Source: https://www.mayerbrown.com/en/perspectives-events/publications/2011/06/european-and-german-privacy-laws-and-crossborder-d
Timestamp: 2019-04-21 18:01:22+00:00

Document:
European and German Privacy Laws and Cross-Border Data Transfer for E-Discovery in the United States—Are These Systems Compatible?
Failure to comply with requests for such information can lead to compa­nies facing severe sanctions.4 On the other hand, violations of European data privacy laws following the disclosure request may lead to damage claims, fines or, in severe cases, criminal prosecution.5 This article aims to suggest possible solutions for that dilemma.
Is There a Justification for Data Disclosure?
In order to understand the conflicting approaches in the United States and Europe in regards to data privacy laws, it is necessary to explain the context of data privacy laws in Europe.
In the European Union, as well as in the European Economic Area, data privacy law is based on European Directive 46/95/EC, dated 24 October 1995 (the “Directive”), which deals with the protection of individuals with regard to the processing of personal data and the free transfer of such data. The Directive was implemented by national data privacy laws, such as the German Federal Data Privacy Act (Bundesdatenschutzgesetz or BDSG) and the British Data Privacy Act of 1998. Hence, EU Member States’ national laws on data privacy are based on the same Directive and, therefore, on the same principles. Nevertheless, they vary in certain aspects.
Pursuant to the general principles established by the Directive, collecting, processing and using personal data is permitted only if the data subject has consented, or if there is a statutory justification. The same holds true for the transfer of personal data to a third party. Moreover, additional requirements have to be met if personal data is transferred to third parties located outside the European Union or the European Economic Area.
In practice, the data subject’s consent can rarely be used as a valid justification for transfer; the law sets strict requirements for a declaration of consent and the sheer volume of data eventually requested in disclosure proceedings often makes it nearly impos­sible to procure the written consent of every person whose data might be concerned. Hence, parties regularly need to find a statutory provision that justifies the data transfer required for an e-discovery.
When is processing personal data permitted?
Pursuant to Article 7 (c) of the Directive, the data controller may process personal data if processing is required in order to comply with other legal obligations. However, disclosure in e-discovery proceedings is based on US e-discovery rules. Such foreign law statutes, however, do not constitute a legal obligation within the meaning of Article 7 (c) of the Directive. Hence, Article 7 (c) of the Directive does not provide for a justification to process personal data in e-discovery proceedings.
However, Article 7 (f) of the Directive allows for the processing of personal data if such processing serves the legitimate interests of the data controller and if these interests are not outweighed by fundamental rights and freedoms of the data subject. Consequently, Article 7 (f) of the Directive requires a thorough balancing of the legally protected interests of the data controller and those of the data subject.
Disclosure of personal data during litigation would certainly serve the justified interests of the data control­ler if that individual or entity is involved in litigation. Therefore, the transfer and use of third-party data may generally be possible before European courts.10 However, that provision does not generally permit the transfer of personal data to US courts, as additional measures are required to ensure an adequate level of protection for a data transfer to parties outside the European Union or the European Economic Area.
May personal data be transferred to the United States?
The German-language version of Article 26 (1) (d) of the Directive has been implemented into German law in Section 4c Subsection 1 Sent. 1 No. 4 BDSG. Germany, like several other countries, has chosen to implement a stricter version of the Directive, allowing for a transfer of personal data to a party in a country outside the European Union without any further measures to guarantee an adequate protection level only if “the transfer is required…for the establishment, exercise or defense of legal claims before courts.” Hence, it is questionable whether Article 26 (1) (d) of the Directive and Section 4c Subsection 1 Sent. 1 No. 4 BDSG also cover pre-trial disclosure proceedings.
Discovery in the United States is typically conducted prior to the beginning of the actual trial proceedings. It is aimed at gathering evidence in preparation for the actual trial and does not, typically, take place before the court. As the pre-trial gathering of evidence is not a familiar element of the German civil procedure law, it can be assumed that an exception provision is not intended to cover such unknown pre-trial proceedings.
A disclosure request by a US court seems to be incompatible with EU and German privacy laws. However, considering the economic importance of requesting or producing documents in e-discovery for European parties, companies are advised not to completely refuse a disclosure request on the grounds of existing national data privacy legislation. Often, a better alternative is to find a privacy-compliant approach to the requested disclosure. Such a privacy-compliant solution might be found by considering the background and the purpose of the exception provision detailed in Section 4c Subsection 1 Sent. 1 No. 4 BDSG.
What are a data recipient’s obligations?
