On February 11, 2009, the Article 29 Data Protection Working Party (Working Party) of the European Union issued a “Working Document” on the issue of pre-trial discovery for cross-border civil litigation (WP 158).   The purpose of WP 158 is to provide guidance to persons who are involved in the processing and transfer of personal data in the context of cross-border civil litigation and regulatory investigations.  This document is the first official EU recognition of the tensions between data privacy concerns of EU Member States and the legitimate need to conduct discovery for cross-border litigation. 

WP 158 is “an invitation to public consultation with interested parties, courts in other jurisdictions and others to enter a dialogue with the Working Party,” rather than a fully developed set of principles and guidelines.* 

WP 158 limits its discussion to (1) Preemptive document preservation in anticipation of proceedings before U.S. courts or in response to requests for litigation hold, known as “freezing;” and (2) Pre-trial discovery requests in U.S. civil litigation.  It does not address the issues of (3) Document production in U.S. criminal and regulatory investigations; and (4) Criminal offences in the U.S. relating to data destruction (WP 158, p. 3).

The Working Party provides the following practical suggestions and guidelines for clients, counsel and courts:

• Use protective orders by to limit discovery and/or protect the privacy of personal data that is processed or transferred to the U.S. for litigation;
• Strictly scrutinize and reduce to a minimum the amount of personal data that is processed or transferred because it might be relevant to future, reasonably foreseeable litigation;
• Require clear and unambiguous consent before processing or transfer of personal data for cross-border civil litigation;
• Provide transparent disclosure of what will happen to the personal data in the litigation process—who will review, disclose, use, and protect the security of, and return when it has served its purpose.
• Take appropriate steps in the host country to filter, redact, anonymize or pseudonymize data, so at to limit the discovery of personal data to the smallest amount that is objectively relevant to the issues being litigated;
• Use an independent, trusted third party expert in the Member State to make relevance determinations as to any personal data to be transferred;
• Involve the data protection officers at the earliest stage to help counsel the parties and to educate foreign courts, and to request U.S. courts for relevant protective orders to comply with EU and national data protection rules;
• Take reasonable steps to preserve the integrity and security of the personal data in handling by external service providers such as law firms, litigation support service vendors and experts;

WP 158 is clearly a “work in process.”  While it identifies a number of issues that arise between competing data privacy and cross-border discovery interests, it admittedly falls short of a solution or a clear way forward.  Instead, it provides some basic, yet helpful guidance, but more importantly is a call to dialogue among affected parties and countries. 

The good news is that WP 158 demonstrates unequivocally that the European Union really understands the constraints imposed by civil discovery systems such as those in the United States.  And it signals a positive willingness of the European Union to take a leadership role in helping find a way forward that respects both interests. 

Where this dialogue take us in uncertain, the increased awareness of these issues through The Georgetown Advanced E-Discovery Institute and its publications will help build a solid foundation for using dialogue to explore and develop a common vocabulary essential to finding a way forward.

* WP 158 cites to “Framework for Analysis of Cross-Border Discovery Conflicts: A Practical Guide to Navigating the Competing Currents of International Data Privacy and e-Discovery, a publication of The Sedona Conference® International Working Group  on Electronic Information Management, Discovery and Disclosure (WG6).

About M. James Daley

More ...