This theme goes back to sanctions—you need to know what data you have and where it lives, which may not be on your company’s servers. Shenwick v. Twitter, N. 16-CV-05314, 2018 WL 833085 (N.D. Cal. Feb. 7, 2018), looks at whether Twitter messages sent and received from nonparties are subject to discovery. Plaintiffs requested that defendants search Twitter direct messages that each custodian sent and received. Defendants agreed to provide direct messages for two defendants only, arguing that the SCA prevents the disclosure of direct messages from anyone other than a named individual defendant. The court agreed with the defendants. The court cannot compel Twitter to produce protected direct messages of individual custodians who are not parties simply because Twitter is the direct messaging service provider.

Hayes v. City of Melvindale, No. Civ. A. 17-13294, 2018 WL 3655138 (E.D. Mich. Aug. 2, 2018), shows that possession, custody, and control is a fact- and jurisdiction-specific analysis. The requesting party must show that the information sought is within the responding party’s possession, custody, and control. In this case, the plaintiff moved to compel production of “any cell phone and other electronic devices that may contain any text messages between” several Melvindale officials, and the production “for inspection, copying and forensic analysis any cell phone and other electronic devices.” The defendants argued that since they no longer use the cell phones or providers, that such information is not in their possession, custody, or control. The plaintiff’s counsel did not know whether the cell phones requested were issued by the City (employer of the defendants). The court ruled that the plaintiff did not meet his burden in demonstrating that the personal devices belonging to nonparty employees are within defendants' possession, custody or control.

2018 helped to better solidify the amended rules which came into play in December of 2015 and speak further to issues involving custody and control.  On the horizon look for more cases involving to new and emerging communication platforms, cases that involve data that needs to be collected globally, and the impact of the General Data Protection Regulation (GDPR) which went into effect this past May.