Public accessibility of European documents produced during US e-discovery proceedings is quite problem­atic from a European privacy law perspective.15 In a German scenario, the documents produced as evi­dence in discovery proceedings are only accessible to persons attending the court proceeding itself (Gerichtsöffentlichkeit),16 and decisions are only published in anonymous form.17 In the United States, however, decisions, writs and protocols in current proceedings can be accessed by anyone worldwide. Documents are even made public over the Internet.
This demonstrates that the recipients who are entitled to receive the documents, including personal data, are not able to protect the personal data against any further transfer or public access. Furthermore, the recipients are generally not able to guarantee that the data is only used during, and for the purpose of, the respective litigation proceedings, or that it is only processed as much as necessary. Therefore, when transferring data, addi­tional measures should be implemented to guarantee that the data is not processed outside the discovery.
Another important point is that only data that is necessary for the support of the claim may be transferred. Many provisions in the German privacy law permit data processing only if it is required for the specific purpose set out in the respective excep­tion provision, Section 4c Subsection 1 Sent. 1 No. 4 BDSG. Therefore, this principle should be considered as a general restriction relative to data transfer in e-discovery.
As a guiding principle, the criterion “required” has to be interpreted restrictively. Although the exception provision suggests that there is a general option to transfer personal data to countries outside the European Union for litigation purposes, information required under US law will not automatically be held as required within the meaning of Section 4c Subsection 1 Sent. 1 No. 4 BDSG.
The aim of the discovery process in the United States is to ensure that the parties to litigation proceedings have access to required and relevant information for their cases, given the rules and procedures of the jurisdiction in which the litigation takes place.21 Discovery is a fundamental part of the litigation process in common law jurisdictions, but the scope of what is required for discovery differs greatly between common law and civil code jurisdictions. The European and German under­standing of discovery in trials varies significantly from the understanding of discovery under US law.
Some data privacy analysts state that the US perspec­tive should be decisive. They argue that, as the German exception provision generally allows the transfer of data required in litigation, the clause should be interpreted to allow the transfer of required data under the applicable law. Thus, if a company is involved in litigation in the United States, then the general meaning of “required” should be defined by US law.24 That perspective should not be applied, however, in jurisdictions where fundamental prin­ciples of data privacy are not respected or enforced. In such cases, interpretation of the term “required” according to applicable law should be restricted.
This view complicates the application of the exception that should allow a data transfer. First, “required” is more a factual criterion than a legal interpretation. In addition, it is difficult to define which principles are to be considered fundamental.
In concert with the principles of data reduction and data economy pursuant to Section 3a BDSG, the principle of proportionality generally serves as a guideline according to which data may be processed. This principle would apply here and would restrict the amount of data that may be transferred.
The provision of Section 4c Subsection 1 Sent. 1 No. 4 BDSG only allows the transfer of data that has already passed the proportionality test. Therefore, the general permission to transfer data for litigation purposes is implicitly restricted by the fundamental data privacy principles expressed in German law.
Such principles include data reduction and data economy pursuant to Section 3a BDSG, which prohib­its a transfer that is not required for the intended purpose. As this is a German law provision, German law standards with respect to data transfer must be met for the exception provision to serve as a justifica­tion.25 Therefore, when transferring data for discovery proceedings, only required data pursuant to German law standards should be transferred.
Are there blocking statutes in other European countries?
The French Blocking Statute is applicable, for instance, in the case of deposition requests, even if the deposition is taken outside of France. The statute applies, too, if the victim of the offense is a French national or if an act made in preparation of the deposition has been made on French soil (such as gathering documents to be produced before a US court).
In order to avoid any risks, it is generally recom­mended that a foreign court should resort to the 1970 Hague Convention on Taking of Evidence Abroad in Civil or Commercial Matters (the “Hague Convention”). This is because the French Blocking Statute is not applicable if the taking of evidence abroad is conducted via the Hague Convention (and, more generally, in compliance with French law or treaties and international conventions).
The conflict between US disclosure requirements and European data privacy law is not yet resolved, and there are no provisions guiding this conflict. As a result, parties to relevant international litigation should obey certain principles in order to ensure compliance with the European and respective national data privacy laws. This will help avoid negative consequences if the laws are violated.
What Do German Authorities Recommend?
What should companies operating in Europe do?
However, in a decision dated January 2010, the US District Court of Utah did not accept the German Data Privacy Act as a justification to not disclose information.42 Nevertheless, raising the problem before a US court might lead to a compromise.
Render personal data anonymous or pseudonymous and then transfer the depersonalized information. This can be done by simply redacting information in the respective documents.
Limit the information to the personal data that is required as proof in the proceedings, and filter the respective data in Germany.
