Walsh v. Alight Solutions LLC

• Decision Date: 12 August 2022
• Docket Number: 21-3290
• Citation: 44 F.4th 716
• Parties: Martin J. WALSH, Secretary of Labor, Petitioner-Appellee, v. ALIGHT SOLUTIONS LLC, Respondent-Appellant.
• Court: U.S. Court of Appeals — Seventh Circuit

44 F.4th 716

Martin J. WALSH, Secretary of Labor, Petitioner-Appellee,

v.ALIGHT SOLUTIONS LLC, Respondent-Appellant.

No. 21-3290

United States Court of Appeals, Seventh Circuit.

Argued April 21, 2022

Decided August 12, 2022

Bruce Canetti, Department of Labor, Office of the Solicitor, Chicago, IL, Thomas Tso, Attorney, Robin Springberg Parry, Attorney, Rachel Uemoto, Attorney, Department of Labor, Office of the Solicitor, Washington, DC, for Petitioner-Appellee.

Ilana Hope Eisenstein, Attorney, Bren Fabens-Lassen, Attorney, DLA Piper US LLP, Philadelphia, PA, Daniel J. Fazio, Attorney, DLA Piper LLP (US), Chicago, IL, Erin M. Sweeney, Attorney, DLA Piper US LLP, Washington, DC, for Respondent-Appellant.

Before Easterbrook, Rovner, and Brennan, Circuit Judges.

Brennan, Circuit Judge.

The U.S. Department of Labor is investigating alleged cybersecurity breaches at Alight Solutions LLC, a company that provides administrative services for employers who sponsor healthcare and retirement plans. As part of its investigation the Department issued an administrative subpoena. Alight produced some documents but objected to many of the subpoena's requests. The district court granted the Department's petition to enforce the subpoena with some modifications.

On appeal, Alight argues the subpoena is unenforceable because the Department lacks authority to investigate the company, or cybersecurity incidents generally. The company also contends the subpoena's demands are too indefinite and unduly burdensome, and that the district court abused its discretion by denying Alight's request for a protective order to limit production of certain sensitive information. Alight's arguments are not persuasive, so we affirm.

I

Alight provides recordkeeping services for employers who sponsor healthcare and retirement benefit plans for their employees, some of which are governed by the Employee Retirement Income Security Act, 29 U.S.C. §§ 1001 – 1461 ("ERISA"). As of November 2020, Alight served over 750 clients supporting more than 20.3 million plan participants. These clients entrust Alight with highly sensitive information about their companies, employee benefits plans, and plan participants. Alight provides cybersecurity services to protect this confidential information.

The Department opened an investigation of Alight in July 2019 prompted by a discovery that Alight processed unauthorized distributions of plan benefits due to cybersecurity breaches in its ERISA plan clients' accounts. The Department says Alight failed to report, disclose, and restore those unauthorized distributions. Alight denies any knowledge of breaches resulting in unauthorized distributions.

As part of the investigation the Department sent Alight an administrative subpoena duces tecum. The subpoena calls for documents in response to 32 inquiries and covers the period from January 1, 2015 through the date of production. The information requested ranges from specific inquiries, like Alight's articles of incorporation and bylaws, to broad demands, including "[a]ll documents and communications relating to services offered to ERISA plan clients."

Alight produced a limited number of documents in response to about half of the subpoena's requests, but the company also objected to many of the inquiries. Specifically, the company challenged the Department's investigatory authority and purposes, criticized the subpoena's scope and burden, and emphasized its duty to keep certain information confidential.

After unsuccessful attempts by the parties to resolve Alight's objections, the Department petitioned the district court to enforce the subpoena. Meanwhile, the company continued to interact with the Department and produced additional materials. But Alight redacted most of the documents it produced to remove client identifying information, which prevented the Department from discerning potential ERISA violations.

In response to the petition, Alight filed a memorandum opposing enforcement of the subpoena. The company argued that the Department lacked the authority to investigate the company because Alight is not a fiduciary under ERISA, the subpoena was too indefinite to enforce and sought documents unrelated to ERISA plans, and enforcement would jeopardize confidential information Alight was contractually obligated to protect. The company also noted that although the subpoena requested documents back to January 1, 2015, Alight was not formed until May 2017. Alight asked the district court to quash the subpoena, or at a minimum to limit the subpoena and enter a protective order permitting redactions.

Alight's response also highlighted a production sample its legal consultant prepared, which covered two months of responsive documents. The consultant spent over 40 hours preparing the sample, and she estimated that the employees who assisted her collectively spent the same amount of time on the project. Based on this sample, Alight's legal consultant projected full compliance with the subpoena would require "thousands of hours of work."

The Department filed a reply memorandum defending the subpoena. It stated that additional documentation was not required for 9 of the original 32 production requests. For the remaining 23 inquiries, the Department clarified or narrowed each request.

Ultimately, the district court granted the Department's petition to enforce the subpoena as modified by the Department's reply memorandum. The court found that the Department's investigatory authority was not limited to fiduciaries, and that the requested information was reasonably relevant to the ERISA investigation. It also ruled that the subpoena was not too indefinite, and that Alight's challenge to the indefiniteness of the subpoena related more to the burden of production than the clarity of the production requests. As to Alight's burden of compliance, the court applied the presumption that subpoenas should be enforced and decided that the balance between the relevance of the requested information and the cost of production favored enforcement.

The district court also declined to enter a protective order. Not only had Alight failed to formally move for such an order under Federal Rule of Civil Procedure 26(c), but the court found that the Freedom of Information Act and 18 U.S.C. § 1905 prohibited the Department from publicizing Alight's confidential information. So, the court concluded that Alight had not shown good cause for redacting the requested documents.

Last, the court addressed the date range covered by the subpoena. Reasoning that Alight "cannot produce what it does not have," the court directed Alight to produce those documents in its possession. And "if [Alight] does not have anything within its possession, custody, or control to produce from the period before it had its current legal existence, it should respond to the Subpoena accordingly."

II

"We review the district court's decision to enforce an agency subpoena for abuse of discretion, and we review any factual determinations on which the ruling is based for clear error. Questions of law are reviewed de novo. " EEOC v. Aerotek, Inc. , 815 F.3d 328, 333 (7th Cir. 2016) (citations omitted); see McLane Co., Inc. v. EEOC , 581 U.S. 72, 137 S. Ct. 1159, 1170, 197 L.Ed.2d 500 (2017). "A decision is an abuse of discretion only if no reasonable person would agree with the decision made by the trial court." Lange v. City of Oconto , 28 F.4th 825, 842 (7th Cir. 2022) (quoting Smith v. Hunt , 707 F.3d 803, 808 (7th Cir. 2013) ). Under clear-error review, we will overturn a decision "only if the entire record leaves us ‘with the definite and firm conviction that a mistake has been committed.’ " Wilborn v. Ealey , 881 F.3d 998, 1006 (7th Cir. 2018) (quoting Anderson v. City of Bessemer City , 470 U.S. 564, 573, 105 S.Ct. 1504, 84 L.Ed.2d 518 (1985) ).

A subpoena enforcement proceeding is "designed to be summary in nature." EEOC v. United Air Lines, Inc. , 287 F.3d 643, 649 (7th Cir. 2002) (quoting EEOC v. Tempel Steel Co. , 814 F.2d 482, 485 (7th Cir. 1987) ). In the context of administrative subpoenas, "a district court's subpoena enforcement function is narrowly limited: in deciding whether to enforce, ‘it is sufficient if the inquiry is within the authority of the agency, the demand is not too indefinite and the information sought is reasonably relevant.’ " Aerotek , 815 F.3d at 333 (quoting Dow Chem. Co. v. Allen , 672 F.2d 1262, 1267 (7th Cir. 1982) ). "[I]t is also clearly recognized that disclosure may be restricted where it would impose an unreasonable or undue burden on the party from whom production is sought," Dow Chem. , 672 F.2d at 1267, and a subpoena may not be issued for an illegitimate purpose. McLane , 137 S. Ct. at 1165. "In the mine run of cases, the district court's decision whether to enforce a subpoena will turn either on whether the evidence sought is relevant to the specific charge before it or whether the subpoena is unduly burdensome in light of the circumstances." Id. at 1167. These inquiries "are ‘generally not amenable to broad per se rules’; rather, they are the kind of ‘fact-intensive, close calls’ better suited to resolution by the district court than the court of appeals." Id. at 1168 (citations omitted).

On appeal, Alight offers similar arguments as in the district court: the Department lacks authority to issue the subpoena, the subpoena is too indefinite and burdensome to enforce, and a protective order is needed to prevent disclosure of certain confidential information.

A

Alight contends that the subpoena falls outside the Department's authority because it cannot investigate non-fiduciaries, and ERISA does not authorize investigations into cybersecurity issues. Each challenge raises a question of law, which we review de novo. Aerotek , 815 F.3d at 333.

The Department's authority to issue subpoenas under ERISA is codified at 29 U.S.C. § 1134(a)(1) :

The Secretary shall have the power, in order to determine whether any person has

...