customer’s account contents when that party has the data.
Rule 45 is how a party serves a subpoena on a nonparty — a bank, a cloud provider, a former vendor. The nonparty may serve objections and move to quash. Cost-shifting and undue-burden arguments are stronger for nonparties than for parties. The SCA, discussed next, often makes the Rule 45 path a dead end for contents held by a public provider.
The SCA’s civil wall, holds, and spoliation
18 U.S.C. § 2702 forbids a public ECS or RCS provider to voluntarily disclose the contents of communications except as listed. § 2703 authorizes governmental entities to compel disclosure. A civil plaintiff is not a governmental entity. Federal courts therefore generally hold that a civil litigant cannot use a Rule 45 subpoena to force Google, Microsoft, Meta, or a similar public provider to produce another person’s stored message contents. Leading applications include Crispin v. Christian Audigier, Inc. (social-media contents) and a line of cases refusing criminal-defense or civil content subpoenas to providers. The workaround is Rule 34 to the account holder: the party who can log in must download and produce. Non-content subscriber data is a closer question and sometimes obtainable; contents are the hard stop. § 2702’s consent, emergency, and child-exploitation exceptions are not a general civil-discovery exception.
Litigation-hold duties attach when a party reasonably anticipates litigation — a demand letter, a charge, a credible oral threat, not only the day the complaint is filed. Counsel must identify custodians and systems (email, chat, laptops, cloud SaaS, phone backups, ephemeral tools), suspend routine deletion, and document the hold. Vendors and affiliates that hold unique relevant electronically stored information need a hold too; a business-associate or processor contract that promises deletion on request is not an excuse to wipe data after the duty to preserve has attached.
Spoliation of electronically stored information is now Rule 37(e). If ESI that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court, upon finding prejudice, may order measures no greater than necessary to cure the prejudice. Only upon a finding that the party acted with intent to deprive another party of the information’s use in the litigation may the court presume the information was unfavorable, give an adverse-inference instruction, or dismiss or enter default. Negligent auto-deletion is not automatically an adverse-inference case. Intentional wiping after a hold is.
Cross-border discovery and the privacy-team intake
U.S. courts can order a party subject to their jurisdiction to produce data the party controls even when the servers sit in Dublin. Foreign law pushes back. The General Data Protection Regulation (GDPR) Article 48 provides that a third-country court judgment or administrative decision requiring transfer or disclosure is recognized or enforceable only if based on an international agreement such as a mutual legal assistance treaty (MLAT) — without prejudice to other GDPR transfer grounds. Blocking statutes (classically France’s Law No. 68-678 of 26 July 1968, as amended) make it a crime to communicate certain economic, commercial, industrial, financial, or technical documents to foreign authorities outside the Hague channel. Société Nationale Industrielle Aérospatiale v. U.S. District Court, 482 U.S. 522 (1987), held that the Hague Evidence Convention is a permissive supplement, not the exclusive means of discovery from a foreign party — so a U.S. court may still order direct production and then weigh comity.
The Clarifying Lawful Overseas Use of Data (CLOUD) Act, 18 U.S.C. § 2713 (2018), is the criminal-process counterpart candidates mix into civil questions. It provides that an SCA warrant or other § 2703 process reaches data in a U.S. provider’s possession, custody, or control, regardless of where the data are stored, and it creates a comity motion to quash or modify when production would violate a qualifying foreign government’s law. The CLOUD Act responded to the Microsoft Ireland litigation; it did not create a civil exception to § 2702.
How a privacy team reviews a civil subpoena versus a warrant.
- Identify the issuer and the statute. A magistrate’s search warrant or a 2703(d) order is criminal/governmental process. A clerk-issued Rule 45 subpoena in Smith v. Acme Corp. is civil. A FISC 702 directive is neither.
- Identify the target. Process served on the company as a party (Rule 34) is the company’s own production. Process served on the company as a provider for someone else’s account is an SCA problem. Process served on a newsroom for unpublished notes is a PPA problem.
- Match the standard to the data. A civil subpoena does not unlock stored contents at a public provider. A warrant does, subject to particularity and any PPA newsroom limits. A super-warrant is for prospective intercept, not for a mailbox dump.
- Preserve first. Issue or refresh the litigation hold the same day. Do not “clean up” Slack while the motion to quash is pending.
- Scrub and stage. For civil production, apply proportionality, privilege, protective-order terms, and minimization. For criminal process, produce what the lawful instrument requires — no more. For CISA-style voluntary sharing, that is a different intake entirely.
- Flag the border. If the data sit in the European Union or a blocking-statute jurisdiction, open the GDPR Article 48 / transfer / Hague / CLOUD Act comity analysis before anyone uploads a file to an opposing counsel’s portal.
Scenario. A plaintiff in a California wage case serves the company’s email host with a Rule 45 subpoena for “all emails and Slack messages of managers Jones and Patel for three years,” and the same week a federal agent serves a warrant for Patel’s laptop plus a PPA-covered freelance journalist’s unpublished interview notes that happen to sit in Patel’s personal cloud. Privacy counsel splits the stack. The Rule 45 content demand on the public host is an SCA non-starter; the plaintiff must use Rule 34 against the company (the account holder) and live with proportionality and a protective order. The laptop warrant is ordinary probable-cause criminal process and should be logged, imaged, and cabined to the warrant’s particularity. The journalist’s unpublished notes are PPA work product: absent a suspect or death-or-injury exception, the government needs a subpoena the journalist can fight, not a newsroom-style seizure of the draft.
Exam traps
- The PPA is a Zurcher statute about searches of publishers. It is not the RFPA and not a general journalist’s privilege that defeats every subpoena.
- Rule 45 to a public email provider does not replace a warrant or a Rule 34 request for contents.
- A litigation hold is triggered by reasonable anticipation, not by the docket number.
- Rule 37(e) requires intent to deprive before an adverse-inference instruction; mere negligence in losing ESI is a lesser-measures case.
- GDPR Article 48 and blocking statutes are not “the U.S. court always loses,” and the Hague Convention is not exclusive after Aérospatiale. Work the comity analysis; do not ignore either side.
Police obtain a search warrant and raid a city magazine’s newsroom for unpublished photographs of a protest, seeking evidence against demonstrators, not against the journalists. Which statute did Congress enact in response to Zurcher v. Stanford Daily, and what does it generally require?
In a federal civil trade-secret case, the plaintiff serves the defendant’s public email provider with a Rule 45 subpoena demanding the contents of three employees’ mailboxes. The plaintiff has not obtained a criminal warrant. What is the correct Stored Communications Act analysis?
A U.S. company reasonably anticipates a class action and later learns that, after the demand letter arrived, a manager ran a “cleanup” script that permanently deleted the only copy of relevant Slack channels. Separately, a U.S. court orders the company to produce European employee emails that French blocking-statute advice says may not leave France except through the Hague Convention. Which pairing is accurate?