Defense Counsel Journal
GDPR in United States Litigation Through Summer 2020: GDPR-Subject Companies Must Produce
Volume 87, No. 4
January 19, 2021
Michael H. Gladstone
Michael H. Gladstone
Mike Gladstone is a Director in McCandlish Holton PC’s Litigation Practice Group, where he counsels clients in civil litigation and arbitration involving commercial, tort, immigration, and employment disputes. He has extensive trial experience in the state and federal courts in Virginia, Washington, D.C., Maryland and New York. He recently served as co-lead counsel in the successful trial defense of the Virginia uranium mining moratorium against a constitutional takings challenge. He has spoken and written on the implications of the GDPR for United States businesses and litigation. Mike is a member of the IADC, and its employment law and international practice groups, and the American Immigration Lawyers Association.
BASED on a review of numerous GDPR discovery cases, in the October 2019 Defense Counsel Journal this author suggested that United States courts may be broadly empathetic to the concerns of GDPR subject litigants obliged to comply with the law where they operate. Since then, however, U.S. courts have examined the terms of the GDPR and questioned claims of the EU’s interest in data subject privacy where compelled productions are limited in scope, serve U.S. interests, and are subject to protective order.
Courts have adopted a formulaic pattern of analysis and outcome, modeled on Finjan, Inc. v. Zscaler, Inc.,1No. 17-cv-06946-JST (KAW), 2019 U.S. Dist. LEXIS 24570, at *2 (N.D. Cal. Feb. 14, 2019).
in GDPR discovery cases. This pattern invariably compels United States discovery of GDPR-protected data. This author predicted the adoption of Finjan as a model and noted in February 2020 that the Mercedes emissions litigation had adopted the Finjan model. This Article provides a more detailed look at the Mercedes decisions and an update on other recent GDPR decisions applying the Finjan model to compel discovery of GDPR-protected data from GDPR-subject companies in U.S. litigation.
I. The Mercedes Opinions
The Mercedes opinions implementing the Finjan model begin with In re Mercedes-Benz Emissions Litig.,2No. 2:16-cv-881 (SDW) (JAD), 2019 U.S. Dist. LEXIS 223132, at *3 (D. N.J. Nov. 7, 2019) (hereinafter “Mercedes I”).
decided by a Special Master on November 4, 2019. A second decision in January 20203In re Mercedes-Benz Emissions Litig., No. 16-cv-881 (KM) (ESK), 2020 U.S. Dist. LEXIS 15967, at *3 (D. N.J. Jan. 30, 2020) (hereinafter “Mercedes II”).
affirmed the Special Master’s ruling. In the 2019 ruling, the Special Master had to choose between the parties’ competing orders over a disagreement concerning document redaction. Each party offered their view of the role of GDPR on the question.4Mercedes I, 2019 U.S. Dist. LEXIS 223132 at *2-3.
The dispute arose from defendant EU companies' resistance to plaintiff's discovery seeking the identity of EU data subjects and their employment and contact information in a matter alleging RICO violations and consumer fraud.5Id. at *4-5.
Relying on the broad definition of "personal data" in the GDPR, the defendants asserted their right to redact all personal data from otherwise relevant documents from EU sources, and sought to defer consideration of their anticipated redactions until after defendants' initial, redacted production.6Id. at *5.
Defendants offered no proof, however, that their production of the information sought would lead to hardship or enforcement action by an EU GDPR supervisory authority or an authority demonstrating an EU propensity to prosecute civil litigation-connected GDPR data transfers.7Id. at *15.
Plaintiffs conceded defendants’ right to redact objectively irrelevant and intimate, private, personal information concerning the EU data subjects, and pointed to the benign character of the data they sought — identity, employment, and business contact information routinely produced in U.S. litigation — in opposition to defendants’ position.8Id. at *5-6.
Plaintiffs also pointed to an existing "Confidentiality Order" which contained a "Highly Confidential" category as providing adequate protection to the EU data subjects’ privacy concerns.9Id. at *15.
