In an era where data breaches and cyberattacks are increasingly prevalent, data security is often top of mind.  During discovery, which can involve vast sets of confidential or protected information, it thus is hardly surprising that producing parties may expect recipients to implement data security protections to guard against data breaches.  But such protections can be expensive, and parties may disagree on both the level and type of protections required and the allocation of related costs.

The recent decision in United States v. Anthem, Inc., 2024 WL 2982908 (S.D.N.Y. June 12, 2024), marks a significant development in this area.  Addressing the novel question of how to allocate data security costs, the court in Anthem highlights the importance of data security in discovery and establishes a new test to determine when and whether cost-shifting may be appropriate.