GDPR in United States Litigation Through Summer 2020: GDPR-Subject Companies Must Produce.

• Author: Gladstone, Michael H.
• Position: General data protection regulation

BASED on a review of numerous GDPR discovery cases, in the October 2019 Defense Counsel Journal this author suggested that United States courts may be broadly empathetic to the concerns of GDPR subject litigants obliged to comply with the law where they operate. Since then, however, U.S. courts have examined the terms of the GDPR and questioned claims of the EU's interest in data subject privacy where compelled productions are limited in scope, serve U.S. interests, and are subject to protective order.

Courts have adopted a formulaic pattern of analysis and outcome, modeled on Finjan, Inc. v. Zscaler, Inc., (1) in GDPR discovery cases. This pattern invariably compels United States discovery of GDPR-protected data. This author predicted the adoption of Finjan as a model and noted in February 2020 that the Mercedes emissions litigation had adopted the Finjanmodel. This Article provides a more detailed look at the Mercedes decisions and an update on other recent GDPR decisions applying the Finjan model to compel discovery of GDPR-protected data from GDPR-subject companies in U.S. litigation.

1. The Mercedes Opinions

   The Mercedes opinions implementing the Finjan model begin with In re Mercedes-Benz Emissions Litig., (2) decided by a Special Master on November 4, 2019. A second decision in January 2020 (3) affirmed the Special Master's ruling. In the 2019 ruling, the Special Master had to choose between the parties' competing orders over a disagreement concerning document redaction. Each party offered their view of the role of GDPR on the question. (4) The dispute arose from defendant EU companies' resistance to plaintiff's discovery seeking the identity of EU data subjects and their employment and contact information in a matter alleging RICO violations and consumer fraud. (5)

   Relying on the broad definition of "personal data" in the GDPR, the defendants asserted their right to redact all personal data from otherwise relevant documents from EU sources, and sought to defer consideration of their anticipated redactions until after defendants' initial, redacted production. (6)

   Defendants offered no proof, however, that their production of the information sought would lead to hardship or enforcement action by an EU GDPR supervisory authority or an authority demonstrating an EU propensity to prosecute civil litigation-connected GDPR data transfers. (7)

   Plaintiffs conceded defendants' right to redact objectively irrelevant and intimate, private, personal information concerning the EU data subjects, and pointed to the benign character of the data they sought--identity, employment, and business contact information routinely produced in U.S. litigation --in opposition to defendants' position. (8) Plaintiffs also pointed to an existing "Confidentiality Order" which contained a "Highly Confidential" category as providing adequate protection to the EU data subjects' privacy concerns. (9)

   The Special Master analyzed the dispute following an analysis now familiar in United States cases addressing the role of GDPR in discovery disputes. Citing Societe Nationale Industrielle Aerospatiale v. United States Dist. Court for the S. Dist. of Iowa, (10) the Special Master noted that foreign law precluding disclosure of evidence does not deprive U.S. courts of the power to order parties subject to their jurisdiction to produce evidence, even though the act may violate the foreign law. (11) Next, he cited AstraZeneca LP v. Breath Ltd. (12) for the proposition that U.S. courts "employ a multi-factor balancing test" provided in the Restatement (Third) of Foreign Relations Law Section 442(1)(c) to evaluate the interests of the U.S. and the party seeking discovery against the foreign state's interest in "secrecy." (13)

   The Special Master then reviewed each of the five factors articulated in AstraZeneca. As to Factor I--the importance of the documents to the litigation--he found the documents directly relevant. (14) Knowledge of the Defendants' employees and their positions was essential to determining the correct document custodians. (15) Factor I favored production. As to Factor II--the degree of specificity of the requests--he found the request satisfactorily specific, particularly as limited by the concession for redaction of irrelevant and intimately personal information. (16) Factor II favored production. Concerning Factor III--whether the information originated in the U.S.--the Special Master assumed the majority of the documents subject to the GDPR originated in the EU. (17) Factor III weighed against production. (18) As to Factor IV--the availability of alternative means of securing the information sought--he noted Defendants' failure to suggest any alternative source, and found such did not exist, thereby favoring production. (19)

   Concerning Factor V, the Special Master cited Finjan (20) and Richmark Corp. v. Timber Falling Consultants (21) for his duty to assess the interests of each nation in requiring or prohibiting disclosure and whether disclosure would affect important substantive policies or interests. (22) Noting other countries' awareness of broad U.S. discovery, and their recognition that the final decision concerning evidence used in U.S. courts must be made by those courts, (23) and noting the U.S.'s significant interest in maintaining its discovery processes, the Special Master emphasized the U.S.'s interest in its discovery processes and in protecting its citizens under RICO claims and from consumer fraud. (24) Together, these points supported his conclusion that the Confidentiality Order provisions allowing protected production of the limited data sought adequately balanced the EU's interest in protecting its subjects' private data. (25) The court cited Finjan for the proposition that U.S. protective orders preventing further disclosure of private data "diminish" the weight of the EU's foreign privacy interest.

   Dissatisfied with the...