The Special Master analyzed the dispute following an analysis now familiar in United States cases addressing the role of GDPR in discovery disputes. Citing Societe Nationale Industrielle Aerospatiale v. United States Dist. Court for the S. Dist. of Iowa,10482 U.S. 522, 544 n. 29 (1987).
the Special Master noted that foreign law precluding disclosure of evidence does not deprive U.S. courts of the power to order parties subject to their jurisdiction to produce evidence, even though the act may violate the foreign law.11Mercedes I, 2019 U.S. Dist. LEXIS 223132 at *8-9.
Next, he cited AstraZeneca LP v. Breath Ltd.12No. 08-1512, 2011 U.S. Dist. LEXIS 42405, at *1 (D. N.J. Mar. 31, 2011).
for the proposition that U.S. courts "employ a multi-factor balancing test" provided in the Restatement (Third) of Foreign Relations Law Section 442(1)(c) to evaluate the interests of the U.S. and the party seeking discovery against the foreign state's interest in "secrecy.”13Mercedes I, 2019 U.S. Dist. LEXIS 223132 at *9.
The Special Master then reviewed each of the five factors articulated in AstraZeneca. As to Factor I — the importance of the documents to the litigation — he found the documents directly relevant.14Id. at *10.
Knowledge of the Defendants' employees and their positions was essential to determining the correct document custodians.15Id.
Factor I favored production. As to Factor II — the degree of specificity of the requests — he found the request satisfactorily specific, particularly as limited by the concession for redaction of irrelevant and intimately personal information.16Id. at *12.
Factor II favored production. Concerning Factor III — whether the information originated in the U.S. — the Special Master assumed the majority of the documents subject to the GDPR originated in the EU.17Id.
Factor III weighed against production.18Id. at *13.
As to Factor IV — the availability of alternative means of securing the information sought — he noted Defendants' failure to suggest any alternative source, and found such did not exist, thereby favoring production.19Id.
Concerning Factor V, the Special Master cited Finjan20No. 17CV06946 (JST) (KAW), 2019 U.S. Dist. LEXIS 24570, at *2 (N.D. Cal. Feb. 14, 2019).
and Richmark Corp. v. Timber Falling Consultants21959 F.2d 1468, 1476 (9th Cir. 1992).
for his duty to assess the interests of each nation in requiring or prohibiting disclosure and whether disclosure would affect important substantive policies or interests.22Mercedes I, at *13.
Noting other countries' awareness of broad U.S. discovery, and their recognition that the final decision concerning evidence used in U.S. courts must be made by those courts,23See Societe Nationale, 482 U.S. at 542.
and noting the U.S.'s significant interest in maintaining its discovery processes, the Special Master emphasized the U.S.'s interest in its discovery processes and in protecting its citizens under RICO claims and from consumer fraud.24Mercedes I, at *14.
Together, these points supported his conclusion that the Confidentiality Order provisions allowing protected production of the limited data sought adequately balanced the EU's interest in protecting its subjects' private data.25Id. at *15.
The court cited Finjan for the proposition that U.S. protective orders preventing further disclosure of private data "diminish" the weight of the EU's foreign privacy interest.26Id.
Dissatisfied with the Special Master’s ruling, the defendants appealed to the Magistrate. In his January 6, 2020 opinion, the Magistrate found the Special Master adequately conducted the international comity analysis under Societe Nationale.27Mercedes II, 2020 U.S. Dist. LEXIS 15967, at *29.
He denied the Mercedes' defendants appeal, and ordered the requested production in accordance with the Special Master’s prior orders.28Id. at *30.
Under an abuse of discretion standard of review — versus de novo, as argued by the defendants — the Magistrate examined the Special Master's opinion point by point and found no abuse of discretion.29Id. at *17.
Relying on AstraZeneca302011 U.S. Dist. LEXIS 42405, at *1.
and Societe Nationale,31482 U.S. 522 (1987).
the Magistrate approved the Special Master's reasoning that, even where foreign law may prohibit production, foreign prohibition does not deprive a U.S. court of the power to order production, even though production might violate foreign law.32Mercedes II at *18.
