c ross -b order l itigation : d iscovery and p rivacy i ssues

2010 OFII General Counsel Conference Washington, D.C.

1

CROSS-BORDER LITIGATION: DISCOVERY AND PRIVACY ISSUES


2

I. Overview — Obtaining Information or Documents Abroad

• Obtaining information or documents abroad — whether one is seeking it for oneself, for example in connection with an international internal investigation, or responding to requests made by others for such information or documents — is considerably more complex than obtaining the same information within the United States.

• Do not assume that the legal principles familiar to US lawyers will govern. Most countries have very different laws and regulations as to expectations of privacy, access to computer data, and the removal of certain types of data from the host country.

– Violating these laws and regulations, even unintentionally, could subject companies and their attorneys to various forms of civil and/or criminal liability.


3

I. Overview — Obtaining Information or Documents Abroad

• Some of the most relevant areas to consider are: (1) control and jurisdictional issues in U.S. litigation; (2) privacy and data protection laws in the U.S and abroad; (3) U.S. courts’ approach to addressing conflicts between U.S. discovery obligations and non-U.S. data protection laws, including use of the Hague Convention on the taking of evidence; (4) maintaining privilege; and (5) interviewing witnesses.

• Finally, many of these issues may be affected by organizational structures and data infrastructures that are put in place before any litigation or international investigation begins.


4

II. Control and Jurisdictional Issues in U.S. Litigation

• Information or documents may be sought from a foreign corporation in a U.S. litigation either in a context where the foreign corporation is a party to the litigation, or where the foreign corporation is a non-party.

• Non-Party Discovery. Where a foreign corporation has a U.S. subsidiary, and the U.S. subsidiary is served with non-party discovery requests, the U.S. subsidiary is generally required to obtain documents from its foreign parent or affiliate if the requested information is within the possession, custody or control of the U.S. subsidiary.


5


• Non-Party Discovery (cont.)

– “Control” has been construed broadly by U.S. federal courts to include the legal right, authority, or practical ability to obtain the materials sought upon demand. While “control” is liberally construed, a corporate entity must have the authority, in the ordinary course of business, to obtain documents held by another corporate entity in order to be deemed in “control “ of those documents. The burden is on the party seeking discovery to make a showing that the other party has control over the materials sought. See, e.g., S.E.C. v. Credit Bancorp, Ltd., 194 F.R.D. 469, 471-72 (S.D.N.Y. 2000).

– The issue of control is often highly fact-specific. Courts analyze the relationship of the entity subject to the discovery request and the foreign entity to determine the respondent’s actual ability to command release of the documents by the person or entity in possession.


6


• Non-Party Discovery (cont.)

– For example, in Motorola Credit Corp. v. Uzan, No. 02 Civ. 666(JSR)(FM), 2003 WL 203011 (S.D.N.Y. Jan. 29, 2003), the plaintiffs served a non-party, U.S. subsidiary bank, requesting records of UBS accounts from the parent company in Switzerland. The court refused to compel discovery of the records, holding that the domestic subsidiary of UBS did not have control over records in UBS Switzerland. The request posed comity concerns for Swiss employees who would fact criminal sanctions under Swiss banking laws if they did comply with a motion to compel the account records. The court directed the plaintiff to make the discovery requests directly against UBS Switzerland under the Hague Convention process fully aware that using the Hague process would entail great delay.


7


• Party Discovery. If a foreign corporation is sought to be included as a party to U.S. litigation, the court must determine whether it can establish in personam jurisdiction over the corporation.

– The mere presence of a domestic subsidiary in the United States does not alone establish the minimum contacts sufficient to assert personal jurisdiction over the foreign parent company.

• The forum state will have personal jurisdiction over a foreign parent corporation arising from the domestic subsidiary, however, if the subsidiary is an agent or mere department of the foreign parent.


8


• Party Discovery (cont.)– Although the mere presence of a domestic subsidiary may not be enough

to establish in personam jurisdiction over the foreign parent, in at least one U.S. state, service of process upon the domestic subsidiary may be deemed to have effected service of process on the foreign parent for purposes of establishing the notice requirement for jurisdiction over the foreign parent.

