March 6th, 2011 by Monique Altheim
Ediscovery in US Civil Litigation and EU Data Protection
EDiscovery in the US
Electronic Discovery (or “Ediscovery”) is
the
process of identifying, preserving, collecting, preparing, reviewing,
and producing electronically stored information (“ESI”) in the context
of the legal process. Some examples of ESI are: emails, word
documents, power point presentations, excel sheets, social media posts,
voice mail and videos.
The legal basis for one party to request from the other party to
produce ESI that are in that party’s possession, custody and control is
Rule 34 of the Federal Rules of Civil Procedure. (2006):
“(a) In General. A party may serve on any other party a request within the scope of
Rule 26(b):
(1) to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following
items in the responding party’s possession, custody, or control: (bold added)
(A) any designated documents or electronically stored
information—including writings, drawings, graphs, charts, photographs,
sound recordings, images, and other data or data compilations—stored in
any medium from which information can be obtained either directly or, if
necessary, after translation by the responding party into a reasonably
usable form; or
(B) any designated tangible things; or
(2) to permit entry onto designated land or other property possessed
or controlled by the responding party, so that the requesting party may
inspect, measure, survey, photograph, test, or sample the property or
any designated object or operation on it.”
In principle, any nonprivileged matter that is relevant to any
party’s claim or defense, is subject to discovery, even if it is nor
admissible as evidence, as long as it “may lead to the discovery of
admissible evidence”, as per Rule 26(b):
“(b) Discovery Scope and Limits.
(1) Scope in General. Unless otherwise limited by court order, the
scope of discovery is as follows: Parties may obtain discovery regarding
any nonprivileged matter that is relevant to any party’s claim or
defense—including the existence, description, nature, custody,
condition, and location of any documents or other tangible things and
the identity and location of persons who know of any discoverable
matter. For good cause, the court may order discovery of any matter
relevant to the subject matter involved in the action. Relevant
information need not be admissible at the trial if the discovery appears
reasonably calculated to lead to the discovery of admissible evidence.
All discovery is subject to the limitations imposed by
Rule 26(b)(2)(C) “.
The Courts interpret the Federal Rules of Civil Procedure as having extra-territorial reach.
As long as the ESI is in the “
responding party’s possession, custody, or control”, and
is relevant to the litigation, it does not matter wherein the world
these ESI reside, it is discoverable under federal law. If, for example,
a US employee can access ESI of an affiliate overseas on a shared
network, the US company has “possession, custody and control”, and the
overseas ESI is discoverable on that basis.
The US has the broadest civil discovery procedure in the world. None
of the other Common Law countries, such as the United Kingdom, Australia
and Canada, have such a wide scope of discovery and in most of the
Civil Code countries, such as in most of the European and Latin American
countries, the concept of discovery obligations is unknown.
In the last few years a quite voluminous case law has developed
regarding the interpretation and application of the Federal Rule of
Civil Procedure (FRCP). The law has developed differently in each of the
District Courts and it is important to keep that in mind when preparing
a case.
In cases governed by US state law, keep in mind that many states have
enacted new civil procedure rules to cover discovery of ESI. Most
states have adopted the FRCP ediscovery model. For example, Florida
became the 29th state to adopt specific electronic data discovery rules
for its state courts on July 5, 2012. It is based on the FRCP model.
When confronted with a lawsuit or subpoena in a large case, it is
considered best practice to appoint a project manager, who organizes an
eDiscovery team and who coordinates the co-operation between corporate
counsel, IT, records management, HR, outside counsel and various service
providers. This task can be done in-house, or outsourced to a law firm
or an eDiscovery consultant.
The IT and records management departments are helpful in explaining
the company’s IT architecture and the life cycle of the records, as well
as in preparing a computer network and data map to locate all
discoverable data. The endless list might contain servers, backup tapes,
flash drives, laptops, iPods, smart phones, VOIP systems, EZpass data,
IMS and text messages. It is important to consult HR concerning departed
employees as well, since the EDiscovery process will typically cover a
time period going back a few years.
