How Does ADPPA Affect Litigation Support?
The American Data Privacy and Protection Act (ADPPA) never became law, but it still shapes how legal teams think about data in 2025. The bill’s framework previewed what a federal privacy regime might require and accelerated a wave of state privacy statutes. For legal teams, that means discovery strategies must now balance evidentiary needs against a fast-evolving patchwork of privacy obligations.
What Is the ADPPA?
As the volume of electronically stored information (ESI) has exploded, so have concerns over how personal data is collected, used, and protected. This growing awareness culminated in the proposal of a comprehensive federal data privacy law similar to Europe’s GDPR: the American Data Privacy and Protection Act.
The ADPPA was a bipartisan, bicameral bill that aimed to establish a national framework for data privacy. Its core tenets were revolutionary for the U.S., focusing on requiring organizations to collect, process, and transfer only the data that was reasonably necessary for a specific product or service and imposing stricter rules for “sensitive covered data,” which included health information, genetic data, precise geolocation information, and private communications.
Had the ADPPA been passed in 2022, it would have created a single, unified standard for organizations operating across state lines. Despite its significant momentum, however, it was not enacted. Instead, individual states began taking the lead on enacting data privacy laws. Today, these regulations have significant implications for litigation and e-Discovery processes.
How Privacy Concerns Are Reshaping e-Discovery
The principles of data privacy are often in direct tension with the traditional goals of e-Discovery. For example, the discovery process calls for a broad and thorough search for relevant evidence. Conversely, data privacy laws demand data minimization and the protection of personal information. This conflict creates several challenges:
- Over-Preservation and Collection Risks: The old playbook of casting a wide net and collecting massive datasets from custodians is now fraught with risk. This approach dramatically increases the chances of capturing irrelevant but highly sensitive personally identifiable information (PII), which then falls under the purview of various state privacy laws.
- Redaction and Anonymization Burden: Identifying and redacting all PII — such as social security numbers, driver’s license numbers, and health information — from a large document production is a monumental task. However, failure to do so can result in an inadvertent data breach and severe penalties.
- Cross-Border Data Transfer Complications: For national or international litigation, transferring data across state or country lines requires careful consideration of the applicable privacy regimes in each jurisdiction.
- The “Right to Delete” vs. Legal Holds: A significant conflict arises when a company receives a consumer’s request to delete their data while that same data is subject to a legal hold for pending or anticipated litigation. Mishandling this situation can lead to sanctions for spoliation of evidence on one hand or fines for privacy violations on the other.
Best Practices for Preventing Data Privacy Violations During Litigation
To navigate this complex environment, law firms must adopt a more privacy-conscious approach to litigation and e-Discovery. Here are just a few ways you can do so:
- Embrace Proportionality: Focus discovery requests and collection efforts on only the data that is truly necessary and proportional to the needs of the case. This requires early and detailed discussions about custodians, date ranges, and data sources.
- Use Protective Orders: Incorporate tiered confidentiality, attorney-eyes-only provisions for highly sensitive data (e.g., health, precise geolocation, children’s information), and clear obligations for vendors.
- Utilize Advanced Technology: Leverage technology-assisted review (TAR) and artificial intelligence tools to quickly identify and categorize documents containing sensitive PII. Modern platforms can automate the redaction process and reduce human error.
- Strengthen Security Protocols: Ensure that all data, whether in transit or at rest, is encrypted and stored in a secure environment. This is especially critical when working with third-party litigation support vendors. Vet your partners thoroughly to confirm they have robust security credentials and are compliant with relevant regulations.
- Implement Strong Clawback Agreements: Establish clear agreements at the outset of litigation that allow for the clawback of inadvertently produced privileged or sensitive information without waiving privilege.
Partner With Cornerstone Discovery to Protect Your Firm
The growing concern over data privacy has made the rules of litigation more stringent than ever before. A single misstep in handling ESI can lead to costly data breaches, regulatory fines, and reputational damage that can cripple a law firm and its clients.
To protect your firm from data breaches and compliance missteps during litigation, partner with Cornerstone Discovery. For over two decades, we have offered unparalleled litigation support services to law firms, corporate legal departments, and government agencies across the United States. Today, our team of experts continues to keep up with the latest e-Discovery technology and evolving laws and regulations governing data privacy so that we can keep your firm protected during every step of the EDRM process.
If you’re navigating high-stakes discovery with sensitive data, contact Cornerstone Discovery today to learn how we can help you reduce risk, control costs, and build a defensible strategy.
