Power Point Slide Deck for a CLE presentation given by Monique Altheim, Esq. at LegalTech West Coast 2012.

1. US Ediscovery in Civil Litigation
v. EU Data Protection Laws
Clash of The Titans
1

2. Monique Altheim, Esq.,CIPP
Owner and Managing Partner
The Law Office of Monique Altheim
New York, USA
monique@altheimlaw.com
718-462-2138
2

3. “The Position of the Americans is…quite
exceptional.”
Alexis de Tocqueville, Democracy in America,1840, part 2, p.36.
• The US has the broadest pre-trial civil discovery
procedure in the world.
• Rule 26 (b) FRCP: "parties may obtain discovery
regarding any matter, not privileged, that is relevant
to any party's claim or defense."
3

4. “The Position of the Americans is…quite
exceptional.”
Alexis de Tocqueville, Democracy in America,1840, part 2, p.36.
• Other Common Law Jurisdictions:
Australia, Canada, United Kingdom, India, Singapore, Hong
Kong and other former British Colonies.
Very restricted pre-trial discovery procedures.
4

5. “The Position of the Americans is…quite
exceptional.”
Alexis de Tocqueville, Democracy in America ,1840, part 2, p36.
•Civil Code Countries: Europe, Latin
America, China, most former Continental
European colonies in Africa & Asia.
“Pre-trial discovery? Huh?”
5

6. “The Position of the Americans is…quite
exceptional.”
Alexis de Tocqueville, Democracy in America,1840, part 2, p.36
• TAKEWAY: When dealing with American affiliates
abroad, don’t assume knowledge of basic US pre-trial
discovery obligations.
6

7. Legal Issues in Cross-Border Civil Ediscovery
•Privacy/Data Protection Laws
•Blocking Statutes
•Bank Secrecy Laws
•Labor Laws
•Criminal Laws
7

8. US vs. EU: Clash of The Titans
US ediscovery obligations vs. EU Data Protection Obligations
US: Broadest pre-trial civil ediscovery system
on the planet.
EU: Strictest Data Protection framework on the
planet. Data Protection is a human right. (article
7 of the EU Charter of Fundamental Rights).
8

9. US vs. EU: Clash of The Titans
What is the US legal basis for discovery abroad?
•Rule 34 FRCP
or
• the Hague Convention on the Taking of Evidence
Abroad in Civil or Commercial Matters
9

10. US vs. EU: Clash of The Titans
What is the US legal basis for discovery abroad?
Rule 34 FRCP:
(a) In General. A party may serve on any other party a
request within the scope of Rule 26(b):
(1) to produce and permit the requesting party or its
representative to inspect, copy, test, or sample the
following items in the responding party's
possession, custody, or control:
Mt. HawlwyIns.Co.v. Felman Prod., Inc. 269 F.R.D. 609, 610 (S.D.W.Va
2010)
10

11. US vs. EU: Clash of The Titans
What is the US legal basis for discovery abroad?
The Hague Convention on the Taking of Evidence Abroad in
Civil or Commercial Matters:
“letters of request” or “letters rogatory” petitions from the court
of one country to the designated central authority of another
requesting assistance from that authority in obtaining relevant
information located within its borders.
11

12. the Hague Convention on the Taking of Evidence Abroad in Civil or
Commercial Matters:
• not all EU Member States are parties to the Hague
Convention. (e.g. Belgium)
• reservations under Article 23:“a contracting state may at
the time of signature, ratification or accession declare that it
will not execute letters of request issued for the purposes of
obtaining pre-trial discovery of documents. Many signatory
States, including France, Germany, Spain and the
Netherlands have filed such reservations under Article 23.
• unduly time consuming; can take more than a year.
• discovery request must be very specific. Broad requests are
denied.
12

13. US vs. EU: Clash of The Titans
What is the US legal basis for discovery abroad?
SociétéNationaleIndustrielleAérospatialev United States District
Court, 482 U.S. 522, 544 n.28 (1987)
FRCP prevails!
However, “International Comity” demands following balancing test:
1)the importance to the litigation of the information requested; 2) the degree
of specificity of request; (3) whether the information originated in the United
States; (4) the availability of alternative means of securing the information; (5)
the extent to which non-compliance would undermine the interests of the
United States or compliance with the request would undermine the interests of
a foreign sovereign nation.
13

14. US vs. EU: Clash of The Titans
What is the EU legal basis for discovery in the EU?
Article 29 Working Party Working Document
1/2009 on pre-trial discovery for cross border civil
litigation: WP 158
• Recommends the Hague Convention, but in
absence thereof, sets forth Guidelines.
14

