1

US Ediscovery in Civil Litigation v. EU Data Protection Laws

Clash of The Titans

2

Monique Altheim, Esq.,CIPP

Owner and Managing Partner

The Law Office of Monique Altheim

New York, USA

monique@altheimlaw.com

718-462-2138

3

“The Position of the Americans is…quite exceptional.”

Alexis de Tocqueville, Democracy in America,1840, part 2, p.36.

• The US has the broadest pre-trial civil discovery procedure in the world.• Rule 26 (b) FRCP: "parties may obtain discovery regarding any matter, not privileged, that is relevant to any party's claim or defense."

4

“The Position of the Americans is…quite exceptional.”

Alexis de Tocqueville, Democracy in America,1840, part 2, p.36.

• Other Common Law Jurisdictions: Australia, Canada, United Kingdom, India, Singapore, Hong Kong and other former British Colonies.

Very restricted pre-trial discovery procedures.

5

“The Position of the Americans is…quite exceptional.”

Alexis de Tocqueville, Democracy in America ,1840, part 2, p36.

• Civil Code Countries: Europe, Latin America, China, most former Continental European colonies in Africa & Asia.

“Pre-trial discovery? Huh?”

6

“The Position of the Americans is…quite

exceptional.” Alexis de Tocqueville, Democracy in America,1840, part 2, p.36

• TAKEWAY: When dealing with American affiliates abroad, don’t assume knowledge of basic US pre-trial discovery obligations.

7

Legal Issues in Cross-Border Civil Ediscovery

•Privacy/Data Protection Laws•Blocking Statutes•Bank Secrecy Laws•Labor Laws•Criminal Laws

8

US vs. EU: Clash of The TitansUS ediscovery obligations vs. EU Data Protection Obligations

US: Broadest pre-trial civil ediscovery system on the planet.

EU: Strictest Data Protection framework on the planet. Data Protection is a human right. (article 7 of the EU Charter of Fundamental Rights).

9

US vs. EU: Clash of The Titans

What is the US legal basis for discovery abroad?

• Rule 34 FRCP

or• the Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters

10

US vs. EU: Clash of The TitansWhat is the US legal basis for discovery abroad?

Rule 34 FRCP:(a) In General. A party may serve on any other party a request within the scope of Rule 26(b):(1) to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control:

Mt. Hawlwy Ins.Co.v. Felman Prod., Inc. 269 F.R.D. 609, 610 (S.D.W.Va 2010)

11

US vs. EU: Clash of The TitansWhat is the US legal basis for discovery abroad?

The Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters:

“letters of request” or “letters rogatory” petitions from the court of one country to the designated central authority of another requesting assistance from that authority in obtaining relevant information located within its borders.

12

the Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters:

• not all EU Member States are parties to the Hague Convention. (e.g. Belgium)• reservations under Article 23:“a contracting state may at the time of signature, ratification or accession declare that it will not execute letters of request issued for the purposes of obtaining pre-trial discovery of documents. Many signatory States, including France, Germany, Spain and the Netherlands have filed such reservations under Article 23.• unduly time consuming; can take more than a year.• discovery request must be very specific. Broad requests are denied.

13

US vs. EU: Clash of The Titans

What is the US legal basis for discovery abroad?

Société Nationale Industrielle Aérospatiale v United States District Court, 482 U.S. 522, 544 n.28 (1987)

FRCP prevails!

However, “International Comity” demands following balancing test:

  1)the importance to the litigation of the information requested; 2) the degree of specificity of request; (3)  whether the information originated in the United States; (4)  the availability of alternative means of securing the information; (5) the extent to which non-compliance would undermine the interests of the United States or compliance with the request would undermine the interests of a foreign sovereign nation.

14

US vs. EU: Clash of The Titans

What is the EU legal basis for discovery in the EU?

Article 29 Working Party Working Document 1/2009 on pre-trial discovery for cross border civil litigation: WP 158• Recommends the Hague Convention, but in absence thereof, sets forth Guidelines.