Delete personal data after it is used, and request deletion by other parties.
If conflicts between the two legal systems cannot be resolved prior to trial, it is recommended that European companies consult and cooperate with the responsible data privacy regulatory authorities to get approval for each situation.
The conflict between US disclosure requirements and European—especially German—data privacy law is ongoing and has not yet been resolved. International regulations are still absent and are urgently needed. Nevertheless, the practical solutions discussed above can help German companies involved in US litigation proceedings to adequately react to disclosure require­ments and still remain compliant with German data privacy law.
1 For a recent instructive overview regarding this conflict of companies see Geercken, Holden, Rath, Surguy and Stretton, CRi 2010, 65, 70.
2 Brisch and Laue, RDV 2010, 1, 3.
3 Newman and Zaslowsky speak of a “seemingly irresolvable conflict between broad US-based discovery rules and EU Member States’ privacy and data protection directives,” Newman and Zaslowsky, see above, p. 1.
4 Brisch and Laue, RDV 2010, 1, 3; Spies and Schröder, MMR 2008, 275, 278.
5 Berlin Data Protection Officer, under: http://www.datenschutz-berlin.de/content/themen-a-z/internationaler-datenverkehr/datenuebermittlungen-an-us-behoerden-sowie-us-unternehmen.
Regarding the general conflict between the US and German systems, see Hilgard in: “Electronic Discovery Deskbook,” Chapter “International Issues,” Practicing Law Institute, 2009; Hilgard and Kraayvanger, “Urkundenvorlegung im Zivilprozess—Annäherung an das amerikanische “Discovery”—Verfahren?“ (“Submission of Documents in Civil Proceedings—Approximation to the American Discovery Procedures?”), Die Justiz 2003, 572 et seq.; Kraayvanger, book review: Abbo Junker “Electronic Discovery gegen deutsche Unternehmen” (Electronic Discovery Against German Business Entities), DAJV Newsletter 3/2008, p. 136 et seq.; Kraayvanger, “Discovery im deutschen Zivilprozess—über den Umweg der US-amerikanischen Beweishilfe” (Discovery in the German Civil Procedure Through US Discovery Aid), RIW 7/2007, p. 496 et seq.
6 Lux and Glienke, RIW 2010, 603, 605; Carsten Domke, International E-Discovery—E-Discovery vs. German Data Protection, Paper for the American Bar Association (ABA) Tech Committee, available under: http://www.abanet.org/labor/techcomm/mw/Papers/2010/pdf/domke.pdf, p. 4.
7 Art.29 Data Protection Working Party, WP 158, p. 6. In the EU, the protection of personal data is considered a fundamental human right that is protected by the laws, Newman and Zaslowsky, The Conflict in Production of Documents From Abroad, New York Law Journal, p. 1, available under: http://www.law.com/jsp/nylj/PubArticleFriendlyNY.jsp?id=1202463762347, p. 2.
8 Art.29 Data Protection Working Party, WP 158, p. 6.; see the decisions Accessdata Corp. v. Alste Technologies GmbH, Decision of 21 January 2010, Case No. 2:08cv569, LEXIS 4566, MMR 2010, 275 et seq.; Richmark Corp., 959 F.2d 1468, 1478 (1992); Weiss v. Natl. Westminster Bank, 242 F.R.D. 333, 45 ff. (E.D.N.Y. 2007); see Spies/Schröder, MMR 2010, 276 et seq.; see Knöfel, RIW 2010, 403 et seq.
9 See the decisions Reinsurance Co. of America, Inc. v. Administratia Asigurarilor de Stat, 902 F.2d 1275, 1281 (7th Cir. 1990); Volkswagen v. Valdez, 909 S.W.2d 900,902 f. (Tex. 1995); Minpeco, S.A. v. ContiCommodity Servs., Inc, 116 F.R.D. 517, 530 (S.D.N.Y. 1987).
10 Domke, see above, p. 4; controversial: Newman and Zaslowsky, p.1, Lux and Glienke, RIW 2010, 603, 604.
11 Namely the Czech, Dutch, German, Greek, Italian, Latvian, Portuguese, Romanian and Spanish versions.
12 Gabel, in: Taeger and Gabel, BDSG, § 4c no. 11 holds that this provision only applies to proceedings that are covered by the Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters. Pursuant to Brühann, in: Grabitz and Hilf, Das Recht der Europäischen Union, Art. 30 no. 9, the provision covers only state court proceedings, as only such proceedings guarantee adequate protection of personal data.
