BCI Media Group Pty Ltd v CoreLogic Australia Pty Ltd

Orders sought against the CoreLogic parties 15 BCI seeks a number of orders whose purpose is to extend the time for compliance with the orders for preliminary discovery that have already been made against the CoreLogic parties; to more precisely define certain categories of documents which, it says, should be discovered; and to ensure that the list of documents and affidavit verifying discovery required to be given by each CoreLogic party is in appropriate form.

Proposed Order 1: the time for the CoreLogic parties to comply with Orders 1 and 2 made on 12 November 2020, as varied on 15 March 2021, be further extended 16 There is no dispute between BCI and the CoreLogic parties that this order should be made. Further, the relevant parties accept that an extension of three weeks should be allowed.

Proposed Order 2(a): the CoreLogic parties' discovery obligations include all comparative documents created or prepared by them or their agents which refer to BCI or its information, including as referred to in certain paragraphs of an affidavit made by Michael John Williams on 27 May 2021 (Williams #6) 17 BCI contends that, in documents discovered and produced by the CoreLogic parties on 29 April 2021, there are references to a number of documents which have not been discovered and which appear to fall within the categories for discovery. It has given examples of these references in various documents included in Exhibit MJW-7 and Confidential Exhibit MJW-8 to Williams #6. The examples include certain "folder paths" through which, apparently, documents can be accessed. 18 The CoreLogic parties submit that the proposed Order 2(a) is not necessary because the category of documents to which it refers is, in substance, subsumed by their existing discovery obligations caught by proposed Order 1. They also contend that "a number" of the documents have already been discovered. Next, they contend that some of the documents identified in Williams #6 as not having been discovered, are referred to in terms which do not explicitly refer to BCI or to BCI metadata and are not, for that reason, discoverable. The CoreLogic parties then say that any relevant documents retrieved from "deep archive" (by following the identified folder paths) have now been discovered, with 35 documents produced on 15 July 2021. 19 Having made these submissions, the CoreLogic parties accept that their solicitors still need to undertake a review of the in excess of 30,000 documents recently identified, to see whether they are discoverable in terms of the orders that have been made. 20 I am not persuaded by the CoreLogic parties' submissions. The fact that the category of documents identified in proposed Order 2(a) is subsumed by their existing discovery obligations is no real answer. The purpose of the proposed order is to make clear those obligations. 21 Further, it is no answer to say that "a number" of the documents in the category have been discovered, while at the same time acknowledging at least the possibility that further documents may be caught by the category. For one thing, until the in excess of 30,000 documents, recently identified, have been reviewed, it will not be known whether they, or some of them - and, if so, which of them - are discoverable or have been discovered. 22 Further, I do not accept that, simply because descriptions or references to documents (in documents that have been discovered and produced for inspection) do not refer, in terms, to BCI or to BCI metadata, it follows that the documents described or referred to do not or cannot fall within proposed Order 2(a), or within each of the CoreLogic parties' existing discovery obligations more generally. 23 I am satisfied that an order in terms of proposed Order 2(a) is appropriate and warranted.

