Download Article 2 Definitions – Processing of Personal Data

INTERNATIONAL E-DISCOVERY:
WHEN CULTURES COLLIDE
Alvin F. Lindsay
Hogan & Hartson LLP
1938
Federal Rules
1934
Hickman v. Taylor
1970
Rule 34 Amendment
2003
2006
Zubilake v. UBS
ESI Amendments
“Everyone has the right to
respect for his private and
family life, his home and his
correspondence”
Article 8, European Convention for the Protection
of Human Rights and Fundamental
Freedoms,1950
EU Data Protection Directive
95/46/EC
EU Data Protection Directive 95/46/EC
Article 1
Object of the Directive
“Member States shall protect
the fundamental rights and
freedoms of natural persons,
and in particular their right to
privacy with respect to the
processing of personal data.”
EU Data Protection Directive 95/46/EC
Article 2
Definitions – Personal Data
“[A]ny information relating to
an identified or identifiable
natural person (“data subject”);
an identifiable person is one
who can be identified, directly
or indirectly . . . .”
EU Data Protection Directive 95/46/EC
Article 2
Definitions – Processing
of Personal Data
“ any operation or set of operations
which is performed upon personal
data, whether or not by automatic
means, such as collection, recording,
organization, storage, adaptation or
alteration, retrieval, consultation,
use, disclosure by transmission,
dissemination or otherwise making
available, alignment or combination,
blocking, erasure or destruction”
EU Data Protection Directive 95/46/EC
Article 2
Definitions – Controller
“the natural or legal person, . . .
or any other body which alone or
jointly with others determines the
purposes and means of the
processing of personal data”
EU Data Protection Directive 95/46/EC
Article 2
Definitions – Processing
“ any operation or set of operations
which is performed upon personal
data, whether or not by automatic
means, such as collection, recording,
organization, storage, adaptation or
alteration, retrieval, consultation, use,
disclosure by transmission,
dissemination or otherwise making
available, alignment or combination,
blocking, erasure or destruction”
EU Data Protection Directive 95/46/EC
Article 7
Criteria for Legitimate
Data Processing
•
the data subject has unambiguously
given his consent; or
•
processing is necessary for the
performance of a contract to which
the data subject is party or in order to
take steps at the request of the data
subject prior to entering into a
contract; or
•
processing is necessary for
compliance with a legal obligation to
which the controller is subject; or
EU Data Protection Directive 95/46/EC
Article 7
Criteria for Legitimate
Data Processing
•
processing is necessary in order to
protect the vital interests of the data
subject; or
•
processing is necessary for the
performance of a task carried out in
the public interest or in the exercise of
official authority vested in the
controller or in a third party to whom
the data are disclosed; or
EU Data Protection Directive 95/46/EC
Article 7
Criteria for Legitimate
Data Processing
•
processing is necessary for the
purposes of the legitimate interests
pursued by the controller or by the
third party or parties to whom the data
are disclosed, except where such
interests are overridden by the
interests for fundamental rights and
freedoms of the data subject which
require protection under Article 1 (1).
EU Data Protection Directive 95/46/EC
Article 18
Obligation to Notify the
Supervisory Authority
“[T]he controller or his
representative, if any, must
notify the supervisory authority
referred to in Article 28 before
carrying out any wholly or partly
automatic processing operation
. . . .”
French Blocking Statute, Penal
Code Law No. 80-538
“[I]t is prohibited for any party to
request, seek or disclose, in
writing, orally or otherwise,
economic, commercial, industrial,
financial or technical documents
or information leading to the
constitution of evidence with a
view to foreign judicial or
administrative proceedings or
in connection therewith.”
Societe Nationale Industrielle Aerospatiale v.
United States District Court for the Southern
District of Iowa, 482 U.S. 522, at 544 n.29 (1987)
The French blocking
statute did not “deprive an
American court of the
power to order a party
subject to its jurisdiction
to produce evidence even
though the act of
production may violate
that statute.”
EU Data Protection Directive 95/46/EC
Article 25
Transfer to Third
Countries
“[T]he transfer to a third country
of personal data . . . may take
place only if . . . the third
country in question ensures an
adequate level of protection.”
EU Data Protection Directive 95/46/EC
Article 26
Derogations To Transfer
-
Consent of data subject;
-
Necessary for performance of
contract with data subject;
-
Legally required on important
public interest grounds or for
the establishment, exercise or
defense of legal claims;
-
To protect vital interests of data
subject.
Navigating the
Cross-Border
Conflict
• Approach with caution
• Limit scope – pseudonymize - anonymize
• Educate the opposing counsel and court
• Coordinate with local EU counsel & Safe Harbor
vendor
• Confidentiality agreement / protective order
• Advance best arguments and comply with spirit
Technology In Litigation.com