Citing the comity analysis contained in Restatement (Third) of Foreign Relations Law § 442(1)(c), the Magistrate approved the Special Master's analysis of the five factors identified in Societe Nationale.33Id. at *18-19.
The Magistrate rejected the defendants' argument the Special Master had applied an incorrect "importance" formulation under Factor I — importance of the information sought — noting "where the evidence is directly relevant ... we have found this factor to weigh in favor of disclosure.”34Id. at *19-20, citing Richmark, 959 F. 2d at 1475; Astra Zeneca, 2011 U.S. Dist. LEXIS 42405; and In re Air Crash at Taipei, 211 F.R.D. 374, 377 (C.D. Cal. 2002)).
Concerning Factor II — the degree of specificity of the request — the Magistrate noted the information sought was narrowed to relevant identities, positions, and business contact information commonly produced in U.S. litigation and did not constitute irrelevant sensitive personal information.35Id. at *22-23.
The Magistrate, citing AstraZeneca, deemed Factor V — the extent to which non-compliance with the discovery request would undermine important U.S. interests or compliance would undermine important foreign interests — the most important of the five factors.36Id. at *26.
Approving the Special Master's citation of Finjan for the point that a U.S. protective order diminishes the foreign privacy interest, the Magistrate re-emphasized the serious nature of the consumer fraud claims and concluded the Special Master properly weighed the national interests at issue favoring production.37Id. at *26-27.
The Magistrate expressly rejected the defendant's arguments that the EU's "weighty interest in protecting its citizens' privacy" was under-valued by the Special Master and that violation of the GDPR put them in "legal jeopardy," threatened them severe "reputational harm," and would damage the morale of their workforce.38Id. at *27-28.
In a footnote, the Magistrate noted the absence of evidence that the ordered production would result in an enforcement action by a GDPR supervisory authority, or that such had ever been prosecuted within the EU.39Id. at *29, n.5.
The Magistrate stated: "[s]imilar to the court in Finjan, the Special Master found that, on balance, the U.S. had a stronger interest in protecting its consumers than the EU did in protecting its citizens' private data, particularly with a Discovery Confidentiality Order provision allowing producing parties to designate and protect foreign private data as ‘Highly Confidential’ information.”40Id. at *28-29.
II. Citizen Smulski’s Prohibition Claim
In late May 2020, the United States District Court for the Eastern District of Pennsylvania addressed GDPR-based objections raised by the defendant — a United States citizen residing in Poland — as a barrier to production of GDPR protected data.41Giorgi Global Holdings, Inc. v. Smulski, No. 17-4416, 2020 U.S. Dist. LEXIS 89369, at *1 (E.D. Pa. May 21, 2020).
Notably, the defendant took the position, initially, that the GDPR forbade production of any protected data, and the Polish data privacy law subjected him to criminal penalty for violations.42Id. at *2.
The parties squared off with GDPR privacy law experts from Poland.43Id.
In this RICO and breach of contract suit, plaintiff sought information which would have required Smulski to produce GDPR protected personal information.44Id.
Though living in Poland, Smulski was sued by several U.S. companies.45Id.
Smulski resisted production of the requested documents, arguing the GDPR and Polish privacy laws prohibited him from producing them.46Id.
Both parties filed expert opinion reports on the question of whether or not GDPR prohibited production of the requested information.47Id.
Plaintiff’s November 20, 2019 Letter Motion provides an in-depth overview of the battle between the legal experts, with accompanying expert reports and rebuttals.48Plaintiff’s Letter Motion, No. 17-4416, 2020 U.S. Dist. LEXIS 89369, at *1 (E.D. Pa. May 21, 2020), ECF No. 65.
