EU data privacy and US discovery. Dr. Detlef Hass, Lovells LLP Munich Quentin Archer, Lovells LLP London

Size: px

Start display at page:

Download "EU data privacy and US discovery. Dr. Detlef Hass, Lovells LLP Munich Quentin Archer, Lovells LLP London"

Nicholas Stanley
7 years ago
Views:

1 EU data privacy and US discovery Dr. Detlef Hass, LLP Munich Quentin Archer, LLP London LLP

2 Outline I. The two worlds US discovery and EU data privacy II. The conflict The view of US courts and EU authorities on the conflict between the systems III. The solution Possible courses of action

3 The two worlds US discovery and EU data privacy LLP

4 Essence of US discovery Mutual knowledge of all relevant facts gathered by both parties is essential to proper litigation Either party may compel the other to disgorge any facts in its possession

5 Scope of US discovery A party may discover any matter relevant to the claim or defence of a party A party may discover any matter that reasonably calculated may lead to discovery of admissible evidence

6 Exceptions from US discovery Privileged documents Documents prepared or acquired in anticipation of litigation or for a trial Documents that are under a protective order of the court

7 Summary of US discovery US discovery provisions very broad Vast amount of internal documents to be disclosed Only limited exceptions from discovery obligations

8 Essence of EU Data Privacy Law Personal data of natural persons may not be freely processed Justification necessary for every separate processing of personal data

9 Scope of EU data privacy Personal data Any information relating to an identified or identifiable natural person ('data subject'), such as: Employee s position address Phone number Covers almost all information that relates to a natural person

10 Scope of EU data privacy (2) Processing of data Any operation or set of operations which is performed upon personal data Nearly every data-related operation: Litigation hold Collection of the data from the individual employee Review of the data Transfer of the data to the US Transfer to the court/opposing party Presentation to the jury and/or other persons

11 Scope of EU data privacy (3) Who is responsible under the law? "Data controllers" are responsible for the processing of all personal data which they control "Data processors" who act on behalf of data controllers: are not normally directly subject to the law, but must have a written contract with the data controller this contract must contain provisions ensuring security

12 Summary of EU data privacy High level of protection of personal data Basically all information concerning natural persons protected Protection against nearly any form of use by almost anyone

13 The view of US courts and EU authorities on the conflict between the two systems LLP

14 The view of US courts Supreme Court in Societe Internationale v. Rogers (1958) Threat of violating a foreign law can justify noncompliance with an otherwise valid production order Court of Appeals for Second Circuit in In re Chase Manhattan (1962) Court should not order production that requires violation of foreign law

15 The view of US courts (2) Major shift with ALI Restatement in 1965 Violation of foreign law is not "per se" obstacle to discovery Courts should consider the extent to which the ordered party has acted in good or bad faith Courts should balance the conflicting interests at stake and the hardship imposed on the ordered party

16 The view of US courts (3) Tendency of US-courts to order discovery of documents oversees currently ongoing, e.g. Bodner vs. Paribas (2000) Strauss vs. Credit Lyonnais, S.A. (2007)

17 The view of US courts (4) US courts favour discovery over data privacy when (some of) the following aspects apply Documents of high importance for trial are requested Request is specific Information originated in the US Alternative means of securing privacy are available Non-disclosure could undermine important interests of the US

18 The view of EU authorities Disclosure of personal data without justification is a violation of the data privacy laws Up to now regulatory intervention has been light when compared with the large amount of traffic in international data

19 The view of EU authorities (2) Recently national authorities have increasingly penalised violations Vodafone fined $100 million by Greek Data Protection Authority for alleged illegal wiretapping Zeppelin fined over 1 million in Spain for various breaches, including lax security Tyco fined 30,000 in France for transferring employee data to the US

20 Summary of the conflict Both systems seemingly in irresolvable conflict Both systems currently "tightening the screws" Transatlantic "discussion" may grow increasingly tense in the near future

21 Summary of the conflict (2) Is compliance impossible? We are caught between complying with the U.S. and European rules, and it s a train wreck. L. Schrank, CEO of the Society for Worldwide Interbank Financial Telecommunication (SWIFT)