• A recent California case, Yamaha Motor Company, Ltd. v. Superior Court (Connors), 94 Cal. Rptr. 3d 494 (Cal. Ct. App. 2009), holds that, when personal jurisdiction otherwise exists, service of process may be accomplished by service on the domestic subsidiary, thereby establishing the notice requirement for jurisdiction. In Yamaha, the question was whether a Japanese manufacturer can be served under California law simply by serving the Japanese manufacturer’s American subsidiary. The Japanese manufacturer asserted that service of process could only be accomplished by means of the Convention on Service Abroad of Judicial and Extrajudicial Documents in Civil and Commercial Cases (the “Hague Service Convention”).


9


• Party Discovery (cont.)• The Yamaha court held that, under California law, a corporation can be served

by service of process on an agent, which for purposes of service constitutes any representative having “‘ample regular contact’ so that it was ‘reasonably certain’ that the representative would apprise the manufacturer of the service.”

• Under this standard, service of a foreign parent through almost any domestic subsidiary would be sufficient to accomplish service without having to satisfy the more costly and inconvenient requirements of the Hague Service Convention.


10

III. Privacy and Data Protection Laws in the U.S. and Abroad

– Companies and their attorneys must be cognizant of privacy regulations throughout the world when conducting an international investigation or seeking discovery abroad. Many countries have regulations protecting or otherwise prohibiting disclosure or retention of particular documents. It is critical to consider the laws of each specific jurisdiction relating to the processing of personal data prior to collecting or processing any data outside the United States.

– In addition, the concept of U.S.-style discovery is not employed or accepted around the world.

• In many European civil countries disclosure is limited to what is needed for the scope of the trial and, should the other side require information, the burden is on them to identify it. In France, for example, disclosure is supervised by a judge who decides on the relevance and admissibility of evidence.

• In Germany, a litigant generally is not required to disclose documents to the other side but, rather, must only produce those documents that support its case.


11

III. Privacy and Data Protection Laws in the U.S. and Abroad

– This reluctance in many civil law countries to disclose documents is reflected in blocking statutes that prevent the disclosure of certain types of documents to be used in foreign jurisdictions.

– Some countries, such as France, have blocking statutes that criminalize discovery within France by private parties for litigation abroad. Other types of blocking statutes, such as in Switzerland, prohibit specific types of information (such as banking records) from being disclosed to foreign authorities.


12

IV. U.S. Courts’ Approach to Addressing Conflicts Between U.S. Discovery Obligations and Non-U.S. Data Protection Laws

A. Courts in the U.S. regularly order production of documents from parties and non-parties notwithstanding foreign blocking statutes

– U.S. courts have regularly ordered production notwithstanding the existence of foreign blocking statutes after concluding that the statutes would likely not be enforced. See, e.g. Societe Nationale Industrielle Aerospatiale v. United States, 482 U.S. 522, 544 (1987); Accessdata Corp. v. ALLSTE Tech. GMBH, 2010 WL 318477 (D. Utah Jan. 21, 2010) Bodner v. Banque Paribas, 202 F.R.D. 370 (E.D.N.Y. 2000) (denying motion for a protective order against production on the basis that the defendants were not subject to a realistic risk of prosecution in France).

– For U.S. litigants who believe a foreign blocking statute prevents the production of evidence contained abroad, it is imperative to present the court with credible evidence that there is a real risk of prosecution and/or liability.


13

A. Courts in the U.S. regularly order production of documents (cont.)

– The threat of prosecution in some countries has become more apparent in recent years. For example, in 2007, a French lawyer was prosecuted and fined €10,000 for seeking information in violation of the French blocking statute. This was the first conviction under the French blocking statute.

IV. U.S. Courts’ Approach to Addressing Conflicts Between U.S. Discovery Obligations and Non U.S. Data Protection Laws


14

B. Absent personal jurisdiction, the Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters (the “Hague Convention”) provides the exclusive means of collecting evidence from nonparties within signatory countries

C. Federal district courts in the U.S. are inclined to order discovery on foreign parties pursuant to the Federal Rules of Civil Procedure rather than the Hague Convention

– Foreign entities that are parties to U.S. litigation often argue that the litigants should be required to resort to the procedures of the Hague Convention.