Smulski opened the expert dual with an opinion from a Polish law expert who opined that, under GDPR Article 48, Smulski was prohibited from producing the requested data because there was no treaty or international agreement in force between the U.S. and Poland authorizing enforcement or recognition of a discovery judgment or decision. As such, the expert opined, if Smulski complied with the discovery request, he would be subject to criminal prosecution under Polish personal data protection law and an administrative fine of up to twenty million euros under the GDPR.
Plaintiffs’ Polish law expert pointed to GDPR Article 49, which provides "Derogations for Specific Situations," and expressly permits transfer of personal data to third countries when "the transfer is necessary for the establishment, exercise or defense of legal claims.” The expert also referenced guidance provided by the European Data Protection Board concerning Article 49 (specifically Art. 49(1)(e)) which confirms "data transfers for the purpose of formal pre-trial discovery procedures in civil litigation may fall under this derogation”) to refute Smulski’s prohibition argument. Other derogations in Article 49 were also argued to apply or to inform the question, e.g., where there is explicit consent of the data subject, and where the data controller itself has a "compelling legitimate" interest in a "limited, non-repetitive and necessary transfer of data" which is not "overridden" by the interests of the affected data subjects.
Forced to admit Article 49 does indeed allow production of relevant documents “necessary for the establishment, exercise, or defense of legal claims,” Smulski's expert effectively conceded his prior overstatement concerning outright prohibition, but argued Article 49 empowered Smulski to rely on his own discretion in deciding whether providing the requested information satisfied that criteria.
As it reached the United States District Court for decision, there was no evidence of a frank prohibition of a data transfer in the GDPR, and no evidence of any likely prosecutions, either criminal or civil, by Poland or a GDPR supervisory authority arising from a limited and secure transfer of personal data under GDPR Article 49 in connection with U.S. litigation claims and defenses. The court summarily stated: "[a] review of the law on this issue clearly shows that Smulski cannot rely on the GDPR and/or any other Polish privacy law to avoid production of relevant documents in this matter."49Smulski, at *2
The court then provided a short analysis based on Astra Zeneca, Restatement Third, Richmark, and Finjan and concluded the production should be made "... without regard to any alleged prohibition under the EU General Data Protection regulation and/or Polish law.”502020 U.S. Dist. LEXIS 89369, at *1.
III. Ohio Joins the Finjan Club
In June 2020, a state appellate court in Phillips v. Vesuvius USA Corp.51No. 108888, 2020 Ohio App. LEXIS 2226, at *1 (Ohio Ct. App. June 11, 2020).
entered the GDPR fray by summarily applying the Finjan model, but with a twist based on Ohio concepts of relevancy and confidentiality.
In this employment suit against his former employer, plaintiff sought discovery of the personnel records of seven individuals which were allegedly relevant to plaintiff's discrimination and retaliation claims.52Id. at *2.
Opposing the discovery, the employer argued the GDPR prohibited the production of the personal data in the personnel files without the permission of the individuals.53Id. at *2-3.
As a condition of proffered production, on appeal, the employer requested a protective order and a promise of indemnification for any levies or fines it might suffer as a result of producing the personal information.54Id. at *3.
The employer argued, however, the trial court erred in ordering the requested production because compliance would require it to violate the privacy rights of EU citizens and the GDPR, exposing it to high fines, other enforcement measures, and civil litigation despite the availability of Hague Convention processes to obtain the same information directly through agreed EU state processes.55Id. at 9-10.
The court duplicated the Magistrate’s analysis in Mercedes II. Relying principally on Finjan,562019 U.S. Dist. LEXIS 24570, at *2.
and Richmark,57959 F. 2d at 1476.
the court applied the five factor test from Restatement (Third) of Foreign Relations Law § 442(1)(c) and quoted Societe Nationale.
The court found Factors I, II, IV, and V weighed in favor of production.58Phillips, at *11-14.
Factor III — whether the information originated in the U.S. — did not weigh in any party's favor because the evidence concerning where the information originated was unclear on the record.59Id. at *13.