If the information is not “reasonably” accessible, because of undue
burden or cost, the parties are relieved from disclosure, (Rule 26 (b)
(2) (B)), as they are when the burden or expense of the proposed
discovery outweighs its likely benefit, the so-called “proportionality
rule”. (Rule 26(b) (2) (C) (iii)).
Very old ESI, stored on obsolete media, might fall into the category
of “unreasonably accessible”, and a case where the lawsuit is worth
$100,000, but the EDiscovery costs would amount to $1 million, would
fall into the category of “disproportionate”.
The data custodians then need to be interviewed to ascertain what relevant data they might have.
Once all the ESI at issue has roughly been identified, a “Litigation
Hold” letter has to be sent to all relevant parties to make sure that
the potential evidence doesn’t get destroyed or altered.
A “Litigation Hold” or a “Legal Hold” is a communication issued as a
result of current or reasonably anticipated litigation, audit,
government investigation, or other such matter that suspends the normal
disposition or processing of records.
It is very important to carefully document all these steps, in case
you have to prove due diligence in preserving ESI to the Court.
Then comes the ”meet and confer” meeting with opposing counsel and
the Court, where parties discuss the scope of production of ESI in terms
of subject matter and relevant time period. The following topics are
some that also need to be addressed: the search methodologies to be
used; the list of keywords to be used for keyword search; the
requirement for preservation of metadata; the format for the production
of ESI (TIFF or Native or both); clawback agreements (a clawback
agreement is an agreement outlining procedures to be followed to protect
against waiver of privilege or work product protection due to
inadvertent production of documents or data); and issues of cost
shifting (Rule 26 (f)).
Next, outside vendors or service providers are usually called in to perform the actual collection of ESI.
Some important questions to ask the vendors are whether they provide
software that enables key word searching, conceptual searching,
technology assisted searching, predictive coding, near duplicate
identification, e-mail threading, and foreign language search
capabilities. In smaller cases, in house IT staff may do the job of
collecting all the ESI.
Once all the ESI is captured, the project manager arranges for teams
of contract attorneys to review the ESI for relevance, and
confidentiality and privilege flagging and redacting. This is the most
time consuming and expensive part of eDiscovery. In a large lawsuit with
about 30 million documents to be reviewed, this part of the eDiscovery
process sometimes takes a few years to complete.
The reviewed data get analyzed by trial attorneys and integrated into trial preparation software.
Finally, the reviewed and analyzed ESI gets delivered to the opposing
counsel in CD, DVD, hard drive or other formats, who then has his own
team review the ESI.
In large cases, this whole procedure is executed in the form of rolling productions, with scheduled releases of data.
When eDiscovery needs to be executed outside of the US, for example
in a foreign affiliate or subsidiary of a US company, the basic
procedure remains the same, except that there are myriads of
complications due to different legislations that apply when data gets
collected in foreign jurisdictions.
Many countries outside of the US have legislation that protects data
from either being collected and/or from being exported outside of the
country.
These can be criminal laws, labor laws, bank secrecy laws, and data privacy laws.
The European Union data protection framework is one of the most
prohibitive set of laws that parties to a civil litigation or government
investigation in the US has to deal with, when trying to collect and
export evidence.
EDiscovery in the EEA and Data Protection Issues
The EEA (European Economic Area) consists of the 27 member states of
the EU, plus Iceland, Liechtenstein and Norway. It has one of the
strictest data protection frameworks in the world.
In the EU, data protection is a human right and is protected
by article 8 of the Charter of Fundamental Rights of The European Union.
The main legal instrument that regulates data protection in the EEA is the
Data Protection Directive 95/46/EC.The
Directive has been implemented by all 30 national member states into
their national laws, and, while the Directive acts as a floor, some
national laws have gone even further in their protection of personal
data.
There are quite a lot of differences in implementation of the
Directive: France, Germany, Spain, and Italy have stricter rules, while
the UK has more lenient ones.
One of the most difficult problems of the EU data protection regime
is the lack of harmonization of laws between the member states, and
consequently also the difficult but important determination which
national law is applicable in any given situation.
This is one of the points under consideration in the current process of overhaul of the entire European data protection regime.
On January 25, 2012, the European Commission proposed a new
Data Protection Regulation. That Regulation should replace Directive 95/46/EC.