15. WP 158 Guidelines
All Data Protection Principles, contained in the European
Directive 46/95/EC (The Directive) must be complied with:
•Proportionality Principle
•Transparency Principle
•Data Subject’s Rights such as Access.
•Data Security
•External Service Providers
•Legal Basis for Processing
•Legal Basis for Transfer to Third Countries
15

16. Directive 46/95/EC
• Directive acts as a floor: Member States can add but not
subtract.
• Applies to all 27 Member States of the EU plus
Iceland, Liechtenstein and Norway. (The European Economic
Area or EEA).
• Has been implemented in the national laws of the EEA States
with many variations.
• Is currently under review for being too outdated.
16

17. Directive 46/95/EC
Legal Basis for Processing Personal Data for Ediscovery
Article 7
Member States shall provide that personal data may be
processed only if:
(a) the data subject has unambiguously given his consent; or
(f) processing is necessary for the purposes of the legitimate
interests pursued by the controller or by the third party or
parties to whom the data are disclosed, except where
such interests are overridden by the interests for
fundamental rights and freedoms of the data subject
which require protection under Article 1 (1).
17

18. Directive 46/95/EC
Legal Basis for Processing SENSITIVE Personal Data for Ediscovery
Article 8
• a) the data subject has given his explicit consent to the processing of those
data, except where the laws of the Member State provide that the prohibition
referred to in paragraph 1 may not be lifted by the data subject's giving his
consent; or
•e) the processing … is necessary for the establishment, exercise or defence of
legal claims.
18

19. Directive 46/95/EC
Legal Basis for TRANSFER of Personal Data to the US
Article 25 and 26
• Adequate Country: US is not an “adequate Country”
• Unambiguous Consent of Data subject. Consent must be freely
given.
• Organizations that have been “Safe Harbor” certified
• Organizations that have Binding Corporate Rules (BCRs) in place
• The transfer occurs under “Standard Contract Clauses” agreements.
• Caveat: None of the above covers onward transfer to third
parties, such as opposing parties and the courts, or data review centers
in India.
19

20. Latest Developments:
• The European Commission’s Proposal for a REGULATION of the European
Parliament and of the Council on the protection of individuals with regard to the
processing of personal data and on the free movement of such data (General Data
Protection Regulation) (2012)
•The Sedona Conference® International Principles on Discovery, Disclosure &
Data Protection (2012)
•American Bar Association Resolution 103 (2012)
20

21. Practical Takeaways
•Know where your data are: Develop a data map of the types and location of
ESI under your control. Include the Cloud and mobile devices.
•Practice sound data governance. Don’t hoard unnecessary data.
•Obtain the advice of local experts regarding data privacy and other
restrictions.
•Prepare the necessary notice and consent forms.
•Develop a strategy for local legal hold, collection and review.
•Process as many data as possible locally. Minimize the amount of personal
data to be transferred to the US through the use of narrow search
terms, predictive coding, anonymization, pseudonimyzation and redaction of
personal information.
•Secure the data adequately.
•Involve the US courts early on in the process, e.g. at the meet and confer
meeting.
•Educate the US courts about EU Data Protection laws and restrictions. Obtain
affidavits from legal experts and government authorities.
•Provide the US courts with enforcement examples by DPAs (Data Protection
Authorities) for non-compliance to show real possibility of harm.
•Request protective orders from US Courts to guarantee data confidentiality.
•Document everything early and often to demonstrate good faith and
reasonableness to both Data Protection Authorities and Federal Judges.
21

22. Sources
The Hague CONVENTION ON THE TAKING OF EVIDENCE ABROAD IN CIVIL OR COMMERCIAL
MATTERS (1970)
http://www.hcch.net/index_en.php?act=conventions.text&cid=82
FEDERAL RULES OF CIVIL PROCEDURE (2006)
http://www.law.cornell.edu/rules/frcp/
SocieteNationalev. District Court - 482 U.S. 522 (1987)
http://www.law.cornell.edu/supremecourt/text/482/522
DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (1995)
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML
The EU Charter of Fundamental Rights
http://www.europarl.europa.eu/charter/pdf/text_en.pdf
Article 29 Working Party Working Document 1/2009 on pre-trial discovery for cross border civil litigation
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2009/wp158
The Sedona Conference® International Principles on Discovery, Disclosure & Data Protection (2011)
http://www.thesedonaconference.org/dltForm?did=IntlPrinciples2011.pdf
The European Commission’s Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND
OF THE COUNCIL on the protection of individuals with regard to the processing of personal data and on
the free movement of such data (General Data Protection Regulation)
http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf
American Bar Association Resolution 103
http://www.abanow.org/wordpress/wp-content/files_flutter/13285610062012mm103.pdf
22

23. Thank You!
Questions?
monique@altheimlaw.com
718-462-2138
23