US district court requires production of overseas data notwithstanding applicable foreign data protection law | Lexology

Many foreign countries have enacted privacy laws and “blocking” statutes that limit the disclosure of personal data and other information maintained within their borders. Violation of these statutes can result in fines, civil penalties and, in some countries, criminal sanctions.

Parties involved in US litigation frequently find themselves in a quandary when they are directed to produce documents stored overseas that fall within the protection of a foreign privacy or blocking statute; US courts have generally been unsympathetic to such parties, commonly ordering production of overseas documents notwithstanding the obstacle posed by foreign law. Continuing this trend, a federal district court in Utah recently ordered a litigant to disclose certain data maintained in Germany that the resisting party contended were exempt from disclosure under the German Data Protection Act (GDPA).

via Lexology – US district court requires production of overseas data notwithstanding applicable foreign data protection law.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Court Compels Production of Foreign Data and Re-Production of “Already-Produced” Electronic Discovery in a Reasonably Usable Form : Electronic Discovery Law

Accessdata Corp. v. ALSTE Tech. GMBH, 2010 WL 3184777 (D. Utah Jan. 21, 2010)

In this breach of contract case, the court granted plaintiff’s motion to compel and ordered defendant (a German company) to produce responsive third-party, personal data, despite objections that such production would violate German law.  The court also granted plaintiff’s motion to compel the re-production of previously produced electronic discovery where defendant’s initial production did not conform to the requirements of Fed. R. Civ. P. 34.

Plaintiff, an American company, sought to compel defendant’s production of documents, including information related to customer complaints and defendant’s technical support of non-customers.  Defendant objected to the interrogatories and requests for production on the grounds that they were overly broad, unduly burdensome, and seeking irrelevant information and because “disclosure of information relating to third parties’ identities would violate German law.”

Addressing the production of third-party, personal data and defendant’s claim that such production “would be a huge breach of fundamental privacy laws in Germany,” the court found that defendant “failed to demonstrate the verity of this assertion” by failing to cite a particular provision of German law that would prohibit such disclosure.  Moreover, the court cited to a section of the German Data Protection Act (GDPA) that seemed to allow for such a transfer of third party information upon meeting certain conditions, including receipt of consent of the third party.  Further, the court reasoned that even if the GDPA prohibited such disclosure, the United States Supreme Court has held that “[i]t is well settled that such [blocking] statutes do not deprive an American court of the power to order a party subject to its jurisdiction to produce evidence even though the act of production may violate that statute.”  Turning to defendant’s assertion that plaintiff should be required to comply with the rules set forth in the Hague Convention for Taking Evidence Abroad with respect to private customer information, the court acknowledged that “[p]arties might properly be required to resort to Hague Convention procedures ‘in suits involving foreign states, either as parties or as sovereigns with a coordinate interesting the litigation’ or if ‘the additional cost of transportation of documents…to or from foreign locations…increase[s] the danger that discovery [is] sought for [an] improper purpose,” but reasoned that “neither circumstance is present [here] where the costs of transmitting information and electronic documents ought to be relatively minimal.”

via Court Compels Production of Foreign Data and Re-Production of “Already-Produced” Electronic Discovery in a Reasonably Usable Form : Electronic Discovery Law.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Swiss seek solution to German bank data spat | Reuters

Switzerland said on Wednesday it would not help Germany hunt tax cheats on the basis of stolen Swiss bank data but hoped to finalise a new tax deal with Berlin by the end of March.

Germany has said it is prepared to pay an informant for data on clients of Swiss banks who may have been using secret accounts to evade German taxes, a new blow to Switzerland’s massive private banking industry.

“Germany is Switzerland’s most important trade partner…. With this in mind, the Federal Council wishes to resolve the problem of the stolen data which has been offered for sale to the German authorities,” the government said in a statement.

“It wants to pursue talks with Germany. Nonetheless, it will not provide administrative assistance based on stolen data, even to Germany.”

Switzerland moved to calm the sharply escalating row with its northern neighbour a day after the Swiss banking lobby said Berlin was acting as a receiver of stolen goods.

Swiss Finance Minister Hans-Rudolf Merz told a news conference he hoped talks with Germany on a new tax deal to help Berlin catch tax evaders in Switzerland would be wrapped up by the end of March.

Germany had already paid for stolen data in 2008 when it purchased information stolen from Liechtenstein’s top bank LGT, forcing the tiny principality to give up bank secrecy rules.

via UPDATE 1-Swiss seek solution to German bank data spat | Reuters.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

If you can’t kill it, bill it: German city charges Google Street View by the kilometre

Germans are very picky when it comes to online privacy. Not only is Google Analytics in danger of being banned for storing user data on ‘foreign servers’, Facebook apps are probably illegal because they pass too much private information to third parties. Also Google Street View is a constant bone of contention. Several mayors of cities and villages like Molfsee or Pfaffenhofen have already tried to ban Google’s camera cars from their streets, until someone told them there was no law against driving around taking pictures.

A study from Ingolstadt even recommends installing specific Street View prohibition signs on private properties. Although local politicians apparently don’t like it, they can’t make the photo service illegal. Every single house owner has to ask Google themselves to get their removed from Street View. A complete ban would violate article 12 of Germany’s constitution which protects the freedom of occupation.

