In AccessData Corporation v. ALSTE Technologies GmbH, 2010 U.S. Dist. LEXIS 4566 (D. Utah Jan. 21, 2010) the U.S. District Court for the District of Utah, Central Division, compelled the production of personal information about customers of the German defendant after finding that German laws did not necessarily bar the production of such information and that the Hague Convention1 did not apply to the requested discovery.
In this breach of contract case, AccessData claimed that ALSTE, a German corporation, owed nearly $80,000 in unpaid invoices for reselling software manufactured by AccessData to ALSTE customers. In response, ALSTE alleged that the software was defective, and counterclaimed that AccessData violated a separate agreement by failing to pay ALSTE for providing technical support to certain users of the software in Germany.
During discovery, AccessData sought information regarding customer complaints and related injuries. ALSTE’s objections included that disclosing information relating to its customers and their employees would violate German law. AccessData then moved to compel.
ALSTE asserted that providing the requested information would subject it to civil and criminal penalties under the German Constitution and German Data Protection Act (GDPA). However, ALSTE did not cite specific provisions prohibiting disclosure, nor apparently did ALSTE provide information to support its position. Based on its own “brief review” of the GDPA, the court concluded that the “Derogations” in Part I, Section 4C permit the transfer of personal information to foreign countries without equivalent privacy protections if “the data subject has given his/her consent [or] . . . the transfer is necessary or legally required . . . for the establishment, exercise or defence of legal claims.” ALSTE did not establish that consents were unobtainable or that these exceptions were inapplicable.
In addition, the court found that ALSTE was incorrect in asserting that discovery must proceed under the Hague Convention. In Aérospatiale,2 the Supreme Court held that “it is well settled that such [blocking] statutes do not deprive an American court of the power to order a party subject to its jurisdiction to produce evidence even through the act of production may violate that statute.” Resorting first to the Hague Convention might be proper if foreign states are involved as either parties or “sovereigns with a coordinate interest in the litigation,” or if the cost of transporting documents or people increases the likelihood that discovery is being sought for an improper purpose. As this was not the case here, the Hague Convention did not apply.
This case raises a number of issues. ALSTE apparently did not show that its customers were individuals rather than business entities (which the GDPA—unlike the DPAs of some European Union (EU) nations—do not protect). Regarding the GDPA, a recent EU opinion appears to confirm that Section 4C of the GDPA may indeed justify a transfer of personal data to the U.S. in this case.3
However, the court only reviewed the GDPA’s provisions concerning transfers of personal information to countries without equivalent privacy protections, and did not consider provisions governing whether such information can as an initial matter be accessed or disclosed to third parties, which appears to be a more difficult issue.4 The grounds for invoking the German Constitution are also unclear. In addition, the Hague Convention would not seem to apply, as Germany’s reservations under Article 23 do not permit pretrial discovery.
As this case and the recent Global Power5 case illustrate, litigants before U.S. courts seeking to limit discovery by invoking foreign laws have a high burden of proof and must anticipate the effect of Aérospatiale. The mere existence of nondomestic data-protection laws will not prevent U.S. courts from ordering discovery under the Federal Rules of Civil Procedure.