As to Factor V, the court focused on Ohio's interest in preventing employment law infractions, and on the employer’s failure to demonstrate any hardship or likely enforcement by an EU supervisory authority — were the GDPR violated — in finding this factor weighed in favor of production.60Id. at *13-14.
Notwithstanding its factor analysis — which the court concluded justified production of the requested material — the court conceded the files could contain otherwise irrelevant or confidential material.61Id. at *14.
For that reason, the court affirmed the requested production but ordered, on remand, the trial court to conduct an in camera inspection of the documents for redaction of otherwise undiscoverable irrelevant and confidential matter before being turned over to plaintiff.62Id. at *14-15.
IV. Navigating the “Delicate Task of Adjudication”
The elements of the Finjan model practically jump from the pages of the preceding cases due to the uniformity of the supporting citations, order of the reasoning, and unanimity of outcome. Since the comity factor is deemed the most important of the Restatement (Third) factors, and is addressed directly by the courts, it will be discussed here.
In Societe Nationale,63482 U.S. 522 (1987).
the court carefully described the sort of comity analysis which should occur: "American courts, in supervising pretrial proceedings, should exercise special vigilance to protect foreign litigants from the danger that unnecessary, or unduly burdensome, discovery may place them in a disadvantageous position. When it is necessary to seek evidence abroad, however, the district court must supervise pretrial proceedings particularly closely to prevent discovery abuse. American courts should therefore take care to demonstrate due respect for any special problem confronted by the foreign litigant on account of its nationality or the location of its operations, and for any sovereign interest expressed by a foreign state.”64Id. at 546.
The court, however, declined to articulate specific rules to guide the "delicate task of adjudication.”65Id.
Reacting to the open-ended but “delicate task of adjudication” of the comity issue set out by the majority, the Societe Nationale dissent predicted the danger of courts resorting “unnecessarily to issuing discovery orders under the Federal Rules of Civil Procedure in a raw exercise of their jurisdictional power to the detriment of the United States’s national and international interests.”66Id. at 548.
The dissent also observed: “…courts are generally ill equipped to assume the role of balancing the interests of foreign nations with that of our own…relatively few judges are experienced in the area and the procedures of foreign legal systems are often poorly understood.”67Id. at 552.
The dissent predicted: “A pro-forum bias is likely to creep into the supposedly neutral balancing process and courts not surprisingly often will turn to the more familiar procedures established by their local rules.”68Id. at 553.
V. Societe Nationale - Cited, but only Selectively?
It is hard to argue the dissent’s predictions have not materialized given the brevity and formulaic character of the comity analysis in the cases discussed. As noted, the same cases are cited for the same points, in the same order, with the same result.
The uncritical repetition and reliance on an inapt quote from Societe Nationale illustrates this approach. The Supreme Court’s statement in Societe Nationale — that other countries know of the United States’s broader discovery and understand decisions concerning evidence to be used in litigation in U.S. courts must be made by those courts — is repeated to diminish the foreign countries’ interest in enforcement of its law as to its subjects whose data is sought in U.S. litigation.69Id. at 482- 483.
AstraZeneca702011 U.S. Dist. LEXIS 42405, at *1.
appears to be the origin this quote’s use for the proposition that the foreign states’ interest in enforcement of its law (in AstraZeneca Sweden’s trade secret law) is diminished or neutralized by its knowledge that U.S. discovery is very broad, and decisions about evidence to be used in U.S. litigation must be made by U.S. courts.71Id. at *52.
The quote, however, did not support the point in AstraZeneca, and does not in the GDPR cases.
In the cases discussed the quotation is used to diminish the foreign state’s interest in application of its law to its subjects where honoring the GDPR would conflict with the U.S. court’s discovery authority, or the requesting parties’ convenience, because “they” already know the U.S. does things differently. Knowing that the U.S. does things differently is objectively not probative of the foreign state’s interest in the enforcement of its laws. While the knowledge likely inspires little confidence in the foreign sovereign that its law will be honored in U.S. courts, it is no measure of the foreign state’s interest in seeing its law applied to its subjects.
