EU Framework for Regulating Cross-Border Discovery

When US courts must adjudicate the propriety of discovery requests directed to EU-based companies, three distinct international discovery laws confront them: First, EU member states have enacted robust data privacy laws in the wake of the EU Data Protection Directive (Directive 95/46/EC); Directive 95/46 recognises data privacy as a fundamental human right and requires EU member states to provide strong protection for individuals’ “right to privacy with respect to the processing of personal data.”

The first tension in US litigation arises with the directive’s definition of “personal data” and “processing”, which are much broader than the common US understanding of the terms. Under the directive “personal data” encompasses (but is not limited to) social security numbers or medical information, and more broadly includes “any information relating to an identified or identifiable natural person.” (Directive article 2(a)). “Processing” includes not only formatting conversions, re-duplication, filtering, and indexing as understood in the American system, but also any collection or manipulation of the data, including storage as part of a routine litigation hold “Directive Art. 2(b); see also Data Protection Working Party, Working Doc. 1/2009, Art. 29 (describing this tension)).

In substance, the directive prohibits the transfer of personal data to any non-EU state, unless that country “ensures an adequate level of protection” for the data (Directive article 25). The directive does provide an exception for “the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims” (id. Article 26(1)(d)) but local law can provide otherwise. The EU and US have developed “safe harbour” principles for the sharing of information, but their limited scope fails to facilitate discovery.

Second, the Hague Convention on the Taking of Evidence (the Convention) provides a procedure to facilitate the discovery of information sought in transnational litigation (23 UST 2555, 847 UNTS 231). Fifty-four countries have acceded to the Convention, including the US, whose signature was ratified by a unanimous vote of the Senate in 1972. These signatory states agreed that judicial authorities in the contracting states “may […] request the competent authority of another Contracting State, by means of a Letter of Request, to obtain evidence, or to perform some other judicial act” (Article 1). But the Convention is equally significant for its provision that allows countries to “declare that it will not execute letters of request issued for the purpose of obtaining pre-trial discovery of documents” (Article 23).

Third, several European countries have enacted “blocking statutes” intended to restrict the production of documents within their borders outside the procedure established by the Hague Convention. Switzerland, for example, requires the use of its local courts to facilitate the gathering of evidence within its borders for discovery in litigation abroad (Swiss Penal Code article 271, 273). France has criminal penalties for private parties that conduct discovery within its borders for litigation abroad (French Penal Law No. 80-538). Other European countries – including Germany, Spain, and Belgium – have adopted similar laws to regulate the disclosure of information in litigation abroad (see The Sedona Conference, Framework For Analysis Of Cross-border Discovery Conflicts 17–22 (2008) (discussing blocking statutes worldwide); The US Discovery – EU Privacy Directive Conflict: Constructing a Three-Tiered Compliance Strategy, 19 Duke J. Comp. & Int’l L. 357 (2009)).

via The Unique Challenge of Serving Two Masters: European Data Privacy Laws & United States Discovery Obligations – The Latest Legal Features, Research and Legal Profiles – Who’s Who Legal.