Proposed Order 2(b): the CoreLogic parties' discovery obligations include JIRA tickets and Trello board records relating to the creation of data comparison reports and, to the extent not already produced, GitHub and JIRA records (as defined in Order 4(i) of the orders made on 15 March 2021) relating to the development and project management of the UiPath software, including as referred to in certain paragraphs of Williams #6 24 The CoreLogic parties have disclosed that a third-party platform, "UiPath", was used to access and extract data from LeadManager. The UiPath platform is an application that can automate the capture of websites, either through screen scraping or by targeting specific elements on a webpage. 25 "GitHub" is an application that stores source code (executable commands) and application packages (in this context, groupings of commonly used source code, for example a login prompt). 26 BCI's investigations have revealed the possibility that GitHub was used to develop the UiPath source code used to access and extract data from LeadManager. 27 Mr Morgan Donohue, who is described as "the Senior Leader, Software Engineering and Technology at CoreLogic", has deposed that, while "CoreLogic" uses GitHub - it is part of the standard software toolkit deployed to all developer workstations - it was not used in the development of the UiPath process. 28 However, when examining the GitHub repository, Mr Donohue located historical notes in respect of the UiPath process code. He has deposed that these notes have been disclosed to BCI in that they were embedded in a discovered document identified as COR.001.006.1209. 29 UiPath can also be linked to version control software called "Jira". The CoreLogic parties say that Jira was used in relation to the development of the UiPath process code to log "agile development sprints". However, Mr Donoghue has deposed that all Jira records with respect to accessing LeadManager have been discovered. 30 The CoreLogic parties have discovered an email (COR.001.002.0778) which reveals the possibility that another product, "Trello", was used to access LeadManager. Trello is a collaboration application that is used to organise task lists and to display them on a visual note board called a "KanBan board". 31 The evidence is that, within "CoreLogic", KanBan boards are typically used in software development as a high-level tracking tool to monitor the progress of an overall project. However, Mr Donohue has deposed that individual tasks and sprints were not recorded in Trello for the UiPath project. He says that these were logged in Jira, which also provides a KanBan board for the same purpose as Trello. 32 The CoreLogic parties have now identified the Trello card referred to in COR.001.002.0778. Mr Donohue has deposed that all Trello cards that respond to the discovery orders made were disclosed to BCI on 15 July 2021. 33 The CoreLogic parties submit that, given the above facts, an order in terms of proposed Order 2(b) is inappropriate. 34 I note that Order 4(i) made on 15 March 2021 made clear that the CoreLogic parties' discovery obligations included any GitHub and Jira records relating to the development of the UiPath source code. No variation has been sought to that order. 35 Further, although the CoreLogic parties contend that documents in relation to the use of Jira with respect to accessing LeadManager have now been discovered, proposed Order 2(b) is conditioned by the words "to the extent not already produced". 36 As to the Trello records, the CoreLogic parties acknowledge, through Mr Donohue's evidence, that Trello cards relevant to BCI or containing BCI metadata are discoverable, although they say that all Trello cards that respond to the orders were disclosed on 15 July 2021. 37 In light of the history with respect to the giving of discovery by the CoreLogic parties, and the fact that in excess of 30,000 documents, which are potentially discoverable, have been recently identified and have yet to be reviewed, I am satisfied that proposed Order 2(b) is appropriate and warranted.

Proposed Order 2(c): the CoreLogic parties' discovery obligations include records relating to the data scraping activities of their agents, as referred to in certain paragraphs of Williams #6 38 Documents discovered by the CoreLogic parties show that agents were used to carry out data scraping activities. 39 By way of example, BCI has tendered a Statement of Work (the SOW) (COR.001.010.003) which refers to work to be carried out by TELUS International (U.S.) Corp. (TELUS) in the Philippines, in conjunction with the second prospective respondent, RP Data Pty Ltd (RP Data). The work includes: Review Residential data quality and assess the data integrity against competitors' in each state for both residential and commercial properties including Cordell data 40 The SOW refers to monthly reporting to be carried out. The SOW also refers to a Master Professional Services Agreement between CoreLogic Solutions, LLC (RP Data's parent), and TELUS. Neither this agreement nor the reports envisaged by the SOW have been discovered. 41 Order 4(g) made on 15 March 2021 made clear that each of the CoreLogic parties was to discover any records relating to the activities of third parties associated with data scraping activities. This order referred to the activities of Artis Group Pty Ltd (Artis), Telus International Philippines Inc (Telus Philippines), and UiPath SRL, but its scope was not limited to the activities of these entities. 42 In the context of contending that discovery by the CoreLogic parties has been incomplete in respect of the activities of its agents, BCI draws attention to an apparent lack of discovery in respect of the activities of these entities. 43 In response, Mr Donohue has deposed that Artis supplied consultants who undertook work on CoreLogic computers within the CoreLogic network, and that each Artis consultant was assigned "CoreLogic" email addresses. He says that any documents or records produced by the consultants would have been contained within the "CoreLogic" network. He says that there are no documents, independently sourced from Artis, to discover. 44 As regards Telus Philippines, Mr Donohue has deposed that a request was made to it to produce documents in the categories that have been ordered. He says that only one document was provided by Telus Philippines and that it will be discovered. 45 As regards UiPath SRL, Mr Donohue has deposed that the UiPath program was installed locally on "CoreLogic" computers. He says there was no capacity for UiPath SRL to generate its own records in its own environment, and that there are no documents, independently sourced from UiPath SRL, to discover. 46 On the evidence before me, I am not persuaded that the CoreLogic parties have given complete discovery in respect of records relating to the activities of third parties associated with data scraping activities, as required by Order 4(g) made on 15 March 2021. I am satisfied that proposed Order 2(c) is appropriate and warranted, it being understood, as with all the proposed orders, that each of the CoreLogic parties is to give discovery of the documents that are or were in its control.