In its original context, the quote explained the Supreme Court’s rejection of the Court of Appeals’ speculative reasoning for not making Hague Convention discovery processes the first resort of U.S. litigants seeking foreign documents. It was not stated to diminish France’s interest in its “blocking law” — which was dealt with elsewhere, and directly, by reliance on Societe Internationale Pour Participations v. Rogers.72357 U.S. 197, 204-206 (1958).
Indeed, the Supreme Court explained the role of the foreign law in the comity analysis it envisioned: “The lesson of comity is that neither the discovery order nor the blocking statute can have the same omnipresent effect that it would have in a world of only one sovereign. The blocking statute thus is relevant to the court’s particularized comity analysis only to the extent that its terms and its enforcement identify the nature of the sovereign interests in nondisclosure of specific kinds of material.”73Societe Nationale, U.S. 522 at 545.
One may say, similarly, the discovery order is relevant to the court’s particularized comity analysis only to the extent that its terms and its enforcement identify the nature of the U.S.’s sovereign interests in U.S. judicial discovery.
The repetition of this quotation to diminish foreign sovereign interest in its laws suggests more affinity for the gravity of a U.S. Supreme Court citation than interest in the gravamen of the quote.
A. Diminished Interests in Finjan Accurately Founded
Finjan, in contrast to later cases applying its analysis, supported its determination of the “diminished interest” point directly, citing Masimo Corp. v. Mindray DS USA Inc.,74No. SACV12-00206-CJC (JPRx), 2014 U.S. Dist. LEXIS 195028, at *6 (C.D. Cal. May 28, 2014) (protective order diminishes interest in protecting privacy).
and United States v. Vetco, Inc.75691 F.2d 1281, 1290 (9th Cir. 1981) (Swiss privacy interest diminished where IRS required by statute to maintain confidentiality of data).
for the proposition that foreign privacy interests are diminished where confidentiality protections apply to the compelled U.S. production.76See Finjan, 2019 U.S. Dist. LEXIS 24570, at *8-9.
It does follow, at least, that where a U.S. protective order or statute serves the privacy purpose of the foreign law — i.e. limiting the scope of the privacy intrusion and guarding against further dissemination — the foreign country’s interest in absolute application of its law is diminished. Under this reasoning a weakened GDPR strawman is propped up so it may be knocked over by the “greater” U.S. interest at hand, e.g., U.S. courts’ interest in its discovery procedures, U.S. interest in enforcing its patent laws, protection of interests implicated by RICO, and consumer protection laws, etc.
B. Just Cite it for the Proper Point…
Despite its misapplication, the Societe Nationale quotation is nevertheless pertinent to the particularized comity analysis. The Supreme Court said examination of the foreign laws’ terms, and enforcement identify the “nature” of the foreign sovereign’s “interests” in nondisclosure of personal data. The defendant in Finjan conceded the GDPR’s terms did not expressly forbid production. Smulski started off claiming the GDPR prohibited production, then backed off in a tedious discretionary analysis. The Mercedes defendants did not argue prohibition, only broad data coverage and protection, and the risk of dire enforcement. By its terms the GDPR does not absolutely prohibit transfer of protected data in litigation.
As for the EU’s enforcement of GDPR and what it says about the “nature” of the sovereign’s “interests” in nondisclosure of personal data, no case yet has reported an existing or past enforcement action against a GDPR-subject controller or processor for producing, under United States court compulsion, narrowly- limited GDPR-protected data, under a protective order, in U.S. litigation. No case has reported a credibly threatened enforcement by a supervisory authority for such a production. Lack of credibility of the enforcement threat takes the teeth out of an objecting party’s “hardship” claim — discussed as an additional factor in Richmark — and lack of actual enforcement goes directly to the “nature” of the foreign country’s “interests” in nondisclosure.77Richmark, 959 F.2d at 1475.
