The federal judge presiding over massive multidistrict litigation stemming from last year's data breach at Atlanta-based Equifax Inc. has signed a protective order warning lawyers that, while some highly sensitive materials may be sealed during the litigation, they should treat documents filed in the case as “presumptively public.”

U.S. District Chief Judge Thomas Thrash also said he would require “an appropriate showing” to justify any confidentiality claims.

Thrash acknowledged in the 34-page order April 18 that the nature of the litigation—concerning the exposure to hackers of the financial and personal data of more than 145 million people—would necessarily involve “unique risks” related to privacy, data security and data management “that will be greater than in most cases.”

Nevertheless, the judge ordered the parties “to use their best efforts to limit the filing of confidential or highly confidential material under seal.”

“This order,” he warned, “does not confer blanket protections on all disclosures or responses to discovery. … The protection it affords from public disclosure and use extends only to the limited information or items that are entitled to confidential treatment.”

It is not the first time Thrash has put attorneys on notice that he does not intend to allow them to use protective orders to unilaterally seal large swaths of the public record.

In 2015, while presiding over multidistrict litigation stemming from a data breach at Atlanta-based Home Depot, Thrash warned lawyers he would reject attempts to seal large portions of the court record.

“The first 10 years I was on the bench, pretty much we just went along with whatever y'all wanted to do about sealing documents. At least I did,” he said then. “And then in these big commercial cases it became clear that things were just getting out of hand, and the lawyers were wanting to seal virtually everything.”

“This wholesale practice of designating everything and every page of deposition testimony as confidential or super-confidential or attorneys' eyes only I'm not going to accept,” he said.

In the Equifax case, Thrash said that sealing would be limited to documents that could reveal a trade secret or other confidential research, development, financial or data security information. The protective order also extends to information revealing personally identifiable information, corporate security information and other information that “would create a substantial risk of serious harm.”

Thrash directed that anyone producing materials under seal would be limited to designating as protected “only those parts of material, documents, items, or oral or written communications that qualify—so that other portions of the material, documents, items or communications for which protection is not warranted are not swept unjustifiably within the ambit of this order.”

“Mass, indiscriminate, or routinized designations are prohibited,” Thrash's order said. Moreover, if data or other information is filed under seal but does not qualify, “That producing party must promptly notify all other parties that it is withdrawing the mistaken designation.”

Thrash also made clear what he would not allow to be filed under seal:

• Any information in the public domain either at the time it is filed or that becomes part of the public domain at a later, including information that becomes part of the public record through trial or other court proceedings;
• Any information known or obtained by the recipient of the information, as long as it was obtained legally.”

Thrash instructed the leadership committees of lawyers steering the litigation and hundreds of clients they represent  “to use their best efforts to limit the filing of confidential or highly confidential material under seal to those situations where such filing is necessary to the resolution of a motion or other matter before the court.”

Any party or nonparty, Thrash said, may challenge a designation of confidentiality at any time.