15

– When seeking discovery from foreign parties in U.S. district courts, litigants often seek discovery under the Federal Rules of Civil Procedure rather than the Hague Convention, because Hague Convention processes are often less effective and more expensive and time-consuming.

– The Hague Convention provides means to seek both depositions and documents. The Hague Convention creates a standardized procedure for having the court of one country petition the designated central authority of another country requesting assistance from that authority in obtaining evidence located within its borders.

• The Hague Convention can only be used to obtain evidence for use in “judicial proceedings, commenced or contemplated,” and many signatory states do not allow the Convention to be used for purposes of pre-trial discovery.



16

• In addition, a state may ignore or deny a request submitted pursuant to the Hague Convention if it “considers that its sovereignty of security would be prejudiced” if the request were executed, or if the state believes the request imposes on the state’s blocking statutes or privilege laws.



17

D. Practice Considerations

– Compliance with an order issued under the Hague Convention provides a formal basis that may be sufficient for the transfer of personal data.

– Consideration should be given even when production is made pursuant to an order under the Hague Convention to seeking a protective order from the U.S. court to limit access to information produced in response to such an order.

– Furthermore, the 2007 conviction in France for a violation of the French blocking statute warrants considering resorting to the Hague Convention in the first instance for obtaining cross-border discovery, at least from France, to mitigate the risk of claims that a disclosure is in violation of data protection or privacy laws.



18

D. Practice Considerations (cont.)

– Steps that might be taken to reduce the risk that a foreign jurisdiction will refuse the discovery request include:

• Limiting the scope of discovery, by tailoring requests to seek only important materials or admissible evidence.

• Documents should be described as specifically as possible.

• To the extent possible, and with the caveat that Hague requests can often take six months or longer to process, parties should hold off on issuing Hague requests until factual disputes have crystallized, and potentially request the U.S. courts’ certification of the issues at trial.

• Hague requests should include findings by the issuing court that the materials sought are intended for trial, or a ruling identifying the issues for trial under Fed. R. Civ. P. 16 or 26(f).

• Local counsel should be consulted for advice on the types of requests that the local central authority would approve.



19

D. Practice Considerations (cont.)

– Steps that might be taken to reduce the scope of potential data protection issues when undertaking discovery abroad in any litigation include:

• Where possible, anonymization of data before any transfer

• In-country culling or filtering of personal data before any transfer

• A single data transfer to the U.S., rather than establishing continued access by a U.S. entity to data abroad



20

V. Maintaining Privilege

– The context and scope of the attorney-client privilege can vary widely by jurisdiction. Thus, it is important to fully understand the scope of privileges recognized in the foreign jurisdiction prior to conducting work abroad. Consider the following critical issues:

• Does the relevant jurisdiction recognize an attorney-client privilege at all? In some countries, authorities may be able to seize documents without regard to any privilege issues. For example, in Italy, the rules protect privileged documents from being seized from the attorney’s offices, but not necessarily from the client’s offices.

• If such a privilege is recognized, what are its limits? Does it apply to communications from the attorney to the client?


21


• Are communications involving in-house lawyers subject to attorney-client privilege? In some European civil-law countries, there is no privilege afforded to communications between in-house counsel and employees of the corporation. In those cases, in-house counsel are viewed as employees and not independent professionals. Examples include Austria and Italy.

• Does the privilege extend to corporations? Subsidiaries in other countries?

• Are waivers construed broadly? What type of conduct might cause a waiver of the attorney-client privilege? For example, producing materials in response to a foreign government subpoena may waive attorney-client privilege with respect to those documents here in the United States.

• Does the relevant jurisdiction recognize anything akin to the work product privilege?


22


– The rules in relation to privilege vary substantially by EU jurisdiction. Care must be taken to seek advice from local counsel as to the scope of privilege in the jurisdiction concerned and to determine the extent to which documents uncovered in any investigation might become discoverable in later proceedings.


23

VI. Interviewing Witnesses

• It is important to be aware that there may be restrictions that are relevant as to the use of information obtained in the course of conducting witness interviews in foreign countries.