Proposed Order 3(a): the CoreLogic parties produce a list of individual email addresses contained within two email group accounts (DL-APAC Sales and DL-Exec 2017 CoreLogic International) referred to in documents produced to date by them 47 The CoreLogic parties' discovery includes documents sent through the group email accounts "DL-APAC Sales" and "DL-Exec 2017 Corelogic International". By way of example, one such document sent through these group accounts (COR.001.003.0104) refers to "Data Superiority packs" containing slides, for both internal and external use, comparing BCI's data to other data. 48 Neither the recipients in these group email accounts, nor the entities they represent, have been identified. Further, it is not possible to know how many recipients are in each group. The title "DL-Exec 2017 Corelogic International" suggests that emails have been sent to international CoreLogic executives. BCI contends that confirmation of the individuals in this group may reveal relevant CoreLogic entities involved in the conduct of which it complains, including entities not yet parties in the substantive proceeding. BCI submits that knowledge of the entities involved would be relevant to its decision whether to join further parties, both corporate and individual, to its substantive proceeding. 49 Further, one of the issues in dispute is the extent of executive knowledge of the alleged infringing conduct. BCI submits that it needs to know whether certain individuals were involved in, or had knowledge of, the CoreLogic parties' conduct, including the allegedly infringing conduct, for the purposes, once again, of determining whether or not to join further parties to its substantive proceeding. 50 The CoreLogic parties' immediate response is that historical email distribution lists are not maintained. Further, distribution lists change from time to time as employees come and go or are promoted to the "executive group". Mr Donohue has deposed that it may be possible for distribution lists, at particular times, to be "reconstructed". This, however, would involve the creation of a new document, not the discovery of an extant document. 51 The CoreLogic parties submit that there is no obligation on them to reconstruct or recreate records which no longer exist and which are not, therefore, in their possession or control. The CoreLogic parties submit, therefore, that no further discovery, according to this category, is warranted. 52 BCI submits that this response is misconceived. It contends that, for the purposes of the Federal Court Rules 2011 (Cth) (the Rules), "document" includes any record of information captured by the definition of "document" in Pt 1 of the Dictionary to the Evidence Act 1995 (Cth) (the Evidence Act). This definition is also incorporated, by reference, in the orders made on 12 November 2020. 53 BCI points to that part of the definition of "document" in the Evidence Act which includes: ... anything from which sounds, images or writings can be reproduced with or without the aid of anything else ... 54 BCI has not identified any "document" - the "anything" in the definition - that the CoreLogic parties can discover, which will "reproduce" the identities of the recipients in each group email account from time to time, throughout the period for which discovery is sought. Equally, it is not clear from Mr Donohue's evidence how the CoreLogic parties say they are able to reconstruct the historical (non-current) email distribution lists. 55 On the state of the evidence, I am not persuaded that I should order discovery in terms of proposed Order 3(a), in so far as it requires the recreation of historical lists that are no longer in existence. 56 I would, however, entertain an application by BCI, in the substantive proceeding, to administer interrogatories to elicit information as to the identities of the email recipients at relevant times. In saying this, I do not intend to pre-empt the outcome of any objection, which might be made, to permitting such interrogatories. 57 I do note, however, Mr Donohue's evidence that the process to restore the email addresses contained within the distribution lists, as at the date each relevant email was sent, is, in fact, being undertaken. Therefore, there does not appear to be any practical impediment, or obvious objection, to this exercise being done, other than that, as a matter of practice and procedure, it is not caught by an obligation to give preliminary discovery of documents. 58 I note that the CoreLogic parties contend that the current distribution lists do not fall within the discovery orders that have been made, apparently on the basis that the current lists do not reflect their form at the time each relevant email was sent. However, as BCI points out, the CoreLogic parties have not adduced evidence to identify the individuals who were recently added to the lists. It cannot be assumed that all recipients on the current distribution lists were not on the lists at the time the relevant emails were sent. 59 I am persuaded that the CoreLogic parties should give discovery of the current distribution lists. The current distribution lists will assist in gaining an understanding of the scope of distribution of the relevant emails and the entities involved in receiving them. It may also assist BCI in framing appropriate interrogatories directed to ascertaining the identity of historical recipients.

