1938 Federal Rules
1934 Hickman v. Taylor
1970 Rule 34 Amendment
2003 Zubilake v. UBS
2006 ESI Amendments
“Everyone has the right to respect for his private and
family life, his home and his correspondence”
Article 8, European Convention for the Protection of Human Rights and Fundamental
Freedoms,1950
EU Data Protection Directive 95/46/EC
“Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.”
Article 1 Object of the Directive
“[A]ny information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly . . . .”
Article 2 Definitions – Personal Data
EU Data Protection Directive 95/46/EC
“ any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction”
Article 2 Definitions – Processing of Personal Data
EU Data Protection Directive 95/46/EC
“the natural or legal person, . . . or any other body which alone or jointly with others determines the purposes and means of the processing of personal data”
Article 2 Definitions – Controller
EU Data Protection Directive 95/46/EC
“ any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction”
Article 2 Definitions – Processing
EU Data Protection Directive 95/46/EC
Article 7 Criteria for Legitimate Data Processing
• the data subject has unambiguously given his consent; or
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
• processing is necessary for compliance with a legal obligation to which the controller is subject; or
EU Data Protection Directive 95/46/EC
Article 7 Criteria for Legitimate Data Processing
• processing is necessary in order to protect the vital interests of the data subject; or
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or
EU Data Protection Directive 95/46/EC
Article 7 Criteria for Legitimate Data Processing
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).
EU Data Protection Directive 95/46/EC
Article 18 Obligation to Notify the Supervisory Authority
“[T]he controller or his representative, if any, must notify the supervisory authority referred to in Article 28 before carrying out any wholly or partly automatic processing operation . . . .”
EU Data Protection Directive 95/46/EC
French Blocking Statute, Penal Code Law No. 80-538
“[I]t is prohibited for any party to request, seek or disclose, in writing, orally or otherwise, economic, commercial, industrial, financial or technical documents or information leading to the constitution of evidence with a view to foreign judicial or administrative proceedings or in connection therewith.”
Societe Nationale Industrielle Aerospatiale v. United States District Court for the Southern
District of Iowa, 482 U.S. 522, at 544 n.29 (1987)
The French blocking statute did not “deprive an American court of the power to order a party subject to its jurisdiction to produce evidence even though the act of production may violate that statute.”
Article 25 Transfer to Third Countries
“[T]he transfer to a third country of personal data . . . may take place only if . . . the third country in question ensures an adequate level of protection.”
EU Data Protection Directive 95/46/EC
Article 26 Derogations To Transfer
- Consent of data subject;
- Necessary for performance of contract with data subject;
- Legally required on important public interest grounds or for the establishment, exercise or defense of legal claims;
- To protect vital interests of data subject.
EU Data Protection Directive 95/46/EC
Navigating the Cross-Border
Conflict
• Approach with caution
• Limit scope – pseudonymize - anonymize
• Educate the opposing counsel and court
• Coordinate with local EU counsel & Safe Harbor vendor
• Confidentiality agreement / protective order
• Advance best arguments and comply with spirit
Top Related