15

WP 158 Guidelines

All Data Protection Principles, contained in the European Directive 46/95/EC (The Directive) must be complied with:•Proportionality Principle•Transparency Principle•Data Subject’s Rights such as Access.•Data Security•External Service Providers•Legal Basis for Processing•Legal Basis for Transfer to Third Countries

16

Directive 46/95/EC

• Directive acts as a floor: Member States can add but not subtract.• Applies to all 27 Member States of the EU plus Iceland, Liechtenstein and Norway. (The European Economic Area or EEA).• Has been implemented in the national laws of the EEA States with many variations.• Is currently under review for being too outdated.

17

Directive 46/95/EC

Legal Basis for Processing Personal Data for Ediscovery

Article 7

Member States shall provide that personal data may be processed only if:

(a) the data subject has unambiguously given his consent; or

(f)  processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).

18

Directive 46/95/EC Legal Basis for Processing SENSITIVE Personal Data for Ediscovery

Article 8 • a) the data subject has given his explicit consent to the processing of those data, except where the laws of the Member State provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject's giving his consent; or• e) the processing … is necessary for the establishment, exercise or defence of legal claims.

19

Directive 46/95/EC

Legal Basis for TRANSFER of Personal Data to the US

Article 25 and 26

• Adequate Country: US is not an “adequate Country”• Unambiguous Consent of Data subject. Consent must be freely given. • Organizations that have been “Safe Harbor” certified• Organizations that have Binding Corporate Rules (BCRs) in place• The transfer occurs under “Standard Contract Clauses” agreements.

• Caveat: None of the above covers onward transfer to third parties, such as opposing parties and the courts, or data review centers in India.

20

Latest Developments:

• The European Commission’s Proposal for a REGULATION of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (2012)

• The Sedona Conference® International Principles on Discovery, Disclosure & Data Protection (2012)

•American Bar Association Resolution 103 (2012)

21

Practical Takeaways•Know where your data are: Develop a data map of the types and location of ESI under your control. Include the Cloud and mobile devices.•Practice sound data governance. Don’t hoard unnecessary data.•Obtain the advice of local experts regarding data privacy and other restrictions.•Prepare the necessary notice and consent forms.•Develop a strategy for local legal hold, collection and review.•Process as many data as possible locally. Minimize the amount of personal data to be transferred to the US through the use of narrow search terms, predictive coding, anonymization, pseudonimyzation and redaction of personal information.•Secure the data adequately.•Involve the US courts early on in the process, e.g. at the meet and confer meeting.•Educate the US courts about EU Data Protection laws and restrictions. Obtain affidavits from legal experts and government authorities.•Provide the US courts with enforcement examples by DPAs (Data Protection Authorities) for non-compliance to show real possibility of harm.•Request protective orders from US Courts to guarantee data confidentiality.•Document everything early and often to demonstrate good faith and reasonableness to both Data Protection Authorities and Federal Judges.

22

SourcesThe Hague CONVENTION ON THE TAKING OF EVIDENCE ABROAD IN CIVIL OR COMMERCIAL MATTERS (1970)

http://www.hcch.net/index_en.php?act=conventions.text&cid=82

 FEDERAL RULES OF CIVIL PROCEDURE (2006)

http://www.law.cornell.edu/rules/frcp/

Societe Nationale v. District Court - 482 U.S. 522 (1987)

http://www.law.cornell.edu/supremecourt/text/482/522

 DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (1995)

 http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

The EU Charter of Fundamental Rights

http://www.europarl.europa.eu/charter/pdf/text_en.pdf

Article 29 Working Party Working Document 1/2009 on pre-trial discovery for cross border civil litigation

http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2009/wp158

The Sedona Conference® International Principles on Discovery, Disclosure & Data Protection (2011)

http://www.thesedonaconference.org/dltForm?did=IntlPrinciples2011.pdf

The European Commission’s Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) 

http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf

American Bar Association Resolution 103

http://www.abanow.org/wordpress/wp-content/files_flutter/13285610062012mm103.pdf

 

 

23

Thank You!

Questions?

monique@altheimlaw.com

718-462-2138