If the new legislation would indeed take on the form of a
“Regulation”, it would be, under EU law, directly applicable to all
member states, without need for separate implementation into national
law, as would be the case for a “Directive” and that would considerably
facilitate the global transfer of data outside the EEA.
Another proposed innovation would be the imposition of fines for data
protection violation up to 2% of the gross annual turnover of the
violating company.
It is expected to take quite a few years for the new rules to come
into force though, so that for a while, the old rules will still apply
and therefore will still be very relevant.
There is a serious conflict for US firms with affiliates in EEA
countries, when they get involved in civil litigation within the US: On
the one hand, federal and state rules mandate retention and production
of all relevant data, even data located outside of the US, with the risk
of severe penalties by the Courts in case of “spoliation”, and on the
other hand, EU data protection laws (applicable to the EEA) mandate very
strict data protection rules for “personal data” of their residents,
that seriously restricts processing of personal data and transfer of
those data to “non-adequate” countries outside of the EEA, with risks of
steep fines in case of transgression.
Directive 95/46/EC regulates the processing of “personal data”.
“Personal data” is construed very broadly as “any information
relating to an identified or identifiable natural person or “data
subject”” (Article 2, (a) of Directive 95/46/EC).
For example, an email address is “personal data”.
“Sensitive Personal Data” are personal data that reveal “racial or
ethnic origin, political opinions, religious or philosophical beliefs,
trade-union membership, and the processing of data concerning health or
sex life” and processing of such data is in principle prohibited, with a
very limited list of exceptions ( Article 8 of Directive 95/46/EC).
The processing of personal data within the EEA is subject to
extensive regulation, which, in a nutshell, strives to incorporate
privacy principles, such as consent, access, proportionality,
transparency, necessity and legitimacy. (Article 6 of Directive
95/46/EC).
The Article 29 Working Party, a EU data protection advisory body, recommends in its
Working Document 1/2009 on pre-trial litigation in cross border ediscovery
( WP 158, 2009) guidelines to be followed in order to conduct cross
border ediscovery within the requirements of the EU data protection
framework.
It recommends that
- The filtering and reviewing of ESI for relevance should be done
locally, within the EEA. Personal data should be anonymised or
pseudonymised. The parties should obtain protective orders and filings
under seal from the US courts to protect data from access by third
parties.
- A notice should be sent to all employees or customers, whose emails
or other data are collected. The data subject has a right to know that
information is being collected about him/her.
- The data subject’s rights should be respected: for example, the data
subject has the right to access the information that is being collected
about him/her.
- Data Controllers should take reasonable measures to secure personal
data from unauthorized access. This applies to vendors, law firms and
courts in every stage of the ediscovery process.
- If the collection of ediscovery is outsourced to a third party, such
as a vendor, there must be a written agreement with that third party,
who must undertake strict confidentiality and provide appropriate
security, must undertake to use the data only for specific purposes and
within a specific retention period and only in accordance with the data
controller’s instructions.
- There has to be a legal basis for processing of personal data. In
other words, there has to be a legitimate reason to process personal
data of other people: for example, curiosity is not a legitimate
reason. For the purpose of ediscovery, there are only two legitimate
basis for processing personal data under directive 95/46/EC: One is
informed and freely given consent by the data subject (article 7 (a) ),
the other is a legitimate interest of the data controller, balanced with
the fundamental rights of the data subjects. (article 7 (f) ). The
Article 29 Working Party recognizes ediscovery as a “legitimate
interest”. For sensitive personal data, the legal basis is
more stringent: consent is the only legitimate basis for purposes of
ediscovery, and it has to be explicit and cannot be implied. For
example, opt-out is implied consent, and opt-in is explicit consent.
- There has to be a legal basis for transfer of personal data outside
of the EU. (articles 25 and 26). In the case of the US, this can be
accomplished by several means: By receiving unambiguous consent from the
data subjects (not very practical), by transferring the data to a Safe
Harbor certified company in the US, by transferring the data under
Standard Contractual Clauses agreements or by transferring them to
companies that have “Binding Corporate Rules” in place. The question
remains, however, how these personal data may be legally transferred
onward to opposing counsel and to the Court. The Working Party
recommends requesting a protective order from the Court, which
guarantees the data a certain degree of privacy protection.
