The European Union’s General Data Protection Regulation (GDPR) ushered in a new era for data privacy. One group surveying and contending with the changed landscape is U.S. litigators and their clients faced with cross-border discovery. With nearly a year and a half having now passed since the much anticipated May 25, 2018 implementation date, what lessons can be drawn from reported discovery disputes involving GDPR?
There are not many reported decisions documenting substantive discovery disputes involving GDPR, but here are a few of note:
- In Re Application of Hansainvest Hanseatische Investment GMBH, et al., 364 F.Supp.3d 243, (S.D. N.Y., 2018). This is not a standard civil discovery dispute. Before the Court was an application submitted by Hansainvest GmbH and other entities for an order to obtain discovery for use in a foreign proceeding pursuant to 28 U.S.C. §1782. The applicants sought production of documents held by both U.S. and foreign custodians. Among the respondents’ objections to the proposed discovery was that it was unduly burdensome because of foreign data privacy laws, including GDPR. What is noteworthy is that in granting the application, the Court ruled that with respect to documents held by foreign custodians the applicants had to (1) assume the costs of the document production, including the costs of compliance with GDPR and other European data privacy laws and (2) indemnify respondents against any potential breaches of European data privacy laws.
- D’Amico Dry Dac v. Nikka Finance Inc., 2018 WL 5116094 (S.D. Ala.). Defendant Nikka lodged a series of objections to video recording the deposition of a witness who was an EU citizen. Nikka moved for a protective order based upon GDPR and related privacy arguments. The Court’s order allowed for video, but also ordered that the transcript not be publicly disclosed.
- Finjan, Inc. v. Zscaler, Inc., 2019 WL 618554 (N.D. Cal.). Plaintiff Finjan sought production of emails from defendant which included those of a U.K. custodian. Defendant resisted by arguing that they could not produce the emails due to GDPR, unless additional burdensome measures were taken such as anonymization. After considering various factors, the Court concluded GDPR did not preclude the defendant from producing the emails in unredacted form.
- Corel Software, LLC vs. Microsoft Corporation, 2018 WL 4855268 (D. Utah). Microsoft requested a protective order related to telemetry data sought by Corel. Part of Microsoft’s argument was that forcing it to retain (and then produce) the telemetry data raised “tension with Microsoft’s obligations under the European General Data Protection Regulation…” and “would require additional burdensome steps to anonymize the data.” After weighing the arguments, the Court ordered Microsoft to produce the data at issue.
There are at least two takeaways from these decisions. First, cross-border discovery is continuing under GDPR. To the extent companies had hoped that GDPR could be used to easily object to producing EU data, that is not the case. GDPR will be a key issue for counsel to manage in the discovery process, along with burden and proportionality, but it is not a ready blocking mechanism to thwart discovery.
Second, organizations have an increased incentive to proactively plan for “litigation readiness” due to novel issues GDPR has created at the intersection of eDiscovery and Information Governance, as touched on in Corel Software. Here are a few considerations when planning:
- How will you implement and manage litigation holds for custodians in the EU? Will your approach violate GDPR?
- How will you manage a conflict that arises between holding data needed for U.S. litigation and conflicting data subject requests for erasure (a/k/a “right to be forgotten”)?
- Do you have adequate procedures in place to ensure all data collected for litigation is properly disposed of after litigation has ended?
- If EU data is leaked or breached during litigation, what is your plan to manage the situation and avoid a crisis?
GDPR has not stopped discovery of European data. However, it impacts U.S. litigants by raising new legal and logistical issues to navigate, and creates additional factors to weigh when considering proportionality.