OCR Documents Under a Protective Order: Vendor Rules

You may OCR documents under a protective order through an outside service only if the order allows disclosure to that kind of vendor and you meet its conditions. The order's access list says who may see designated material. Find the vendor clause, the undertaking it requires and the destruction clause before a single page is uploaded.

Protective orders are negotiated case by case, so yours may read differently from any sample. This post uses one court's published model orders as a worked example of the clauses to find. It explains how to handle the documents and is not legal advice. Your own order controls.

What does a protective order say about outside vendors?

A protective order can say three things about vendors: which kinds of service providers may receive designated material, what they must sign first, and how the material must be stored. If the order says nothing, no vendor is authorized until the order is changed or the designating party agrees in writing.

The authority for these orders in federal civil cases is Rule 26(c) of the Federal Rules of Civil Procedure. It lets a court, for good cause, issue an order "requiring that a trade secret or other confidential research, development, or commercial information not be revealed or be revealed only in a specified way". The specified way is what the parties write into the order.

A useful sample is the Northern District of California's model stipulated protective order for standard litigation, one of the model protective orders the court publishes. Four of its clauses bear on an OCR upload:

Your order may use other words for the same ideas: "litigation support vendors", "outside copy services", "e-discovery providers". It may also carry a data security section with requirements of its own. Search the order for "vendor", "service", "copy", "storage" and "data" and read every hit.

One clause is easy to miss. The model order opens its access list with "Unless otherwise ordered by the court or permitted in writing by the Designating Party". That sentence is a route as well as a limit. If your order does not clearly cover a tool you want to use, written permission from the party that designated the material can supply what the text does not.

Is an OCR service a vendor under your protective order?

An OCR service is a vendor under your order only if it fits the order's definition and you can satisfy the conditions attached to that definition. A definition like the Northern District model's, which covers retrieving data in any form, plausibly reaches text conversion. Whether your order's wording does is a reading for the responsible lawyer.

Ask four questions of the definition:

1. Does the list of services fit? Converting page images to text sits close to copying and to "organizing, storing, or retrieving data". An order limited to "court reporters and copy services" is a harder fit.
2. Is disclosure "reasonably necessary"? The model order ties vendor access to necessity for the litigation. Being able to search 4,000 scanned pages is an easy case to make. Convenience on a ten-page set is weaker.
3. Does the definition reach subcontractors? The model includes a vendor's "employees and subcontractors". A hosted service may pass pages to other companies for processing. If your order is silent on subcontractors, ask the vendor who else handles the file.
4. Are there limits on where data may go? An order may restrict storage to particular countries or systems, or keep its most sensitive tier off networked computers altogether.

One distinction comes before all four. Running OCR inside software installed on your firm's own computer involves no outside party, so the vendor clause never comes into play. A web service does involve one. That difference is why the same task can be routine for one document and a problem for the next.

Material sealed by the court is a separate category from designated discovery, with different rules. The post on OCR for sealed records deals with it.

The model order's limits fall on a "Receiving Party", which means on what you received from the other side. Your own client's documents, even ones your side stamped confidential before producing, are a different pile. Keep the two sets apart so that you apply the order to the right pile.

A protective order can also say where electronically stored information may live, and converted text counts as a new copy of that information. Read the storage clause before you choose a hosted converter. Client confidentiality duties sit beside the order. Mark each batch with the pile it came from, and if the order sets a return date, put that date on the conversion log.

Confidential and attorneys' eyes only designations after conversion

A designation follows the content, so every Word, Excel or text export of a designated page carries the same designation as the page. What does not always follow is the marking. A searchable PDF keeps the page image and its stamp. A text or spreadsheet export may hold the stamp only as a stray line, or not at all.

The Northern District model requires a producing party to "affix the legend 'CONFIDENTIAL' to each page that contains protected material". That legend is part of the page image. After conversion:

• Searchable PDF. The image is unchanged, so the legend is still visible on every page.
• Word and plain text. The legend may be recognized as a line of text in a header or footer position, may land in the middle of a paragraph, or may be dropped. Nothing guarantees which.
• Excel and CSV. A table pulled from a designated page has no legend. The cells look like any other spreadsheet.

So mark exports yourself. Put the designation in the file name (CONFIDENTIAL_BRT0004127.docx), and add it as the first line of a text export or a header row above a table. Keep the production's Bates number with every export so that anyone can trace a paragraph to the stamped page.

The higher tier

An order may have a second tier. The Northern District's model order for patent and highly sensitive cases defines its "ATTORNEYS' EYES ONLY" tier as "extremely sensitive" information whose disclosure "would create a substantial risk of serious harm that could not be avoided by less restrictive means." That model still lists Professional Vendors among the permitted recipients for the tier, on the same signed-acknowledgment condition. It also offers an optional source code tier, with inspection on a secured computer, which rules out an upload altogether where the parties adopt it.

Two practical consequences follow for a mixed production:

• Sort by tier before you convert. Run confidential and attorneys' eyes only material as separate batches into separate folders. A single merged export makes it impossible to share the lower tier with a client contact who may see only that tier.
• Watch who can open the workspace. If the tool's account is shared across your team, everyone with access to it can read the exports. The people on the account must all be people the order allows for the highest tier stored there.

A designation can also change. The model order provides for challenges to a designation and for correcting a failure to designate. When a document is upgraded or downgraded, the exports need the same change, and the conversion log is how you find them.

Signing the undertaking: who at the OCR vendor is bound?

