Even when stringent protective orders are in place, clients are often concerned that the sensitive information they are required to produce in litigation will end up being disclosed or used for improper purposes. Clients often ask whether the protective order is strong enough to ensure that the other side will comply with the provisions. It became a little clearer this week that protective order violations can be expensive, even when courts find no bad faith. In a February 17, 2026 Order in the multidistrict litigation (MDL) In re: Uber Technologies, Inc., Passenger Sexual Assault Litigation, No. 3:23-md-03084-CRB (LJC) (N.D. Cal. 2026), Magistrate Judge Lisa Cisneros sanctioned plaintiffs’ counsel $30,000 plus reasonable attorney’s fees for disclosing confidential information across multiple cases, sending a clear message that compliance with protective orders is non-negotiable and self-help is not an option. Judge Cisneros left open the door for more severe sanctions if the plaintiffs’ counsel continued to violate the Protective Order. This ruling makes it clear that it is important to take the time to negotiate a strong protective order that can be enforced should the need arise.

Background

Bret Stanley, one of several plaintiff attorneys in the MDL proceeding against Uber, also represents plaintiffs in other matters against Uber. The Court previously determined that Stanley violated the Protective Order in the MDL by disclosing information that Uber had designated as confidential in the MDL. Uber filed motions to enforce the Protective Order against Stanley in August 2025 and again in December 2025.

First Protective Order Violation (August 2025)

Uber argued that either Stanley or his co-counsel violated the Protective Order, which provided that a “Receiving Party may use Protected Material that is disclosed or produced by another Party or by a Non-Party in connection with this case only for prosecuting, defending, or attempting to settle this Action or the consolidated [California JCCP] action captioned In re Uber Rideshare Cases…so long as such use is permitted herein” Specifically, Stanley included lists containing protected information, specifically the names of Uber policies and how Uber categorized the policies, in discovery requests served on Uber in other cases in Texas and New Jersey, and nearly identical requests were served by other plaintiffs’ attorneys in two additional New Jersey cases. In a ruling on the record for an August 12, 2025 hearing, the Court found that Stanley’s spreadsheets and document requests in other litigation disclosed the complete substantive contents of certain documents Uber designated as confidential in the MDL, stating that it was “pretty straightforward that a disclosure occurred” and noting that “Stanley could have challenged Uber’s confidentiality designations if he had wished to do so, but that he never did.”

On August 18, 2025, the Court adopted a joint proposed order finding that Stanley violated the Protective Order. The Court ordered Stanley to identify all persons outside the MDL to whom he disclosed confidential information and to provide a copy of the order to those persons and courts within three days. The Court also ordered Stanley to take reasonable efforts to retrieve or ensure destruction of all unauthorized confidential information. The Court did not impose monetary sanctions in August.

However, Stanley failed to notify the appropriate courts and persons of the Court’s August 18, 2025 order within the required three-day deadline. Additionally, despite the Courts order that Stanley needed to ensure that the material was destroyed and his co-counsel’s knowledge of the violation, his co-counsel refiled the same confidential material in the public record in one of the cases on October 8, 2025, with the filing remaining publicly accessible for approximately thirteen days.

Second Protective Order Violation (December 2025)

Separately, Stanley searched for documents related to another matter in the repository of documents that Uber produced in the MDL, including documents designated as confidential under the Protective Order. Stanley then relied on what he found in a confidential document to advance arguments in his unrelated matter, though he did not disclose the document itself to that court or others unauthorized to see it. Stanley had access to this repository of documents because of his membership in the Plaintiff Steering Committee.

The Court’s February 17,2026 Order

            First Motion for Sanctions for the Disclosure of the Policy List

The Court found that “Stanley’s disclosure of that information unilaterally rendered Uber’s designations meaningless, disregarding the Protective Order’s process for challenging a designation if parties reasonably disagree over whether information should be protected” and that “[a]ttorneys do not have ‘discretion to decide unilaterally that competing rationales…permit the blatant breach of preexisting protective orders.’” The Court found that Stanley’s interpretation of the Protective Order was impermissible and unreasonable and that some sanction was required under Rule 37(b)(2)(C). On the other hand, Uber had not shown significant actual or likely harm from the disclosure, and its request for attorneys’ fees was excessive under the circumstances.

