+55 11 3285.0706 | +55 11 5053.2990atelier@atelierjuridico.com

The clash between e-discovery in international arbitration and European data protection laws

14 de Dezembro de 2017

 

 digital

The new Directive 95/46/EC may have a substantial impact on e-discovery in arbitration. International practitioners must be aware of these changes.

 


 

European Union, Global July 29 2010


In today's business environment, ever-increasing amounts of information are stored and communicated in electronic format. This electronically stored information ("ESI") is not only found on computers, servers and storage devices, but also on PDAs, mobile phones and MP3 players. Unsurprisingly, such a universe of information is fertile ground for requests for document production in international arbitrations.

At the same time, the EU is concerned about the protection of third parties' personal data, and has issued directives protecting such data. But what happens when a request to produce documents in an international arbitration would require a party to contravene an EU directive on data privacy? EU guidelines exist for data protection issues related to discovery in cross-border litigation, but the conflict between document production and EU data privacy guidelines in international arbitration remains unresolved.

Data Protection and E-Discovery

In the EU, data protection is governed by Directive 95/46/EC as implemented by the Member States (the "Directive").1 The Directive places two limits on the use of third parties' ESI:

First, the handling of a third party's data for the purposes at hand must be "justified".

Second, the export of data to countries outside the EU must be justified, e.g., if the requesting party is located in the USA.

Handling or exporting a third party's data without justification may lead to administrative and criminal sanctions, as well as damages claims, cease-and-desist orders and other remedies.

Data handling may be "justified" by a statutory obligation, through the consent of the third party, or by a legitimate interest of the disclosing party.

A tribunal's production order does not create a statutory obligation to produce data, as arbitration is based on the parties' agreement. Statutory obligations arising from a legal system other than the disclosing party's home jurisdiction are equally not sufficient. One solution could be to seek assistance for the taking of evidence from an EU court, which may then order the production based on its public powers. However, state court assistance will be limited to measures of document production permitted under the domestic procedural rules of that state and will therefore likely not be available in countries where disclosure is unknown.

Justification for the handling of a third party's data in an arbitration through obtaining the third party's consent creates practical and legal issues. It requires every individual to agree to the specific handling of its data in the arbitration, which may be highly impractical and time consuming, e.g., in cases of e-mails with extensive to- and cc-lines. It is also doubtful whether employees can validly consent vis-à-vis their employers' data handling as the employees' economic situation suggests that they are not free to decide (in which case consent would be invalid).

Justification for the handling of a third party's data in an arbitration by legitimate interests is possible, but requires the carrying out of a balancing exercise. Most commentators believe that, absent specific circumstances, being ordered by a state court to produce data would justify such data's production. This reasoning may apply by analogy to arbitrations. However, in absence of any case law on this topic, careful analysis with regard to any personal data and the scope of disclosure is recommended.

Data export out of the EU requires further justification, unless data is exported to one of the few so-called "safe third countries" (e.g., Switzerland, Isle of Man). One option is establishing an adequate level of protection in "unsafe" third countries for the purposes of data export in arbitrations, however, such option is generally lengthy and costly, and therefore impractical.

The Directive further provides that the export of third parties' data can be justified for the "exercise or defence of legal claims". However, about half of the different language versions of the Directive limit the "exercise or defense of legal claims" to court proceedings, which may exclude arbitral proceedings (e.g., the German version). The remaining versions do not contain similar wording and, therefore, seem to be more permissible with regard to data export for the purposes of international arbitration (e.g., the English version). Consequently, if, for example, a German party is requested to produce ESI to a party or tribunal sitting outside the EU, complying with such an order may constitute a breach of German data protection laws.

Telecommunication Secrecy and E-Discovery

Telecommunications data is subject to an even stricter regime. For instance, German law prohibits telecommunication service providers from disclosing the content, participants or particulars of "telecommunication activities" to third parties. Employers who permit or tolerate the use of a corporate e-mail system for private purposes are considered service providers (i.e., such private e-mails are considered "telecommunications data" even if the employer is not in the telecommunications business).

Service providers may collect and use such data only to the extent required for the provision of telecommunication services. This does not cover compliance with an order for production in an arbitration. In effect, the only justification for disclosure would be consent, with the attendant legal and practical difficulties discussed above.

Solutions and Recommendations

At the pre-dispute stage, a suitable document retention policy may help to decrease the volume of ESI that might be subject to an order for production. Also, companies may avoid problems with telecommunications secrecy by either prohibiting the private use of telecommunications infrastructure or clearly separating business and private use of such services.

Once the proceedings have started, the party confronted with data protection issues should timely indentify potential conflicts between document production and data protection for the tribunal and involve internal data privacy agents, if any, and administrative authorities to clear potential conflicts. A tribunal may consider data protection concerns as a legal impediment pursuant to Art. 9(2)(b) and 9(2)(c) of both the 1999 and the recently revised IBA Rules,2 which can shield against a production order or at least, lead the tribunal to order the production of ESI in a manner that reduces or avoids the conflict with data protection requirements. One option would be to avoid data export, e.g., by ordering the production of ESI within the EU (or Switzerland).

At the pre-dispute stage, a suitable document retention policy may help to decrease the volume of ESI that might be subject to an order for production. Also, companies may avoid problems with telecommunications secrecy by either prohibiting the private use of telecommunications infrastructure or clearly separating business and private use of such services.

Once the proceedings have started, the party confronted with data protection issues should timely indentify potential conflicts between document production and data protection for the tribunal and involve internal data privacy agents, if any, and administrative authorities to clear potential conflicts. A tribunal may consider data protection concerns as a legal impediment pursuant to Art. 9(2)(b) and 9(2)(c) of both the 1999 and the recently revised IBA Rules,2 which can shield against a production order or at least, lead the tribunal to order the production of ESI in a manner that reduces or avoids the conflict with data protection requirements. One option would be to avoid data export, e.g., by ordering the production of ESI within the EU (or Switzerland).

To view all formatting for this article (eg, tables, footnotes), please access the original here.


White & Case LLP - Markus Burianski

Source: Lexologyhttps://www.lexology.com/library/detail.aspx?g=9514d932-4e71-4ec4-80d5-b97bb8e74c90