The undertaking binds whoever signs it, and a form like the Northern District model's is written for a named individual. That fits an expert or a court reporter. It fits a self-service web tool poorly, because nobody at the provider reads your order or signs anything when you upload a file. Settle this before you rely on the vendor clause.

The Northern District model's form, Exhibit A, begins "I, [print or type full name]" and is made "under penalty of perjury". The signer agrees "to comply with and to be bound by all the terms of this Stipulated Protective Order", submits to the court's jurisdiction, and appoints an agent in California for service of process. That is a serious personal commitment. A provider's standard terms of service are not the same thing.

Questions to put to an OCR vendor in writing:

• Will an authorized person sign the order's acknowledgment on the company's behalf, and who?
• Does the signature cover employees who can reach customer files, and any subcontractor that processes them?
• If the company will not sign, what written confidentiality terms does it offer instead?
• Will it tell you if it receives a subpoena or other demand for your documents?

Then match the answer to your order:

Schema Law's published plans do not mention protective order undertakings. The Enterprise plan lists "Security questionnaire and contract review" and says no more about what that review covers. Ask the question, and get an answer in writing before treating any plan as covered by your order. The post on the OCR vendor data processing agreement goes through the contract clauses that sit alongside an undertaking.

Your own side signs too. The model order requires the acknowledgment from the employees of outside counsel "to whom it is reasonably necessary to disclose the information". Check that the paralegal doing the conversion is on the list.

A pre-upload checklist for protected discovery material

Run a fixed checklist before any designated material goes to an OCR service, and keep the completed list in the matter file. It gives you a record of the reasoning if the other side ever asks how its documents were handled.

1. Pull the current order. Use the version entered by the court, with any amendments. A draft stipulation is not the order.
2. Find the vendor definition and the access list. Copy both clauses into your note.
3. Identify each tier in the set. Count pages by designation.
4. Decide whether conversion is reasonably necessary for each tier, and write one sentence saying why.
5. Check the storage and data clauses against where the tool keeps files and for how long.
6. Resolve the undertaking. Signed form, written permission from the designating party, or no upload.
7. Confirm who has access to the account and that each person has signed the acknowledgment if the order requires it.
8. Convert in batches by tier, into folders named for the tier.
9. Mark every export with the designation and the Bates range.
10. Log it. Date, person, tool, Bates range, export formats, and the date the upload was deleted from the service.

A worked example

A fictional case: Harlan Tooling sues Brightwater Castings. Brightwater produces 4,200 scanned pages, 3,900 stamped CONFIDENTIAL and 300 stamped ATTORNEYS' EYES ONLY. The order follows the model language.

Harlan's paralegal checks the definition and concludes that text conversion is a litigation support service. The vendor's reply to her email says it will not sign Exhibit A but will sign a short confidentiality agreement. The supervising lawyer sends that agreement to Brightwater's counsel, who consents by email for the CONFIDENTIAL tier only. The 3,900 pages are converted through the service. The 300 pages are converted on a firm workstation. Both decisions go in the log with the email attached.

If the production arrived as unsearchable images in the first place, you may have had a right to something better. The post on searchable productions explains whether you can require a searchable production.

If something goes wrong

Check what your order says about an unauthorized disclosure. The Northern District model requires the receiving party to "immediately" notify the designating party in writing, use "best efforts to retrieve all unauthorized copies", inform the recipient of the order's terms, and ask the recipient to sign the acknowledgment. If you discover that designated material went to a tool your order does not cover, read that clause first and take it to the responsible lawyer the same day.

Returning or destroying converted copies when the case ends

When the case ends, the destruction clause reaches every converted copy, including the upload still sitting in a vendor account and each export on your own systems. An order like the Northern District model sets a deadline and requires a written certification. You can only certify what you can find, which is why the conversion log matters.

The Northern District model gives a receiving party "60 days after the final disposition of this action" to "return all Protected Material to the Producing Party or destroy such material." It defines the term broadly: "all copies, abstracts, compilations, summaries, and any other format reproducing or capturing any of the Protected Material." A Word export, a spreadsheet of extracted tables and a JSON file all capture the material in another format. The receiving party must then submit a written certification that identifies what was returned or destroyed and affirms that it "has not retained any copies".

There is a carve-out. Under the model, counsel may keep "an archival copy" of pleadings, motion papers, transcripts, correspondence, exhibits, expert reports and work product, "even if such materials contain Protected Material", and those copies stay subject to the order. A loose folder of OCR exports is not obviously on that list. Read your own order's carve-out before deciding that converted text can stay.

A closing routine:

1. Open the conversion log and list every upload and export of designated material.
2. Delete the uploads from the OCR service and note the date. Ask the vendor how long deleted files persist in backups if your order's wording makes that matter.
3. Delete or return the exports in the matter folder, download folders, email attachments and any review platform.
4. Check whether any export was sent to an expert or a client contact, and collect their confirmations.
5. Prepare the certification from the log.

Do not wait for the end of the case to delete the vendor's copy. Once exports are downloaded and checked, the upload has done its work. Schema Law's site lists "Delete any document, at any time" for every plan, and nothing is deleted automatically, so the upload stays until you remove it. Make deletion the last step of the conversion.

The confidentiality duty itself outlasts the deadline. The model states that the order's obligations "shall remain in effect until a Designating Party agrees otherwise in writing or a court order otherwise directs." An export you kept under the archival carve-out is still protected five years on.