E-discovery proceedings brought by companies or authorities located outside the European Union against French companies necessarily involve the transfer of personal data (e.g., the communication of emails). This raises difficulties with regard to legislation on personal data.
Both the EU General Data Protection Regulation (GDPR) and the French Computer and Freedoms Act prohibit, in principle, the transfer of personal data to countries whose legislation does not offer an equivalent level of protection. To derogate from this prohibition, specific compliance mechanisms must be put in place to provide the framework for each envisaged cross-border data transfer. Such mechanisms include adherence to the standard contractual clauses published by the European Commission, establishing binding corporate rules for intra-group transfers or adhering to a code of conduct.
On this basis, French companies have already refused in the past to follow a discovery request, arguing that the disclosure outside the European Union of documents containing personal data is prohibited by French law.
This issue is now addressed by Section 48 of the GDPR, which states that:
Any decision of a court or government entity of a third country requiring a Data Controller or Data Processor to transfer or disclose personal data may not be recognised or made enforceable in any way unless it is based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer under this Chapter.
Therefore, any request for discovery must be made within the framework of a treaty, in this case an international mutual legal assistance treaty. In France, as in the United States and elsewhere, the applicable procedure consists of international rogatory letters as provided for by the Hague Convention of 18 March 1970 on the Taking of Evidence Abroad in Civil and Commercial Matters (the Convention). This procedure allows any judge of a state party to the Convention to request, in accordance with the terms of its legislation, the competent authority of another state party to carry out any investigation measures. International rogatory letters are issued and received in each country through a central authority, which acts as a 'one-stop shop'.
In the context of the Convention, France has declared that it will not execute international rogatory letters issued in common law countries for the purpose of obtaining evidence before a trial (i.e., pretrial discovery), unless the documents required are listed restrictively and have a direct and precise relationship with the subject matter of the proceedings.
Since the 1987 Supreme Court Aérospatiale judgment, US courts have considered civil judicial cooperation proceedings under the Convention to be optional – that is, not replacing the extraterritorial application of the US pretrial discovery rules.
Regardless of whether the framework of the e-discovery procedure is national or international, the GDPR protection principles will consist essentially of data limitation and of proportionality (i.e., they will require that only personal data necessary for the procedure be disclosed).
The French Data Protection Authority and the European Coordination Committee recommend in this respect to (1) provide anonymised or pseudonymised data, where possible; and (2) request (via 'stipulative court orders') to limit the scope of the documents to be communicated, to specify the conditions related to the use and communication to third parties of the personal data collected, and to provide for the security and confidentiality measures to be followed.
The same authorities recommend, for companies that may be subject to an e-discovery procedure (e.g., French subsidiaries or parent companies of corporate groups with a company located in the United States), that these procedures be adapted to comply with the GDPR. For example, companies can:
- provide for an express information notice to employees (in an IT charter, for example) on the possibility that their data may be transferred outside the European Union in such a situation;
- equip themselves with software tools to 'filter' personal data, to be able to communicate only those data that may be required for an e-discovery procedure, should this happen; and
- insist that employees expressly identify their personal files (using an explicit name: 'personal' or 'private'), to be able to exclude them from the documents to be communicated.
In all cases, the persons whose data are communicated shall retain their rights over such data, namely rights of access, objection, deletion and limitation. US courts have previously accommodated these types of rights, despite normally taking a different view on the right to privacy.
In view of the extraterritorial and intrusive nature of cross-border discovery procedures, the French authorities have adopted a blocking statute designed to prevent, in particular, 'fishing expeditions' (i.e., procedures for economic intelligence purposes). As amended in 1980, this statute prohibits both the request and disclosure of any 'documents or information of an economic, commercial, industrial, financial or technical nature intended to constitute evidence for or in connection with foreign judicial or administrative proceedings' if outside international judicial cooperation mechanisms. The statute applies even if the search for information is not followed by a trial and even if the person being prosecuted is neither French nor a French resident. Violations of this statute are subject to criminal sanctions.
To date, there has been only one conviction in France, in 2007, against a lawyer who had sought information from a company director for a lawsuit in the United States by making false suggestions as to the nature of the evidence he was asking for. On the US side, the courts refuse to automatically follow French litigants on this legal basis. Following the Supreme Court, they balance the interests in question in order to define the scope of discovery.
A draft reform of the blocking statute is expected in the coming year. The issue of its international effectiveness will likely be one of the points of attention.