In addition , the national Data Protection Authorities (DPAs) need to
get the proper notifications, as for every processing of personal data
under the Directive.
In order to show good faith, in case the national DPA should conduct
an audit, it is to be recommended that the data controllers involved in
ediscovery include all the above mentioned privacy guarantees in their
general policies.
When choosing ediscovery vendor or consultants to do ediscovery in
the EAA, one must look to how well they guarantee the rights of the data
subjects under Directive 95/46/EC , such as notice to the concerned
data subjects and access of the data subjects to their data and whether
the processing of the data, such as preliminary document review, is
done in the EU. When transferring data to the US for final processing,
the US companies should either be Safe Harbor certified, or have model
contract clauses or binding corporate rules, approved by the Data
Protection Authorities, in place. This is a requirement for any EU
personal data that will eventually be used in a civil proceeding in the
US.
The increase of data protection risks associated with the rise of
cloud computing has prompted the Article 29 Working Party to publish
Opinion 05/2012 on Cloud Computing.
As a reminder tough, the Article 29 Working Party’s opinions are not
legally binding, but they are very influential nevertheless.
Conclusion:
Companies which have to apply ediscovery rules and at the same time
are under the jurisdiction of the EEA data protection laws, find
themselves between a rock and a hard place.
Under Rule 37 FRCP and under the traditional rule of “spoliation”,
which means the destruction or alteration of evidence, or even the
failure to preserve property or documents for another’s use as evidence
in pending or reasonably foreseeable litigation, the US federal courts
have broad discretion regarding the type and degree of sanctions they
can impose.
The sanctions run the gamut from significant monetary sanctions, to
“adverse inferences”, meaning directing the jury to assume that missing
ESI is adverse to the spoliator, to even default judgments.
As with other laws, the case law has developed differently in the different district courts.
In general though, the Courts do not look kindly, not only to those
parties in litigation who are guilty of willful spoliation, but also
those who merely show negligence in preserving and producing ESI, and
the case law of Judges sanctioning negligent parties has grown over the
past few years.
As mentioned before, these rules apply to all relevant ESI in the
parties’ possession, custody or control, regardless of their
geographical location or the applicable local laws.
It is therefore crucial for companies that are affiliates or
subsidiaries of US companies, to have a litigation hold procedure in
place, since the reasonable expectation of a lawsuit alone triggers the
obligation of preservation of ESI under the FRCP, without delay.
What is even more crucial for companies today is the proper management of “information governance.”
Since storage of ESI has become so cheap, especially in the cloud,
the lure for IT has been very strong to just store everything, forever.
This can have disastrous consequences once a company gets involved in
litigation or internal investigations, since, once the ball starts
rolling, nothing potentially relevant may be deleted and as a
consequence, a company may have to end up paying a small fortune for
processing of terabytes of useless information.
It is a huge cost saving move for companies to invest in information
governance. That involves, among others, the decision as to which data
will be preserved for what period of time, and needs to be tailored to
the needs of the company, depending on the type of industry and the
regulatory and business requirements of the company. For most companies,
there is no reason whatsoever to retain all low level employees’
emails, forever. There need to be a policy, stating for example that all
of certain levels of employees’ emails need to be deleted within 6
months.
Proper information management will also facilitate the ability to locate data in an increasingly complex information ecosystem.
As far as EU data protection framework is concerned, the risk facing
EU affiliates of companies from the US in the course of EDiscovery
procedures not totally in line with the national data protection laws,
consists of being investigated and maybe fined by the local Data
Protection Authorities.
Of course, the risk depends very much on the country where the data are located.
If they are located in Germany, for example, the risks are much higher than if they are located in the UK.
Right now, most Data Protection Authorities are understaffed and
under financed, and there have been complaints about lack of compliance
and enforcement.
In France, for example, a January 2011 study has shown that 82% of
French enterprises do not abide by the French Data Protection Act of
2004.