13 Burainski and Reinl, SchiedsVZ 2010, 187, 191.
15 See American Tel. Tel. Co v. Grady, 594 F.2d 594 (7th Cir. 1978).
16 Pursuant to Section 169 1. Sentence German Judicature Act (Gerichtsverfassungsgesetz or GVG).
17 Lux and Glienke, RIW 2010, 603, 606.
18 Däubler, Klebe, Wedde and Weichert, BDSG, Sec. 4c no. 4; Gola and Schomerus, BDSG, Sec. 4c no. 4. Gola and Schomerus, BDSG, Sec. 4c no. 7; Brisch and Laue, RDV 2010, 1, 7.
19 Taeger and Gabel, BDSG, Sec. 4c no. 9.
21 Art.29 Data Protection Working Party, WP 158, p. 3.
22 Domke, see above, p. 6; Spies, MMR 2007, V, VII.
23 For that strict interpretation of the wording “required” (erforderlich) see Taeger and Gabel, BDSG, Sec. 4c no. 11; Simitis, BDSG, Sec. 4c no. 21; Art.29 Data Protection Working Party, WP 114, p. 18.
24 Domke, see above, p. 6. See also Knöfel, RIW 2010, 403, 405, who assumes that data protection law does not play any role in a litigation procedure.
25 See also Newman and Zaslowsky, p. 2: They point out that the foreign court—which in this respect would be the German court—is the one to determine whether the discovery request is reasonable.
26 Document can be downloaded from: http://ec.europa.eu/justice_home/fsj/privacy/index_en.htm. See also Hilgard in: “Electronic Discovery Deskbook,” Chapter “International Issues,” Practicing Law Institute, 2009.
27 See the objectives of the Directive under: http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/tasks-art-29_en.pdf.
28 So Art.29 Data Protection Working Party, see WP 117, p. 8; WP 114, p. 15; WP 158, p. 15.
29 Art. 29 Data Protection Working Party, WP 114, p. 7. However, there is little guidance on the interpretation of “required” in this context in the Working Paper.
30 WP 158, p. 13. Thereby, Art. 29 Data Protection Working Party reiterates its earlier opinion that Art. 26 (1)(d) cannot be used to justify the transfer of all employee files to a group’s parent company on the grounds of the possibility that legal proceedings may be brought in US courts one day, see WP 114, p. 15.
31 Art. 29 Data Protection Working Party, WP 117, p. 8; Spies and Schröder, MMR 2010, 275, 279.
32 Burianski/Reindl, SchiedsVZ 2010, 187, 194; Däubler/Klebe/Wedde/Weichert, BDSG, Sec. 4c no. 4.
33 Brisch and Laue, RDV 2010, 1, 7.
34 It should also be noted that it is not possible to circumvent the prohibition to supply documents or data by examining a witness on the contents of the documents or data. See Hilgard in: “Electronic Discovery Deskbook,” Chapter “International Issues,” Practicing Law Institute, 2009.
35 Annual report of the Berlin Data Protection Officer, 2006, p. 170.
36 See annual report of the Berlin Data Protection Officer, 2006, p. 171.
37 Brisch and Laue, RDV 2010, 1, 5.
38 Art.29 Data Protection Working Party, WP 158, p. 10.
39 See annual report of the Berlin Data Protection Officer, 2006, p. 171.
40 Spies and Schröder, MMR 2010, 275f; Geercken, Holden, Rath, Surguy and Stretton, CRi 2010, 65, 70. For an individual solution that has to be used by the US court in each individual case: Kristen A. Knapp, “Enforcement of US Electronic Discovery Law Against Foreign Companies: Should US Courts Give Effect to the EU Data Protection Directive?” available at SSNR.
42 Accessdata Corp. v. Alste Technologies GmbH, Decision of 21 January 2010, Case No. 2:08cv569, LEXIS 4566.
43 Lux and Glienke, RIW 2010, 603, 607.
44 Spies and Schröder, MMR 2008, 275, 280.
45 Simitis, BDSG, Sec. 4c no. 21.
46 Däubler, Klebe, Wedde and Weichert, BDSG, Sec. 4c no. 8.
47 Spies and Schröder, MMR 2008. 275, 280 with regards to FCPR Rule 26(c).
48 Id. at 275, 280.
49 See Brisch and Laue, RDV 2010, 1, 7. With respect to these measures, companies may rely on the technical and organizational measures as set out in Sec. 9 Sentence 1 BDSG.

References: Art.29
 Art.29
 v. 
 v. 
 v. 
 v. 
 v. 
 § 4
 Art. 30
 v. 
 Art.29
 Art.29
 Art.29
 Art. 29
 Art. 29
 Art. 26
 Art. 29
 Art.29
 v.