• For example, in Switzerland, if information obtained from a witness is to be provided as part of an investigation to a foreign government, the individuals collecting the information could be deemed to be agents of the foreign government and those individuals could be subject to criminal liability if the information is not collected through official diplomatic channels.

• It is advisable to consult with local counsel prior to interviewing witnesses in any foreign jurisdiction to ensure that you do not run afoul of any local laws.


24

VII. Pre-Litigation Considerations

• Many of the issues we have discussed can be substantially affected by structures and policies in place before any litigation or international investigation occurs.

• Transfers of data once U.S. litigation is foreseeable or existing is unlikely to be successful in shielding data from U.S. discovery, and may even lead to spoliation claims. In In re Global Power Equipment Group, Inc., the court ordered a claimant in the Global Power bankruptcy proceedings to produce documents and personnel for depositions from its French affiliate even though Maasvlakte Energie BV claimed that such discovery would violate the French blocking statute and expose its affiliate to prosecution in France, where the claimant had shipped large amounts of documents from its Rotterdam office to France. No. 06-11045, 2009 WL 3464212 (Bankr. D. Del. Oct. 28, 2009).


25


• The outcome of control, jurisdictional, and data protection determinations may be affected by

– the organization of affiliated companies’ structures and operations, including:

• the legal organization and separation of affiliated entities in different countries,

• the degree of use of shared resources and functions across borders, and

• the characterization and presentation of the affiliated entities in marketing materials and websites; and


26


• The outcome of control, jurisdictional, and data protection determinations may be affected by (cont.)

– the location, structure, and control of data across borders, including:

• the location of documents and information, including the location of servers for electronic data;

• whether all servers for EU data are located within EEA jurisdictions;

• whether, and the extent to which, any U.S. subsidiary has access to, and/or the ability to control, data maintained on servers abroad; and

– employment and other policies in place, such as employment policies that request consent by employees to processing of personal data (though as previously discussed, such consents may not have full effect because some applicable laws provide that consent must be “informed” and the subject must have a real opportunity to withhold or withdraw consent).


27


• Whether the data protection laws of the place where data is stored, if distinct from the place where data is sent from/accessed, will apply, depends on specific jurisdictions and circumstances.

– Germany, for example, provides that its data protection law shall not apply where the data controller is located in another EU/EEA member state and processes data within Germany, unless the controller has a branch in Germany.

– France’s data protection act specifically provides that the act applies to the processing of personal data if the data controller is located on French territory or if the data controller, though not located on French territory or in any other member state of the EU, uses means of processing located on French territory, with the exception of processing used only for the purposes of transit through French territory.


28


• These issues are complicated by technological developments, such as the increasing use of “cloud computing”— services through which an organization can access software operating systems, applications, databases, networking and disaster recovery infrastructure and related services via the Internet or other networks, which can provide significant cost savings.

– Where cloud computing is being considered, it is important to understand where the data exists and is stored, and who has access to it.

• Depending on the configuration of the cloud, data sets may move from one jurisdiction into another within seconds, based on the virtual space available on a server.

– Sometimes the vendor selling the cloud computing service does not actually own or operate the infrastructure that is being offered.


29


– If the cloud is shared with other companies, the service agreement must include provisions relating to data ownership and access, because otherwise data may be mixed and it may be difficult to extract one’s own data separately without affecting the systems of other companies, which may limit the method and timing of extraction.

– Establishing a private cloud resolves some of these issues, but users still may not have direct access to servers and other facilities. Any extraction and processing is likely to be performed by the cloud repository, and will probably be more expensive than access to internally maintained servers.

– Litigation holds may be more difficult to enforce as it is not clear if the controls will be in place in the cloud.


30


– Companies should include EU model contractual provisions with Cloud Computing services that incorporate data controller and data processor data protection obligations, regardless of the location of the Cloud Computing environment, and exert regular control over whether Cloud Computing providers observe data protection requirements, including the processor’s technical and organizational measures to protect the integrity and security of the data. Companies may wish to ensure that data processing occurs only in EU countries, or any jurisdiction deemed to have an adequate level of data protection.