The cases repeatedly reference the lack of evidence of any immediate enforcement activity, or record of enforcement, by supervisory authorities against EU companies which produce GDPR protected data in U.S. civil litigation under U.S. discovery and protective orders. So far, the EU enforcement threat seems abstract. According to the GDPR enforcement tracker, as of early September 2020 there are no listed enforcement actions citing or applying Articles 48 or 49 of GDPR. These articles would most likely be implicated were enforcement premised on a U.S. court-compelled transfer of personal data. That does not mean, of course, that GDPR-subject companies’ fear of enforcement, or a large fine, is unfounded. The numerous subjective links in the decision chain of Article 49 (1)(e) and its supporting guidance — any one of which could found a violation adjudication — provide little comfort to a company seeking refuge there.
Nevertheless, under the “particularized analysis” required by Societe Nationale, the absence of EU enforcement signals weak EU interest in nondisclosure of the limited, relevant, protective-order governed data at issue in the United States cases. We might speculate U.S. protective orders chill EU enforcement because the GDPR privacy interest in the produced data is being served, albeit by the U.S. court enforcing its protective order. Enforcement could also be chilled because it would be messy. Mechanisms for U.S. litigants subject to GDPR to justify their compelled production do exist under GDPR, however tedious and uncertain they may be. Taking on Mercedes, however, in an enforcement action over U.S. discovery could prove daunting and possibly unpopular. On the other hand, the companies listed in the GDPR enforcement tracker prosecuted for divulging or violating seemingly ‘benign’ privacy interests (e.g., video of a public street) could have an opinion whether U.S. litigant companies subject to GDPR are getting a pass from their supervisory authority when they produce protected data in compliance with U.S. discovery orders. Data subjects may disagree that the controller or processer’s interests outweigh their privacy interests under GDPR. U.S. courts finding no hardship on the objecting party, or assessing the EU’s interest in protecting data as minimal due to lack of enforcement, dare the EU to make an enforcement example of a U.S. litigant subject to GDPR.
VI. Conclusion: Ms. Leavitt Predicted this Situation
Melinda F. Leavitt predicted this game of chicken in The National Law Review:
Well, here is a prediction – U.S. courts will have little patience for GDPR compliance requirements if the result is a failure to preserve electronically stored information (ESI), a substantial delay in producing requested documents and data, or an outright refusal to produce the materials requested.
…
The Europeans have long taken a different approach towards compelled – or involuntary – disclosure of information that relates to an individual. And what may have begun, at least in part, as a reflection of specific countries’ disdain for U.S. discovery – e.g., the French blocking statute – has evolved in more recent years to genuine concern about personal privacy in an era where electronic data is ubiquitous, instantly transferable across national boundaries, and subject to unknown uses or misuse. Nonetheless, U.S. courts continually have treated European privacy protection efforts as more of an annoyance to be quickly swatted away and dispelled.
…
Will European companies stand firm behind the GDPR and either decline to produce data or seek substantial delays, thereby risking the wrath of U.S. judges – or will they elect to comply with U.S. discovery orders and risk the significant fines that can be imposed on them for non-compliance with the GDPR’s provisions? Are the European authorities really going to impose those fines despite having not done so in the past? If they do, are U.S. courts really going to continue to require compliance with U.S. discovery rules, essentially ignoring the hardships those fines represent?78Melinda F. Levitt, GDPR and U.S. eDiscovery- Who Will Win the Game of Chicken?, National Law Review (June 20, 2018).
So long as defendants can only describe GDPR enforcement and penalties as threats, exposures, jeopardy, and other possibilities, United States courts do not appear generally likely to take the GDPR hardship burden seriously or credit the EU’s interest in its privacy laws sufficiently to deny otherwise relevant, limited U.S. discovery subject to protective order. This means GDPR-subject U.S. litigants who can afford to should continue to create a record of resistance to U.S. discovery based on GDPR as a defensive hedge against GDPR enforcement in the EU, should they be the unlucky litigant chosen by an EU authority to serve as the example.
View Article
Back