Transnational e-discovery is fast becoming a common challenge for businesses. Conflicting data privacy and protection laws—particularly between the United States and the European Union—top the list of biggest hurdles. This makes it more important than ever for companies that do business abroad to understand how to successfully navigate the competing currents of international notions of data privacy and protection with U.S. notions of discovery.
Why Do These Differences Exist?
For many countries outside the United States, the right to have one’s personal information kept private trumps any right to the kind of discovery necessary for a meaningful “day in court.” And with that right comes a much broader definition of “personal data,” as in the 1995 EU Data Protection Directive.
In the EU, for example, any information that identifies or can be used to identify an individual—sometimes, even a person’s name in an email—is considered personal data. That’s a pretty broad definition compared with the U.S., where personal data typically includes very specific information, such as social security numbers, certain financial information, and medical information covered by HIPAA.
This fundamental difference in how countries view personal data lays the groundwork for conflicting data privacy and protection laws.
The Two Pillars of Personal Data Protection
In general, there are two areas personal data protection rules tend to cover.
1. Restrictions on processing personal data.
“Processing” in this context is not limited merely to computer processing, but rather includes any kind of handling of personal data outside the normal course of an employee’s work, for example. In the context of cross-border e-discovery, segregating, collecting, or searching such data is all considered processing. Even issuing a legal hold notice to preserve certain information for legal reasons can be interpreted as unauthorized “processing.”
There are certain authorized reasons for being able to process personal data, such as when it is necessary to process it for the benefit of an employee, as in the context of payroll and benefit administration. But in other contexts, especially transnational e-discovery, no blanket authorization exists. For example, in some countries, data protection authorities or workers councils must bless the manner and extent to which personal data is processed to help protect employee data privacy rights. These hurdles vary across countries—even within the EU—because the EU Directive only sets a floor, not a ceiling, to the regulation of personal data.
2. Restrictions on transferring personal data.
Many jurisdictional laws prohibit—or at least limit—cross-border data transfers. In the EU, you may not transfer personal data outside the host country unless the country to which you’re transferring it has adequate data privacy and protection safeguards in place. All of the EU countries—as well as a smattering of other countries, such as Argentina and Canada—have safeguards deemed adequate, but the U.S. does not. Thus, transferring data from one country to the States is often a hurdle.
That’s not to say there aren’t alternatives. The U.S.-EU Safe Harbor framework, for instance, says that if certain rules are followed by U.S. companies, those companies can transfer personal data from the EU to the United States. Other options include Binding Corporate Rules and EU Model Contract Clauses. But there’s one huge catch—none of these options supports the cross-border transfer of personal data for litigation discovery purposes, putting many companies back to square one.
Looking Forward
More challenges are on the horizon for early 2016—the new EU Regulations, which will substantially increase fines for data privacy and protection violations, will require 48-hour data breach notifications, as well as full-time data privacy officers at medium- and large-size companies. Additionally, the new rules will mandate that all IT systems handling personal data incorporate “Privacy by Design” principles to monitor, manage, and ensure security for all personal data in the organization.
Preparing for International e-Discovery
As with many e-discovery challenges, cross-border issues are best handled proactively. Whether you’re involved with international matters now or not, you should be able to confidently answer “yes” to the following questions:
Am I aware of the different data protection and privacy risks? If you’re a company with an international presence, you should be aware of the sometimes conflicting laws and regulations for each country in which you do business.
Do I have a team with enough litigation experience? Ideally, you should have attorneys on staff who have litigation experience that serves the complexity of your global footprint, as well as expertise in one or more of the following fields:
Computer science and programming
Information security training
Information governance and records management
Privacy law and consulting
Project management
Do we have technology to help limit costs of international matters? Technology is a window into your data—take advantage of it. For example, you can use tools like Relativity’s Collection scout feature to see if there is data that might be relevant to claims and defenses before incurring the high cost of loading and reviewing everything.
Senior Counsel M. James Daley at Seyfarth Shaw LLP has more than 35 years of complex litigation experience. His primary focus is helping global clients develop practical solutions to records management, e-discovery, and data privacy challenges. He provides expertise on how to manage the risk and cost of compliance with the competing notions of data protection and U.S. cross-border e-discovery.