Therefore the city of Ratingen yesterday took an interesting decision: If you can’t kill it, then bill it. The finance committee ruled with 12 to 7 votes that Google has to pay €20 per kilometer to take pictures of the city. The head of Ratingen’s law department, Dirk Tratzig, had found out that a photographical capturing of the entire town is a “special usage” as defined in article 18 of the streets law of the province of Northrine Westfalia. Thus Google can be charged.

via If you can’t kill it, bill it: German city charges Google Street View by the kilometre.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Germany: Privacy challenge to data-storage law reaches constitutional court – The Local

A controversial law forcing communications companies to keep records of customers’ phone and internet use for six months was to be scrutinised on Tuesday by the constitutional court after 34,000 people lodged appeals against the law.

Germany’s highest court, based in Karlsruhe in the state of Baden-Württemberg, was to examine 60 separate legal questions regarding the law, which has prompted the biggest class action in the court’s history.

The law is meant to make it easier for authorities to gather evidence against criminal suspects including terrorists but opponents claim that it invades the privacy of people who have done nothing wrong.

Introduced in 2008 by the former “grand coalition” government, the law brought Germany into line with a European Union directive of 2006.

It means sensitive personal data detailing phone numbers called and internet sites visited can be kept for every person for six months.

via Privacy challenge to data-storage law reaches constitutional court – The Local.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Achtung! Google Analytics is illegal, say German government officials

Several federal and regional government officials in Germany are trying to put a ban on Google Analytics, the search giant’s free software product that allows website owners and publishers to get detailed statistics about the number, whereabouts and search behavior of their visitors (and much more).

According to an article in today’s Zeit Online (poor Google translation here), multiple federal and state government officials charged with guarding over national data protection are convinced that Google Analytics is against the law in Germany and are mulling imposing fines on companies who use the service to gather detailed stats based on their website visitors’ usage patterns without the explicit consent of those visitors.

Still according to the Zeit Online article, an approximate 13% of German website publishers (meaning those with sites that have .de as their TLD) currently use Google Analytics, including several websites of leading media organizations, political parties and pharmaceutical companies. The government officials are particularly wary about the information Google is able to collect on websites of health insurance companies and the like, saying Google could conceivably create profiles of people that would include information about their interests, lifestyles, consumption patterns, political and sexual preferences.

This isn’t the first time German privacy protection officials have voiced their concerns about the Google Analytics service, as it had earlier criticized the search giant over keeping everyone ‘in the dark’ about which information they’re collecting exactly and how much identifiable data is sent to and stored on servers located on U.S. soil. German laws prohibit such data to leave the country, they claim.

Google Germany’s Per Meyerdierks, however, says the company is well within its rights to process user data in the United States because it respects the Safe Harbour treaty between the EU and the USA. He argues that an opt-out would be entirely unnecessary, and that users always have the option to refuse cookies anyway.

One German lawyer that gets cited in the article says the penalties could amount up to €50,000 (about $75,000) per website that uses Google Analytics to keep track of its visitors’ usage patterns.

via Achtung! Google Analytics is illegal, say German government officials.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

International Cloud Computing Meets U.S. E-Discovery

“Software as a Service” (SaaS) providers such as Google, IBM, Cisco and others are offering multinational corporations the opportunity to replace their enormously expensive and ever changing technological infrastructure with SaaS computing facilities. Individual companies would archive and access information in these systems through the internet at a presumably lower unit price (cloud computing). These providers also promise to manage the skyrocketing costs of collecting and disclosing electronically stored information (ESI), especially emails, demanded in U.S. judicial and regulatory proceedings (e-discovery).

Since these repositories are not under the control of the company being sued, they argue that the very strong policy and procedure, audit trails and reliability in the “cloud” are a vast improvement over a company’s internal procedures.  However, international cross-border e-discovery issues threaten to rain on the cloud computing parade. The SaaS provider, the multinational corporation and their attorneys must carefully address and anticipate these e-discovery issues early in their discussions or risk costly sanctions. Moreover, litigation counsel cannot be surprised to learn that all of the company’s ESI is outside of the company’s control.

Civil code countries, such as France and Germany, take dramatically different approaches to cross-border information transfer than does the U.S. The U.S. requires parties in any litigation to exchange information which “may” lead to the discovery of admissible evidence. Issues of confidentiality and privacy are dealt with through various devices such as protective orders and confidentiality agreements. This is not true for many European and Asian countries where U.S. type discovery is rare and broad data protection and privacy rights are enforced by the state and are not negotiable by an employer. For example, “processing,” includes a company’s operations relating to collecting, storing, retrieving, disclosing and transmitting personal data and includes any information relating to an identified or identifiable natural person. Countries have introduced laws (”blocking statutes”) to restrict cross-border disclosure of information to foreign jurisdictions. See generally, “The Sedona Conference Framework for analysis of cross border discovery conflicts-A practical guide to navigating the competing currents of international data privacy and discovery” .

Read more via Project Counsel » Blog Archive » International Cloud Computing Meets U.S. E-Discovery.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare