Litigants Unsuccessful in Invoking European Union’s Data Protection Regulation to Prohibit U.S. Discovery

The General Data Protection Regulation (GDPR) provides broad privacy restrictions applicable to the data of EU citizens wherever they may reside.  When it became effective in 2018 litigators queried whether the GDPR would complicate discovery in cross-border disputes, or in any disputes involving the personal data of EU citizens.  Several recent U.S. cases have affirmed that the GDPR will not provide a safe harbor in which parties may seek refuge from U.S. litigation discovery obligations.

History of the GDPR

The GDPR¹ changed the European Union’s data privacy landscape for entities in possession of citizens’ personal information. Lauded as the world’s strongest set of data protection rules, the regulation imposes limits on how organizations that control or process personal data may use and provide access to such data. Key provisions authorize EU nations to enact their own data privacy legislation consistent with the regulation, guiding how the GDPR will be implemented in respective EU-member countries. The UK², for example, has since passed the Data Protection Act of 2018.

The wide applicability of the GDPR impacts industries and jurisdictions across the globe. Companies, including those in the U.S. that operate or service EU citizens have had to adapt to comply with GDPR mandates or face fines up 20 million euros per violation.³

Invocation of the GDPR to Avoid U.S. Discovery

Litigants in U.S. courts have attempted to use the GDPR to limit or avoid discovery obligations with little success. Courts have declined to protect deposition testimony based on the assertion that the GDPR creates greater confidentiality for such testimony, see, e.g., Ironburg Inventions, Ltd. v. Valve  Corp.,⁴ declined to limit data retention and production based on an assertion that the GDPR increased the data anonymization burden, see, e.g., Corel Software, LLC v. Microsoft,⁵   and declined to prohibit a video deposition on the basis that doing so over a party’s objection violated the GDPR, see, e.g., d'Amico Dry D.A.C. v. Nikka Financial.⁶  As discussed in detail below, when faced with a challenge that the GDPR prohibits the discovery sought entirely U.S. Courts have thus far generally maintained that they will not weigh foreign nations’ privacy interests over the interests of domestic parties seeking discovery.

The conflict between the GDPR and the right to discovery in U.S. litigation has been confronted by courts across the United States.  In a California patent infringement suit, Finjan, Inc. v. Zscaler, Inc., the defendant contended that the production of its former sales director’s emails would violate the GDPR unless costly redactions and anonymization were applied.⁷ In South Carolina, the plaintiffs in Rollins Ranches, LLC, v. Watson raised claims of defamation, tortious interference, and civil conspiracy against a U.K. citizen based on her social media communications. The defendant opposed the plaintiffs’ initial and renewed motions to compel discovery responses and the production of records, asserting that the UK Data Protection Act blocks access to these communications.⁸ In Pennsylvania, in Giorgi Global Holdings, Inc. v. Smulski, an action for civil RICO and breach of contract, among other claims, Defendants argued that Polish privacy law and the GDPR prohibited them from producing otherwise discoverable documents. In New Jersey, in In re Mercedes-Benz Emissions Litigation, the defendants sought to overturn an appointed special master’s finding that sought after discovery could not be withheld under GDPR protections, but rather could be produced and designated as “Highly Confidential.”⁹

Where a party has met its burden to prove that a foreign law bars production of discovery, courts will engage in a case-by-case comity analysis to determine its application. ¹⁰  In Societe Nationale Industrielle Aerospatiale v. U.S. District Court for Southern District of Iowa, the Supreme Court  followed the “particularized analysis,” set forth in the Restatement (Third) of Foreign Relations Law § 442(1)(c), to weigh the privacy interests of the foreign nation against the disclosure interests of the U.S. based on the following factors:

1. The Importance to the Litigation of the Documents or Other Information Requested

The importance of the documents weighs in favor of disclosure when the evidence is “directly relevant” to the claims¹¹ and there is a “substantial likelihood” that the documents will be important to prove the claims.¹²

2. The Degree of Specificity of the Request

Where a party makes a specific request directly related to relevant information from relevant documents this factor weighs in favor of production. This factor weighs against production where a party seeks irrelevant, sensitive, personal information and unduly burdens the opposing party with “generalized searches for information.”¹³

3. Whether the Information Originated in the United States

This factor weighs against production where it is found that the majority of the sought-after documents and their custodians are located in a foreign nation.

4. The Availability of Alternative Means of Securing the Information

Where there is no alternative means for a plaintiff to obtain the sought-after information, this factor weighs in favor of production.¹⁴

5. The Extent to Which Noncompliance Would Undermine Important Interests of the United States, or Compliance Would Undermine Important Interests of the Foreign State

Arguably the most important factor, the Courts recognize that the U.S. “has a substantial interest in fully and fairly adjudicating matters before its courts – an interest only realized if parties have access to relevant discovery – and in vindicating the rights of American plaintiffs.”¹⁵ Where this goal can be accomplished while respecting foreign privacy interests (i.e., through protective orders and confidentiality agreements), this factor weighs in favor of production.¹⁶ Likewise, this factor weighs in favor of production where respecting foreign privacy interests would impede the pursuit of serious claims with significant impact (i.e., impacting American consumers en masse).¹⁷

The Finjan, Rollins Ranches, In re Mercedes-Benz Emissions Litig., and Giorgi courts rejected the invocation of the GDPR and implementing regulations. Those courts found that the parties resisting discovery failed to meet their burden, to demonstrate that the regulations should apply and, upon evaluation of the aforementioned factors, found that the interests of the U.S. and the party seeking discovery outweighed the interest of the foreign nation privacy interests.¹⁸ Accordingly, the GDPR and implementing legislation did not result in a prohibition against the requested discovery.

Chapter 6 GDPR provides that a “legal requirement” may be a basis for which a company can make a compliant disclosure of personal information.¹⁹ Article 49 of the GDPR further provides that personal data can be transferred to a  third country where it is “necessary for the establishment, exercise or defence of legal claims.”²⁰ However the European Data Protection Board (“EDPB”), which was created by the GDPR to create guidance on its application, has advised that a legal requirement is not established merely by an order of a U.S. Court, and the Article 49 derogation is not granted for every foreign legal proceeding—only those in which pass a strict “necessity test.” While balancing the interests of domestic parties seeking discovery U.S. courts must also be aware of the reality that action may be taken against litigants for their disclosures in discovery.

Implications of U.S. GDPR Rulings and Beyond

U.S. courts’ rulings in favor of disclosure over litigants’ invocation of the GDPR and other foreign data protection laws are likely to make waves for companies with an EU presence. Where courts determine that litigants must comply with discovery requests, the companies involved in maintaining relevant personal data run the risk of violating the GDPR. While not the focus of regulators thus far, document production in litigation may soon garner their attention, as enforcement efforts have been aggressive, and the imposition of fines has been significant.

Furthermore, as domestic data privacy legislation expands in the U.S.—California’s enactment of the California Consumer Privacy Act (CCPA)²¹ is expected to be followed by additional states enacting similarly restrictive data privacy laws—similar discovery objections and claims are likely to be raised, based instead on state law.

Brittney L. Denley is an attorney at Riley Safer Holmes & Cancila LLP.