But with the overhaul of the EU data protection framework in full
swing, and with the strengthening of the data subjects’ rights, as well
as the improving of enforcement as some of the main objectives of the
overhaul, I believe it would be wise for companies to prepare themselves
and make sure they have the right infrastructure in place for proper
compliance. The Federal Courts have already declared that social media
are discoverable and that the mere fact of outsourcing IT to the cloud
does not relieve companies from their EDiscovery obligations under the
FRCP.
In cases where ediscovery requirements are irreconcilable with EU
data protection requirements, companies will have to do a balancing test
between the risks of non compliance with EU data protection laws and
risks of non compliance with EDiscovery obligations in the US, on a case
by case basis.
Or maybe it should be the Federal Courts and the Data Protection
Authorities who should do the balancing when companies find themselves
between the rock of ediscovery and the hard place of data protection.
This is exactly what Working Group 6 (WG 6) of The Sedona Conference® is suggesting in its 6 principles, “
The Sedona Conference® International Principles on Discovery, Disclosure & Data Protection (December 2011).
WG 6 recommends that, as long as the parties in cross-border
ediscovery show good faith and reasonableness, “US Courts, as well as
Data Protection Authorities should consider the balancing of competing
factors to achieve a practical compromise between the US litigants’
interests and the EU data subjects’ interests. “
The subject matter of cross border ediscovery is an extremely
complicated one, and the move to mobile, social media and the cloud only
complicates already very complex legal issues of applicable laws.
February 19th, 2011 by Monique Altheim
On
February 11, the Article 29 Working Party adopted an opinion on the
revised Industry Proposal for a Privacy and Data Protection Impact
Assessment (PIA) Framework for RFID applications. (
ARTICLE
29 DATA PROTECTION WORKING PARTY 00327/11/EN WP 180 Opinion 9/2011 on
the revised Industry Proposal for a Privacy and Data Protection Impact
Assessment Framework for RFID Applications)
The aricle 29 WP endorses the proposal developed by industry
associations, experts, academics, and individual companies from across
Europe.
One of the main privacy concerns related to
RFID technology arises from uses of
RFID
technology which entail individual tracking and obtaining access to
personal data. While an RFID operator may not have such a goal in mind
when deploying an RFID application, it is important to consider the risk
that a third party may use tags for such unintended purposes. The
revised framework now clearly requires RFID operators to evaluate the
risks that may arise when tags may be used outside the operational
perimeter of an RFID application and/or are carried by persons.
The European Commission published a recommendation on the
implementation of privacy and data protection principles in applications
supported by radio-frequency identification on May 12th, 2009.( the
“RFID Recommendation”).
One of the recommendations reads:
“Article 7: RFID use in Retail
Article 7.3: (a) Where a RFID application processes personal data
or the privacy impact assessment…shows significant likelihood of
personal data being generated from the use of the application, the
retailer has to follow the criteria to make the processing legitimate as
laid down in directive 95/46 and to deactivate the RFID tag at the
point of sale unless the consumer chooses to keep the tag operational.
(b) Where a RFID application does not involve processing of personal
data and where the privacy impact assessment has shown negligible risk
of personal data being generated through the application, the retailer
must provide an easily accessible facility to deactivate or remove the
tag.”
In the
U.S. Federal Trade Commission Comments on the the European Commission’s recommendation of May 2009, the FTC stated, in response to recommendation
Article 7.3: (a)
” …Similarly, with respect to RFID, we caution against mandating a
specific technological approach, such as mandatory deactivation of tags,
before fully understanding the range of benefits the technology might
provide to consumers, as well as the range of protective measures that
might be available to consumers in the future.”
(The U.S. Federal Trade Commission’s Bureau of Consumer Protection is in charge of protecting consumer rights in the US.)
This is the recent Article 29 WP’s opinion on the subject matter of RFID use in retail:
“This concern (about individual tracking and access to personal data)
has received particular attention in the retail sector, where it is
feared that tagged items bought by individuals could be misused by
retailers or third parties for tracking or profiling purposes. The
European Commission addressed this concern in the Recommendation by
establishing the principle that tags must be deactivated at the point of
sale unless the customers give their informed consent to keep tags
operational. The same Recommendation allows an exception to this
deactivation principle if the PIA concludes that keeping tags
operational after the point of sale does not represent
a likely threat to privacy or the protection of personal data.
