Have you ever wanted to email Abby Wambach or Alex Morgan on their personal email accounts? If so, then last week may have been your lucky week. According to a recent report by the New York Times, the United States Soccer Federation (US Soccer) filed an unredacted complaint in its labor litigation against the US Women’s National Team that included the addresses of 28 players and personal email exchanges between some of the most famous athletes on the team.
As we have discussed on this Blog, the traditional harm from a data breach takes the form of an unauthorized credit card transaction. Here, the consequences of the breach have the potential to become far more serious because the athletes’ status and publicity may lead to stalking or other forms of harassment. For its part, US Soccer apologized and promptly re-filed a properly redacted version of the complaint, but the damage arguably may already be done.
Notably, many state courts have express requirements to redact personally identifiable information in a court filing. For example, here in Ohio, Sup.R.45(D)(1) requires a party to omit personal identifiers before filing. In Alabama, the rule can be found at Rule 1.5 of the Alabama Rules of Civil procedure, which requires redacting social security numbers and taxpayer identification numbers. In California, the rule can be found at Court Rule 1.20. Each of these rules place the responsibility for redaction solely on the party or attorney making the filing, meaning that even if you received an unredacted document in discovery, you will need to review that document for sensitive information and redact it before you file it.
We recommend taking the time to review any state’s civil, court or local rules that you may be unfamiliar with for relevant privacy and redaction requirements. Also, consider performing a brief cross-check of how that state defines personal identifiers or PII because some states have different parameters. Until then, continue to cheer for our women’s national team, and as always – stay tuned.