22 Possible courses of action LLP

23 Compliance with EU data privacy when collecting data for US proceedings 1. Authorities and data subject must be notified of data processing 2. Justification is necessary for each data processing operation 3. Data transfer to US must also be justified

24 Step 1 Notification of authorities and data subjects Information provided to authorities and data subjects must be sufficiently specific, e.g. Identity of data controller Purposes of processing Recipients of data

25 Step 2 Justifications for data processing Personal data may be processed, if Necessary for compliance with a legal obligation of controller, or Necessary for legitimate interests of controller or third parties outweighing interests of data subject, or Data subject gives unambiguous, free consent For highly sensitive data (on religion, political opinions etc.) even higher legal hurdles apply

26 Step 2 Justifications for data processing (2) Exception 1: Legal obligation of the controller Problem: Parent company in US is party to US litigation but subsidiary data controller in Europe is not EU Working Party: Compliance with non-eu legal obligations does not justify processing of employee data in Europe for purposes of litigation Exception 2: Legitimate interests of controller or third parties Similar problems as with exception 1 above Questionable whether vast disclosure will be legitimate interest or "necessary"

27 Step 2 Justifications for data processing (3) Exception 3: Freely given consent Free consent possible in employer-employee relationship? Data subject must be notified exactly which data is being transferred for which purposes Data subject must have access to data and be able to rectify it Data subject may freely revoke consent

28 Step 3 Admissibility of data transfer EU holds view that US laws do not provide adequate protection of personal data Free transfer to US not admissible

29 Step 3 Admissibility of data transfer (2) Exceptions to inadmissibility of transfer apply, if Necessary for establishment, exercise or defence of legal claims or Safe Harbor agreement exists or Contractual clauses guaranteeing adequate data privacy protection exist or Binding corporate data protection rules exist or Freely given consent of data subject

30 Step 3 - Admissibility of data transfer (3) Legal claims exception EU Working Party: Transfer only possible to countries that comply with Hague Convention on taking of evidence (US courts do not typically use this route) Access to Justice Convention of 25 October 1980 (Not signed by US)

31 Step 3 - Admissibility of data transfer (4) Safe Harbor exception Safe Harbor is self-certification procedure with US Department of Commerce Exception only applies to those that adhere to the Safe Harbor principles Not available to financial institutions Data privacy compliance issues arise when disclosure to jury, court, or other party

32 Step 3 - Admissibility of data transfer (5) Contractual clauses exception Agreement between data controller and data recipient guaranteeing adequate level of data protection EC has issued decisions on valid standard clauses Exception only applies to those who sign agreement Standard clauses may not be modified Data privacy compliance issues arise when disclosure to jury, court, or other party

33 Step 3 - Admissibility of data transfer (6) Binding corporate rules exception Intra-company system with binding legal effect which details what information is collected how it is processed and stored who may access the data Approval by EU regulators allows free data transfer between international offices Exception only applies within the company Compliance issues when disclosure to jury, court, or other party

34 Result Establishing system that shows good faith in both directions is vital System relying on multiple data processing and transfer justifications should be implemented Protective orders in US courts aligned with data privacy laws provide additional legal protection

35 LLP and its affiliated businesses have offices in: Alicante Amsterdam Beijing Brussels Budapest Chicago Dubai Dusseldorf Frankfurt Hamburg Ho Chi Minh City Hong Kong London Madrid Milan Moscow Munich New York Paris Prague Rome Shanghai Singapore Tokyo Warsaw Zagreb is an international legal practice comprising LLP and its affiliated businesses. LLP is a limited liability partnership registered in England and Wales with registered number OC Registered office and principal place of business: Atlantic House, Holborn Viaduct, London EC1A 2FG. The word "partner" is used to refer to a member of LLP, or an employee or consultant with equivalent standing and qualifications, and to a partner, member, LLP employee or consultant in any of its affiliated businesses who has equivalent standing. New York State Notice: Attorney Advertising.

Merger Control Issues and Private Equity Transactions

Merger Control Issues and Private Equity Transactions Further information If you would like further information on any aspect of Merger Control and Private Equity Transactions please contact a person mentioned