The Working Party observes that a risk management approach, as
suggested by the Framework, is an essential tool for the RFID Operator
to assess the risks of taking the responsibility to keep tags activated
after the point of sale.”
As shown with this example, a key point is that the Revised Framework
is based on a risk management approach, which is an essential component
of any Privacy and Data Protection Impact Assessment Framework.
The Article 29 WP however would like see implementaion of the
Commission’s recommendation no earlier than three years from now.(
2014):
“The European Commission is expected to provide
a report on the implementation of the Recommendation, its effectiveness and its impact on operators and consumers, with
regards in particular to measures concerning the retail sector. This
report is set to be produced 3 years after the Recommendation was
published, that is by May 2012. However, considering that the Framework
may take 6 months to fully take effect, supplementary time would be
beneficial for all stakeholders before such an evaluation is conducted.
Therefore, the Working Party would like to suggest to the European
Commission to either postpone or supplement the proposed report at a
later date set in 3 years from the publication of this opinion.”
In the above mentioned comments on the the European Commission’s recommendation of May 2009, the FTC remarked:
“The FTC staff supports the EC’s risk- based approach to addressing
potential consumer privacy and data security issues related to the use
of RFID technology. The FTC staff also agrees with the EC that there is a
need to raise consumer awareness about RFID technology, in order to
enhance consumer trust and to give consumers the tools to protect
themselves from the risk of misuse of their information. Given the
current stage of deployment of consumer-facing RFID applications,
however, the FTC believes that mandating or encouraging specific
technological tools for protecting consumer privacy is
premature.” (bold added)
Premature?
Implementation no earlier than 2014?
Last summer, Wal-Mart created quite a controversy when it started to use RFID tags to
track underwear and jeans
and the George Miller III Head Start Program in Contra Costa County,
California, created a buzz when they started to make pre-schoolers wear
jerseys, with RFID chips inside
that track them through the day.
But RFID (Radio frequency identification) technology is far from new.
It has been used for many years to keep track of cattle, prisoners,
goods, and pets.
RFID technology is already widely adopted, world wide and in many
industries, and is also found in enhanced driver’s licenses, credit and
debit cards, passports and government IDs, TWIC Cards, Employer
ID/Proximity Cards, US EZpasses, London Oyster cards, just to name a few
applications.
The risk of tracking, profiling, fraud, identity theft is here and it is real. RFID readers
are used by convenience stores, pharmacies, restaurants, fast food
markets, bars, and many other places of business to read the RFID chips.
However, these same readers can be freely purchased and attached to a
laptop with very little technical knowledge required. There are even
cell phones with built in card readers that can steal your information.
By simply walking past you, anyone equipped with such a device can
acquire your credit card number and expiration date. There is even a
term for it:
electronic pick pocketing.
Here’s a not so recent video by Boingboingtv’: “How to hack RFID-enabled Credit Cards for $8 (BBtv)”
Human RFID Implants are already used for access to car, home, office.
Human RFID implants with personal health and financial information are being used and promoted:
Premature? Seriously?
published
on 28 January 2011, 82% of French enterprises do not abide by the
French Data Protection Act of 2004 (La Loi Informatique & Libertés).
The AFCDP is a professional organisation that represents French
privacy professionals. The AFCDP works to develop privacy best
practices and to build relationships with the French National Data
Protection Commission (CNIL).
Following French Data Protection Act, an individual may request that
an entity that holds personal data about him, share that personal data
with him. After a request is made, the entity has two months to provide
full information to the person who made the request, free of charge. In
certain circumstances, the individual may then request that the personal
information be deleted or that it be brought up to date.
The AFCDP published a second “Access Right Index”. It is intended to
help French entities, both private and governmental, prepare themselves
to respond to these information requests and to help educate
individuals about their rights. The Index provides some insight into the
manner in which entities are currently complying with the law.
To complete the study, access to personal data requests were sent to a
panel of more than 220 French entities. In the Index, the AFCDP
indicates which sectors were the best and worst in terms of compliance,
and also provides anonymous, real examples of wrongdoing and guidance as
to best practices.
)..#privchat. 
