The CNIL issued a press release on January 15, 2008, to express its concern about recent developments in the U.S. regarding the rules and practices on transfers of data linked to U.S. litigation.
The CNIL has identified four instances that are potentially problematic from a French data privacy perspective:
1) the so-called “litigation hold” or “litigation freeze” procedures where a company is transferring data in anticipation of judicial activity;
2) the requirements attached to pre-trial discovery and the advent of services providers and software to assist companies to comply with the request in due time;
3) injunctions relating to compliance with the Foreign Corrupt Practices Act and the Sarbanes-Oxley Act;
4) the creation of a new offense punishing the destruction of relevant information that is applicable to European subsidiaries.
According to the CNIL, these practices are not in compliance with the provisions of French data protection law – in particular, the requirements to inform and obtain consent from individuals, the proportionality of the data processed, and the transfer of personal data outside the EU.
The CNIL has alerted the French government of these issues and expects the formation of an inter-ministerial working group to study the issues at stake. The CNIL also intends to put the issues on the agenda of the Article 29 Working Party with a view to possible discussions with the U.S. authorities.