Sedona Conference Issues International Principles On Discovery And Data Protection

Multinational companies based in the United States (or with significant operations in the United States) may be subject both to the civil procedure discovery rules of the United States as well as the privacy laws of the European Union and other countries in which they operate. Complying with these potentially conflicting bodies of law may pose difficult challenges for such companies.

Recently, Working Group 6 of the Sedona Conference issued a draft document aimed at addressing this conflict entitled “International Principles on Discovery, Disclosure & Data Protection: Best Practices, Recommendations & Principles for Addressing the Preservation and Discovery of Protected Data in U.S. Litigation,” text available at www.thesedonaconference.org [the “Sedona International Principles”]. The International Principles are the product of nearly six years of work, involving representatives from the legal profession, judges, privacy and compliance leaders, academics and discovery service vendors from around the globe.[1] The Principles represent one of the most comprehensive of efforts to reconcile (to the extent possible) conflicting notions of data privacy and norms for disclosure in litigation.

Nature Of The Conflict

The International Principles aim principally at a potential conflict between U.S. and EU law.[2] Companies operating in the EU must abide by the laws of individual EU member countries as well as the EU Data Protection Directive (the “Directive”), 95/46/EC. The Directive, which took effect in 1998, required each member of the EU to pass data protection laws that comply with the Directive’s minimum standards. These standards require, among other things, that companies give data subjects (such as consumers and employees) access to correct their data, that they use personal data only for the purpose for which it was obtained, and that they not transfer personal data to countries (such as the United States) found to lack adequate data protection laws. If a company violates these data privacy laws, the Directive allows EU member governments to seek civil fines, injunctions and even criminal sanctions. In addition, some countries (notably, France in its Penal Law No. 80-538) have adopted “blocking” statutes, which are specifically designed to protect their citizens from compelled discovery of information in court proceedings outside their borders.

The U.S., unlike the EU, embraces broad discovery in civil litigation. Under Rule 26 of the Federal Rules of Civil Procedure, parties may obtain disclosure of any matter not privileged that is relevant to a claim or defense in an action. Materials disclosed need not be admissible as evidence, so long as they “may lead to the discovery of admissible evidence.” Parties responding to discovery requests may obtain protection from unreasonably burdensome or expensive requests.

When a U.S. court exercises jurisdiction over a European party (or a U.S. party that maintains some data in Europe), conflicts may result between U.S. civil discovery rules and European data protection rules. In the case of “Christopher X,” the Criminal Chamber of the French Supreme Court upheld the criminal conviction and fine of a French lawyer for violating the French blocking statute.[3] Yet, in a similar case in the United States, an American court rejected the French blocking statute as a basis to preclude discovery in a U.S. proceeding,[4] and American courts have remained skeptical of claims that foreign privacy and blocking statutes are vigorously enforced.[5] As these and several other recent cases illustrate, however, the conflict in rules is quite real.[6]

The U.S. is a signatory to the Hague Evidence Convention,[7] yet, in the Aérospatiale case,[8] the U.S. Supreme Court held that courts in the United States were not bound to use the Hague Convention and that the convention did not preempt the Federal Rules of Civil Procedure with respect to discovery from foreign litigants. The Court described Hague Convention procedures as optional supplementary measures that need not be used where they would be “unduly time consuming and expensive, as well as less certain to produce needed evidence than direct use of the [Federal Rules].” To determine whether to use the Federal Rules or the Convention, the Court in Aérospatiale considered: “(1) the intrusiveness of the discovery requests given the facts of the particular case, (2) the sovereign interests involved and, (3) the likelihood that resort to the Convention would be an effective discovery device.”[9] The Sedona International Principles build on this analysis of relevant concerns.

The International Principles

The new Sedona International Principles identify six essential principles for reconciliation of the potential conflict between privacy and disclosure in the context of U.S. litigation:

1. With regard to data that is subject to preservation, disclosure or discovery, courts and parties should demonstrate due respect for the data protection laws of any foreign sovereign and the interests of any person who is subject to or benefits from such laws.
2. Where full compliance with both data protection laws and preservation, disclosure, and discovery obligations presents a conflict, a party’s conduct should be judged by a court or data protection authority under a standard of good faith and reasonableness.
3. Preservation, disclosure and discovery of protected data should be limited in scope to that which is relevant and necessary to support any party’s claim or defense in order to minimize conflicts of law and impact on the data subject.[10]
4. Where a conflict exists between data protection laws and preservation, disclosure, or discovery obligations, a stipulation or court order should be employed to protect protected data and minimize the conflict.
5. A data controller subject to preservation, disclosure or discovery obligations should be prepared to demonstrate that data protection obligations have been addressed and that appropriate data protection safeguards have been instituted.
6. Data controllers should retain protected data only as long as necessary to satisfy legal or business needs. While a legal action is pending or remains reasonably anticipated, data controllers should preserve relevant information, including relevant protected data, with appropriate data safeguards.

The Sedona International Principles offer a model protective order and a “Transfer Protocol” (identifying important issues to consider in implementing data transfers in the context of disclosure for litigation). The Principles, moreover, are labeled “draft,” with the expectation that interested parties and groups will provide comments on the Principles, for inclusion in revised versions.[11]

Conclusion

The conflict between European data protection law and U.S. discovery rules may eventually be resolved by treaty or other diplomatic efforts. The U.S. Department of Commerce, for example, has negotiated safe harbor standards with European authorities, which permit U.S. companies to obtain certainty as to the data protection rules they must follow when doing business in Europe.[12] Similar standards could be developed for purposes of U.S. litigation. For now, however, dialogue between U.S. and European groups, such as the Sedona Conference and the E.U. Article 29 Working Party, both advisory groups, may offer the best hope of improving understanding and developing “best practices” to manage the conflict.[13]