Discovery
of electronically stored information, so-called e-discovery, has been much discussed
in light of proposed, now recently effective, e-discovery provisions of the Federal
Rules of Civil Procedure[1]. In a world
with numerous international transactions and multinational corporations, courts,
litigants and witnesses can expect various requests for electronic information covered
by the European Union's Directive On Data Protection. (“E.U. Directive”), including
its well-publicized provisions protecting privacy and prohibiting data transfers.[2] This article
briefly discusses the potential for conflict between the e-discovery rules and laws
implementing the E.U. Directive and the general rules that a court in the United
States may be expected to apply in resolving any such conflict.
A. The
General Precepts—Disclosure vs. Privacy
A
policy of discovery under the Federal Rules of Civil Procedure is disclosure of
information to the litigants. Under Rule 26(b)(1), a litigant may properly request
unprivileged data that is “relevant to the claim or defense of any party.” Further,
with a showing of good cause, the court may order discovery of “any matter relevant
to the subject matter of the action.” Relevant information need not be admissible
evidence; instead, a request for relevant information is proper if it “appears reasonably
calculated to lead to discovery of admissible evidence.” However, discovery requests
do not automatically compel production of data; instead, discovery can be limited,
or precluded completely, by agreement, uncontested objection, or court order.[3]
In
contrast with the disclosure philosophy of discovery under the Federal Rules of
Civil Procedure, one of the underlying policies of the E.U. Directive is protection
against disclosure of private information. The recitations in the E.U. Directive
note a purpose of protecting individuals with “respect to their fundamental rights
and freedoms, notably the right to privacy.”[4]
Although the E.U. Directive sets forth basic standards, the implementation within
the E.U. is based on laws enacted by each nation.[5]
Of course, this means that any particular disclosure issue must be assessed under
national law or laws that are applicable to the data being sought. Generally, however,
the E.U. Directive directs implementing laws to restrict all manner of “processing”[6]
of “personal data,” a term broadly defined to mean “any information relating to
an identified or identifiable natural person.”[7]
Additionally, Article 26 of the E.U. Directive prohibits the transfer of personal
data outside of the European Economic Area only if the country or territory to which
it is transferred provides “adequate protection” for personal data, a condition
that the E.U. has not generally found to be satisfied by the United States.
Given their different focuses, it should not be surprising
that there is a potential for a conflict between the disclosure permitted by Federal
Rules of Civil Procedure and the privacy mandated by the E.U. Directive. If such
a conflict arises, a party or witness could be faced with conflicting obligations
under the law of a European nation and the rules (or court order) of a court in
the United States. The remainder of this article briefly examines the rules that
a court in the United States could be expected to follow in resolving any such conflict.
B.
A “New” Version of an Recurrent Issue
While
e-discovery and the E.U. Directive are relatively new, courts in the United States
have long confronted conflicts between obligations under the laws of other nations
and disclosure obligations arising from litigation or investigations in the United
States. Indeed, the Reporters for the Restat. (Third) of Foreign Relations Law of
the United States (“Restatement”) have observed that “[n]o aspect of the extension
of the American legal system beyond the territorial frontier of the United States
has given rise to so much friction as the requests for documents in investigation
and litigation in the United States.”[8]
Not surprisingly, legal doctrines have evolved for determining whether to order
production of information located in another nation and for dealing with situations
where such an order will conflict with foreign law.
In
deciding whether to order production of data located within the E.U., a court in
the United States would consider the general guidelines found in § 442 of the Restatement.
Indeed, identical language in an earlier draft of the Restatement was found by the
United States Supreme Court to be “relevant to any comity analysis.”[9]
Under Restatement § 442, the court should weigh five factors in deciding whether
to order production of information located abroad and in framing any order to do
so: “the importance to the investigation or litigation of the documents or other
information requested; the degree of specificity of the request; whether the information
originated in the United States; the availability of alternative means of securing
the information; and the extent to which noncompliance with the request would undermine
important interests of the state where the information is located.” The Restatement
factors are not necessarily an exclusive list. Other factors that have been considered
include “the extent and nature of the hardship that inconsistent enforcement would
impose. . . [and] the extent to which enforcement enforcement by action of either
state can reasonably be expected to achieve compliance “with that state's rule.”[10]
Although the case predated the mandate
of the E.U. Directive, the Restatement principles were applied by the Texas Supreme
Court in Volkswagen, A.G. v. Valdez to resolve
a conflict between a discovery request and a German statute protecting personal
privacy.[11]
In Valdez, the German Data Federal
Protection Act, Bundesdatenschutzgesetz, BGBI, I, 2954 (1990)(FRG)(BDSG), prohibited the discovery of a corporate
phone book of the German Corporation, Volkswagen AG, which was located in Germany.