Given Stanley’s failure to take reasonable efforts to retrieve or ensure destruction of all unauthorized confidential information after being ordered to in August 2025, the Court granted Uber’s first motion for sanctions in part in its February 2026 Order and ordered Stanley to pay Uber $30,000 as partial reimbursement for its attorneys’ fees within thirty days. The Court considered several factors in reducing the fee award of $168,572.97 original requested by Uber, including:

  • Uber delayed seeking sanctions and appeared to have “sandbagged” its request, with no indication in its original motion that more than $150,000 in attorneys’ fees would be sought and “remain like a sword handing by a slender thread, ready to drop if Stanley was late or otherwise delinquent in meeting his obligations”
  • Uber’s billing records showed the matter was overstaffed with senior attorneys and overworked beyond what was reasonable for the matters in dispute
  • While disclosure was improper, Uber had not shown actual harm, and the lack of harm informed the Court’s assessment of a just sanction
  • Uber’s own conduct in the MDL warranted a reduction in the fees that it should be permitted to recover because the Court previously found that Uber likely violated at least one discovery order and had “wasted the Court’s and Plaintiffs’ time” through incomplete and misleading disclosures
  • Stanley directly revealed protected material only to other attorneys and courts
  • Stanley genuinely, though unreasonably, believed his disclosure did not violate the Protective Order, and Uber had not shown bad faith

The Court also recognized that protective orders for confidential information are not intended to serve as barriers to efficient and effective discovery in other litigation. Accordingly, the Court ordered the parties to meet and confer regarding the degree to which Uber’s policy names are “CONFIDENTIAL” or “HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY” within the meaning of the Protective Order and “to consider whether a modification to the Protective Order is appropriate to allow for limited use of this or other material designated as confidential in serving discovery requests in other litigation, subject to specific safeguards to prevent undue public disclosure.”

            Second Motion for Sanctions for Conducting an Unauthorized Search

For the second motion involving Stanley’s unauthorized search of the MDL discovery repository, the Court found that Stanley violated the Protective Order “when he resorted to self-help to research his [] client’s claims in the confidential MDL discovery repository” and that sanctions were appropriate under Rule 37(b)(2)(C). The Court ordered Stanley to pay Uber’s reasonable attorneys’ fees for bringing that motion, with the parties encouraged to negotiate the amount. 

The Court also referred Uber’s request to disqualify Stanley from the Plaintiff Steering Committee to the appropriate court for resolution.

Our Take

Regardless of the type or size of litigation, the majority of the parties will at some point be required to produce highly sensitive and confidential information to the other side. Production of the information does not convey any additional rights or ownership to the receiving party, nor does it grant the receiving party rights to use this information as it sees fit. However as soon as a party produces the information, their ability to control the information decreases dramatically. Protective orders provide rules for this exchange of information allowing parties to share sensitive information with other parties in order to further the truth-seeking function of the court and to avoid surprises at trial without needing to worry that the information will be used for improper purposes or cause harm to the producing party. If a party believes an opponent’s designation is unwarranted, the right approach is to meet and confer and raise a challenge to the court if necessary not decide unilaterally what portions of an opponent’s confidential documents can and cannot be disclosed.

This Order makes clear that protective orders are not perfunctory agreements nor orders that are issued at the beginning of litigation and then have little meaning as the case unfolds. Compliance is non-negotiable and courts are prepared to order parties to comply. 

This ruling also highlights the importance of carefully negotiating the protective order and being prepared to enforce it if it becomes necessary. When negotiating the protection of sensitive information, it is crucial for parties to consider cyber security obligations that should be incorporated, as we have discussed in prior blog posts and articles: LINK and LINK. If more courts take the approach Judge Cisneros did, that may give some comfort to clients who have to produce sensitive information in order to comply with their discovery obligations knowing the court  will impose sanctions where “necessary and sufficient to deter future violations and appropriate to partially compensate [the producing party] for its costs.”