Source: http://docplayer.org/3530525-E-discovery-the-eu-data-protection-authorities-approach.html
Timestamp: 2018-07-21 23:53:05
Document Index: 745046890

Matched Legal Cases: ['Art. 29', 'Art. 29', 'Art. 29', 'Art. 29', 'Art. 42', 'Art. 44', 'Art. 26']

E-Discovery the EU Data Protection Authorities approach - PDF
Download "E-Discovery the EU Data Protection Authorities approach"
1 E-Discovery the EU Data Protection Authorities approach Breakout Session Mind the Gap: Bridging U.S. Cross-border E-discovery and EU Data Protection Obligations Dr. Alexander Dix, LL.M. Berlin Commissioner for Data Protection and Freedom of Information IAPP Europe Data Protection Congress Brussels Alexander Dix 1
2 Overview Focus on transatlantic civil law suits Dialogue between Sedona and Art. 29 WP The latest response from Europe Draft General Data Protection Regulation any new ideas on transnational discovery? Alexander Dix 2
3 Focus on transatlantic civil law suits Discovery requests by LEAs (e.g. DoJ) and administrative bodies (SEC) covered by mutual legal assistance treaties (e.g. EU-US) Procedures of MLA-treaties should be observed, no direct requests to controllers in the EU Focus here: transatlantic pre-trial discovery in civil law suits Alexander Dix 3
4 Dialogue between The Sedona Conference and Art. 29 Working Party The Sedona Conference (TSC) Framework for Analysis of Cross-Border Discovery Conflicts (2008) Art. 29 Working Party WP 158 on pre-trial dicovery for cross-border civil litigation (2009) wp158_en.pdf TSC International Principles on Discovery, Disclosure and Data Protection (2011) Alexander Dix 4
5 The latest response from Europe Art. 29 Working Party has welcomed the International Principles, especially their emphasis on - necessity, proportionality and a phased approach to discovery (Principle 3), - the need to minimize the disclosure of personal data (Principle 3), - encouraging organizations to implement privacy by design (Principle 6) Alexander Dix 5
6 Quotes from the TSC International Principles Highlighting the importance of a restrictive data retention policy in vow of the fact that many organizations worldwide have become data hoarders Pointing to serious legal risks which may arise from the over-retention of information Alexander Dix 6
7 Remaining issues Independence of EU DPAs (COM./. Germany, Austria) and the US courts International Principles without binding effect HR and customer data Telecommunications secrecy Alexander Dix 7
8 Cloud Computing Discovery in the Cloud (p. v TSC Principles) Cf. Sopot-Memorandum of the International Working Group on Data Protection in Telecommunications ( Berlin Group ) Alexander Dix 8
9 EU Draft General Data Protection Regulation Leaked version v contained restrictive rule on discovery (Art. 42) Apparently deleted at the request of US Government Patriot Act-issue is addressed in recital 90 of the current draft (public interest) Legal situation would remain unchanged should the Draft become law (cf. Art. 44 Abs. 1 e) of the Draft Regulation and Art. 26 Abs. 1 d) of Directive 95/46) Alexander Dix 9
10 Summing up (1) Despite basic differences between legal cultures on both sides of the Atlantic practical ways and means to bridge the gap between European data protection law and US discovery are available European companies should make use of all possibilities of US procedural law to comply with their obligations under EU data protection law Restrictive retention policies are key Alexander Dix 10
11 Summing up (2) Get the company s Data Protection Officer involved as early as possible Point to restrictions under Data Protection Laws as early as possible (even prior to the meet and confer stage) Highlight the risk of criminal prosecution when processing data falling under telecommunications secrecy or patients confidentiality Phased culling in the country of origin Check the requirements for exporting data to third countries Apply for a protective court order Alexander Dix 11
12 Thank you any questions? Alexander Dix 12