The Texas Supreme Court found the issue was governed by the five factors listed
in Sec. 442(1)(c) of the Restatement. After concluding that production would violate
German law, the Texas Supreme court applied those factors and held that it had been
an abuse of discretion to order the production. Of course, the facts of a particular
case could convince a court that it should order production even though such production
would violate a law or laws implementing the E.U. Directive.
Should a court decide that disclosure
is warranted despite a conflict with civil or penal laws implementing the E.U. Directive,
the United States Supreme Court’s decision in Societe Internationale Pour Participations
Industrielles et Commerciales, S.A. v. Rogers [12]
is probably the leading guide to what to expect. In Societe Internationale, a Swiss holding company sued the United States Attorney
General to recover property that had been seized under the Trading with the Enemy
Act. The trial court dismissed the case after the plaintiff refused to comply with
its order to produce Swiss banking records that “might have vital influence” on
the outcome. The root problem was that the Swiss Federal Attorney had ordered the
same records withheld on pain of violating Swiss civil and criminal laws. While
emphasizing that it was deciding the case solely on the record before it, and noting
the plaintiff’s considerable efforts at compliance, the Supreme Court concluded
that the failure to comply with the production order was “due to inability fostered
neither by [plaintiff’s] own conduct nor by circumstances within its control.” Accordingly,
the Supreme Court held that dismissal was not proper as it had “been established
that failure to comply was due to inability, and not to willfulness, bad faith,
or any fault of petitioner.” Nevertheless, the Supreme Court held that there might
still be adverse consequences, specifically, that the trial court might be “justified
in drawing inferences unfavorable to petitioner as to particular events.”
The teachings of Societe International
now seem to be collected in § 442 of the Restatement.
There, it is stated that when disclosure of information located outside the United
States is prohibited by law of the nation where it is located, then “ a court…may
require the person to whom the order is directed to make a good faith effort to
secure permission from the foreign authorities to make the information available.”
Consistent with Societe International, it also notes that “a court…should not ordinarily impose sanctions of contempt,
dismissal or default…except in cases of deliberate concealment or removal of information
or of failure to make a good faith effort” to secure permission to disclose. Finally,
the Restatement states that, when appropriate, a court may “make findings of fact
adverse to a party that has failed to comply with the order for production, even
if that party has made a good faith effort to secure permission from the foreign
authorities to make the information available and that effort has been unsuccessful.”
Should a conflict arise between e-discovery rules and a law implementing
the E.U. Directive, the above rules will likely be considered by a court in the
United States confronting the conflict. However, the facts of the particular case
can be expected to weigh heavily on how a court will apply those rules.
[1] The e-discovery provisions of the
Federal Rules of Civil Procedure became effective on December 1, 2006.
[2]
Directive
95/46/EC of the European Parliament and of the Council of 24 October 1995 on
the protection of individuals with regard to the processing of personal data
and on the free movement of such data.
[3] See, e.g.
Fed. R. Civ. P. 26(c), 34(b), 37(a), 45(c).
[4]
E.U Directive. Preamble Para. 2
[5] See,
e.g., E.U. Directive, Art. 32.
[6]
‘Processing of personal data is defined to mean
“any operation or set of operations which is performed upon personal data,
whether or not by automatic means, such as collection, recording, organization,
storage, adaptation or alteration, retrieval, consultation, use, disclosure by
transmission, dissemination or otherwise making available, alignment or
combination, blocking, erasure or destruction.” E.U. Directive, Art. 2(b).
[7] 'Personal
data' means "any information relating to an identified or identifiable
natural persons ('data subject'); an identifiable person is one who can be
identified, directly or indirectly, in particular by reference to an
identification number or to one or more factors specific to his physical,
physiological., mental, economic, cultural or social identity." E.U. Directive, Art. 2(a).
[8] Id. at §442,
Reporters’ Notes, n.1.
[9] Societe
Nationale Industrialle Aerospatiale v. U.S.D.C., S.D. Iowa, 482 U.S. 522, 544 n. 28 (1987)
[10] Richmark
Corp. v. Timber Falling Consultants, Inc.,
959 F.2d 1468, 1475 (9th Cir.), cert. dismissed, 506 U.S. 948
(1992).