The Article 29 Working Party is the independent advisory board of the European Union on data protection and privacy. It was established by Article 29 of the EC Directive 95/46, hence the name “Article 29 Working Party”. Within its scope of duties, it also adopts documents and renders advice regarding cross-border data protection issues involving Non-Member States of the EU. It has recently issued a working document relating to the transfer of personal data from the EU to the United States for pre-trial discovery.
Parties to civil litigation in the United States often face transborder discovery, and are under the obligation to produce documents that may be relevant to the litigation. This also includes pre-emptive document preservation, known as “freezing”, in anticipation of proceedings before U.S. courts. Such obligations also apply to European companies with a U.S. office or U.S. subsidiary; U.S. courts may even order the production of documents located abroad, which means that such European companies may have to produce and transmit documents in their possession.
The Working Party opined that these issues giving rise to tension need to be resolved on a governmental basis. However, it provides some guidance for businesses that find themselves gripped in the middle of pre-trial discovery obligations and required-compliance with European data protection rules.
The Working Party found that consent will usually not be a proper ground to rely upon for transmission of personal data to the United States in the course of discovery proceedings, unless the data subject is itself involved in the litigation and is in a position to provide freely given specific and informed consent. In almost all other cases, it is unlikely that the data subject is even aware of the fact that his personal data is processed, in particular outside the European Union. In addition, the data subject must have the real opportunity to withhold his consent or to withdraw it without suffering any penalty.
Pre-trial discovery may qualify as processing of personal data that is necessary for the purposes of a legitimate interest of the data controller. This is the case where the legitimate interest is not “overridden by the interests for fundamental rights and freedoms of the data subject”. The Working Party recommends restricting disclosure in these cases to pseudonymised or anonymised data. A trusted third party in the EU should be commissioned to filter the irrelevant data in order to limit the amount of personal data that is disclosed to such information as is strictly necessary. This third person should be in a position to determine the relevance of the personal data for the litigation and therefore have sufficient knowledge of the litigation process.
The Working Party also recommends involving the internal data protection officers at the earliest possible stage. The internal data protection officer can then approach the U.S. courts and explain to them the data protection obligations on the European companies, and move for protective orders to comply with EU and national data protection rules.
Individuals whose personal data is used in the pre-trial discovery, such as employees, clients or customers, must be provided with a respective notification, and with the right of access and rectification. This may constitute considerable difficulties because the documents present evidence to a litigation that cannot be altered at a later stage if it shall serve its purpose of providing proof regarding a specific situation.
In summary, a European company with an office or a subsidiary in the United States should employ a document retention policy that abides by the national and European legislature, and install guidelines in order to avoid excessive production of documents. If requested to produce documents, the company should involve its data protection officer and move for a protective order to impose the data subjects’ rights to access, rectification and erasure of the personal data on the receiving party in the United States. In addition, the data subjects need to be informed on the processing of their personal data in the pre-trial discovery. The producing company should also closely review and filter the requested documents in order to provide only such documents that are necessary for the litigation. Where possible, the data should be redacted or pseudonymized/ anonymized.