Proposed Order 3(b): the CoreLogic parties produce a list of their employees and agents who are directed by them to use proxy servers when using LeadManager, including the recipients of the documents referred to in certain paragraphs of Williams #6 60 In its written submissions, BCI says that it seeks confirmation of all employees and agents of the CoreLogic parties who were directed to use proxy servers when accessing and scraping data from LeadManager. It says that such documents are relevant to determine: whether CoreLogic employees or agents intentionally disguised their IP addresses, and a connection to the CoreLogic network, to surreptitiously access and extract data and materials from LeadManager; the role of these individuals within CoreLogic; and the location of these individuals. 61 The CoreLogic parties contend that Order 3(b) is not directed to the discovery of documents, and should not be made. 62 I am not persuaded that Order 3(b) should be made. I accept that it is not directed to the discovery of documents. However, I would entertain an application in the substantive proceeding for interrogatories to be administered directed to this subject matter. Once again, in making this observation, I do not intend to pre-empt the outcome of any objection, which might be made, to permitting such interrogatories.

Proposed Order 3(c): the CoreLogic parties produce the IP addresses of any employee or agent included in the list to be produced pursuant to proposed Order 3(b), including the IP address of the proxy servers used by them, including without limitation, the employee Ellena Bianco 63 My conclusion in relation to proposed Order 3(b) determines BCI's application for this proposed order.

Proposed Order 4: each CoreLogic party provide a further verified list of documents in accordance with r 20.17 and r 20.22 specifying with precision the discovery made by each respondent, including documents for which privilege is claimed, and the grounds of the privilege 64 If a person is ordered to give preliminary discovery under r 7.23 of the Rules, that person must file a list of documents in accordance with r 20.17: r 7.25. Rule 20.17 provides that the list must be in accordance with Form 38 and describe: the documents in the party's control; each document that was, but is no longer, in the party's control and what became of it; and each document in the party's control for which privilege from production is claimed, and the grounds of the privilege. 65 The orders made on 12 November 2020 expressly refer to these rules. The orders also make clear that each prospective respondent was to give discovery. 66 Further, r 20.22 provides that the required list of documents must be verified by affidavit. Where the party against whom discovery is ordered is a corporation, the affidavit must be made by an officer of that corporation. 67 On 29 April 2021, Mr Donohue made an affidavit purporting to comply with r 20.22. He did so in his capacity as "the Senior Leader, Software Engineering and Technology at the First, Second and Third Respondents". In that affidavit, Mr Donohue deposed that he was authorised to make the affidavit on behalf of the CoreLogic parties, but he did not state the basis of that authority or, indeed, make clear whether he was, in fact, an officer of any of those parties. Moreover, in making the affidavit, he referred to the CoreLogic parties collectively, on the basis that all the documents listed were stored in "a single IT environment". According to him: It is not possible to differentiate the source of documents as between the first, second and third prospective respondents ... in order to say which of them produced each document ... 68 As a consequence, only one list was provided. 69 I accept BCI's submission that this affidavit does not comply with rr 20.17 and 20.22. First, the fact that all discoverable documents are located in "a single IT environment" does not absolve each party from specifying which documents are, or have been, in its control (see the definition of "control" in Sch 1 to the Rules), and which documents in its control, are privileged from production. Secondly, Mr Donohue's reference to the CoreLogic parties "producing" documents does not address the question of "control". Thirdly, if it be the case that the documents, or one or more of them, are under joint control, then this should be specified with respect to the documents concerned. But each of the CoreLogic parties must give discovery, as ordered on 12 November 2020. This means that each must provide a separate list which is properly verified in accordance with the Rules.

Orders sought against the Gingold parties 70 There are only two orders sought against the Gingold parties. The first is an order that the time by which Gingold Investments is to comply with Orders 1 and 2 made on 12 November 2020, as varied, be extended. There is no dispute that this order should be made. It is accepted that a period of three weeks should be allowed. 71 The second proposed order is that Mr Colangelo "make all reasonable efforts to comply with his obligation to discover the books and records of Gingold Investments Pty Ltd". This order is opposed. I am not persuaded that I should make it. It conflates Mr Colangelo's and Gingold Investments' respective discovery obligations.

Costs 72 BCI seeks an order that the CoreLogic parties pay the costs of the present application. For their part, the CoreLogic parties submit that the appropriate order is that the costs of the application be costs in the cause. They have nevertheless sought an opportunity to address the question of costs once the outcome of the present application has been determined. I will give that opportunity to all the parties. I certify that the preceding seventy-two (72) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Yates.

SCHEDULE OF PARTIES NSD 529 of 2020 Respondents Fourth Respondent: GINGOLD INVESTMENTS PTY LTD (ACN 007 762 834) Fifth Respondent: ANGELO COLANGELO