E-Discovery the EU Data Protection Authorities approach

Größe: px

Ab Seite anzeigen:

Download "E-Discovery the EU Data Protection Authorities approach"

Ralf Kappel
vor 8 Jahren
Abrufe

1 E-Discovery the EU Data Protection Authorities approach Breakout Session Mind the Gap: Bridging U.S. Cross-border E-discovery and EU Data Protection Obligations Dr. Alexander Dix, LL.M. Berlin Commissioner for Data Protection and Freedom of Information IAPP Europe Data Protection Congress Brussels Alexander Dix 1

2 Overview Focus on transatlantic civil law suits Dialogue between Sedona and Art. 29 WP The latest response from Europe Draft General Data Protection Regulation any new ideas on transnational discovery? Alexander Dix 2

3 Focus on transatlantic civil law suits Discovery requests by LEAs (e.g. DoJ) and administrative bodies (SEC) covered by mutual legal assistance treaties (e.g. EU-US) Procedures of MLA-treaties should be observed, no direct requests to controllers in the EU Focus here: transatlantic pre-trial discovery in civil law suits Alexander Dix 3

4 Dialogue between The Sedona Conference and Art. 29 Working Party The Sedona Conference (TSC) Framework for Analysis of Cross-Border Discovery Conflicts (2008) Art. 29 Working Party WP 158 on pre-trial dicovery for cross-border civil litigation (2009) wp158_en.pdf TSC International Principles on Discovery, Disclosure and Data Protection (2011) Alexander Dix 4

(2008) Art. 29 Working Party WP 158 on pre-trial dicovery for cross-border civil litigation (2009) http://ec.

5 The latest response from Europe Art. 29 Working Party has welcomed the International Principles, especially their emphasis on - necessity, proportionality and a phased approach to discovery (Principle 3), - the need to minimize the disclosure of personal data (Principle 3), - encouraging organizations to implement privacy by design (Principle 6) Alexander Dix 5

necessity, proportionality and a phased approach to discovery (Principle 3), - the need to

6 Quotes from the TSC International Principles Highlighting the importance of a restrictive data retention policy in vow of the fact that many organizations worldwide have become data hoarders Pointing to serious legal risks which may arise from the over-retention of information Alexander Dix 6

organizations worldwide have become data hoarders Pointing to serious legal

7 Remaining issues Independence of EU DPAs (COM./. Germany, Austria) and the US courts International Principles without binding effect HR and customer data Telecommunications secrecy Alexander Dix 7

Principles without binding effect HR and customer

8 Cloud Computing Discovery in the Cloud (p. v TSC Principles) Cf. Sopot-Memorandum of the International Working Group on Data Protection in Telecommunications ( Berlin Group ) Alexander Dix 8

Berlin Group ) 2012 www.datenschutz-berlin.

9 EU Draft General Data Protection Regulation Leaked version v contained restrictive rule on discovery (Art. 42) Apparently deleted at the request of US Government Patriot Act-issue is addressed in recital 90 of the current draft (public interest) Legal situation would remain unchanged should the Draft become law (cf. Art. 44 Abs. 1 e) of the Draft Regulation and Art. 26 Abs. 1 d) of Directive 95/46) Alexander Dix 9

42) Apparently deleted at the request of US Government Patriot Act-issue is addressed in recital 90 of the

10 Summing up (1) Despite basic differences between legal cultures on both sides of the Atlantic practical ways and means to bridge the gap between European data protection law and US discovery are available European companies should make use of all possibilities of US procedural law to comply with their obligations under EU data protection law Restrictive retention policies are key Alexander Dix 10

available European companies should make use of all possibilities of US procedural law to comply with

11 Summing up (2) Get the company s Data Protection Officer involved as early as possible Point to restrictions under Data Protection Laws as early as possible (even prior to the meet and confer stage) Highlight the risk of criminal prosecution when processing data falling under telecommunications secrecy or patients confidentiality Phased culling in the country of origin Check the requirements for exporting data to third countries Apply for a protective court order Alexander Dix 11

when processing data falling under telecommunications secrecy or patients confidentiality Phased culling in the country of

12 Thank you any questions? Alexander Dix 12

Ähnliche Dokumente

Big Data Analytics. Fifth Munich Data Protection Day, March 23, Dr. Stefan Krätschmer, Data Privacy Officer, Europe, IBM

Big Data Analytics. Fifth Munich Data Protection Day, March 23, Dr. Stefan Krätschmer, Data Privacy Officer, Europe, IBM Big Data Analytics Fifth Munich Data Protection Day, March 23, 2017 C Dr. Stefan Krätschmer, Data Privacy Officer, Europe, IBM Big Data Use Cases Customer focused - Targeted advertising / banners - Analysis