Early Pattern Emerges for Federal Consideration of GDPR-based Objections to Discovery

A Series By: Michael H. Gladstone, Esq. Bio IconMike's Bio

GDPR LogoIn Finjan, Inc. v. Zscaler, Inc., 2019 U.S. Dist. LEXIS 24570 the USDC for the Northern District of California addressed an objection by Defendant to discovery propounded by Plaintiff seeking emails possessed by one of defendant’s European employees.  The objection argued the employee’s emails may not be produced without violating privacy requirements contained in the GDPR, which became effective in May, 2018.  The Court approached the dispute methodically and provided what this author predicted may be a model for future analysis of discovery objections under the GDPR by U.S. Courts of such disputes. 

[Are You Within the Reach of the GDPR?]

The Court first announced the general rule that “…a foreign country’s statute precluding disclosure of evidence does “not deprive an American court of the power to order a party subject to its jurisdiction to produce evidence even though the act of production may violate that statute.”  Societe Nationale Industreille Aerospatiale v. United States Dist. Court for Southern Dist., 482 U.S. 522, 544 n. 29, 107 S. Ct. 2542, 96 L Ed. 2d 461 (1987).  The Court then identified the considerations pertinent to the question whether or not a foreign statute excuses non-compliance with a U.S. discovery order:  1. The importance of the documents or other information requested to the litigation, 2. The degree of specificity of the request, 3. Whether the information originated in the United States, 4. The availability of alternative means of securing the information, and 5. The extent to which noncompliance would undermine important interests of the United States.  Richmark Corp. v. Timber Falling Consultants, 959 F. 2d 1468, 1475 (9th Cir. 1992). 

The Court addressed the factors individually. 

Consideration No. 1: The importance of the documents or other information requested to the litigation. The court concluded the documents were directly relevant to the infringement issue and the data subject’s knowledge of the patented technology at issue.  As such, this consideration weighed in favor of disclosure. 

Litigation Participants Subject to GDPR Must Justify their Use of Protected Data

Consideration No. 2: The degree of specificity of the request. The court found the requesting party adequately limited its request to specific patents and parties directly pertinent to the litigation.  So limited, the requests were specific and not overbroad.  This factor was found to weigh in favor of disclosure. 

Consideration No. 3: Whether the information originated in the United States. The Court noted that the employee’s employer- Zscaler Inc.- was an American Company, subject to American discovery law.  This weighed somewhat in favor of disclosure, though the employee was located in the UK. 

Consideration No. 4: The availability of alternative means of securing the information. The Court found there was not a ‘substantially equivalent’ substitute or alternative source for the information.  The absence an alternative source of the information weighed in favor of disclosure. 

Consideration No. 5: The extent to which noncompliance would undermine important interests of the United States. Labeled by the Court as “most important factor”, the court followed Richmark by addressing whether disclosure would affect important substantive policies or interests between the countries.  Two factors persuaded the Court the disclosure would not affect important substantive policies or interests of the U.S. and the UK: [1] The constitutional dignity of U.S. patent law, and the U.S.’ interest in ensuring U.S. patent disputes are fully and fairly litigated.  [2] The existence of a protective order prohibiting disclosure of secret information.  The requesting party’s offer to treat the discovery results as “highly confidential” under the existing protective order diminished the offense of disclosure to the UK’s privacy interests.  The Court also noted defendant’s concession that the GDPR permits “discovery of personal data to that which is objectively relevant to the issues being litigated”.  2019 U.S. Dist. LEXIS 24570, 9.  The Court concluded the significant American interest in protecting its patents outweighed the “reduced” U.K. interest in protecting the privacy rights of its citizens.   Consideration 5 weighed “heavily” in favor of disclosure.  Id at 10. 

Lastly, the Court considered the burden of disclosure on the defendant and concluded it did not weigh against disclosure.  Noting the burden of proof on one asserting foreign law bars production, the Court stated it was not clear the GDPR would have barred production of the requested emails, and further, defendant failed to show the U.K. enforced the GDPR. 

Another Application of this Methodical Approach

This methodical approach to evaluating objections posed to U.S. discovery was followed in In Re Mercedes-Benz Emissions Litig. 2019 U.S. Dist. LEXIS 223132, involving a dispute over treatment of GDPR regulated personal information sought by plaintiffs from Mercedes and Daimler.  The special master considering the dispute began his analysis by observing the wide breadth of personal data deemed protected by the GDPR, and contrasted the regular production in U.S. discovery of much data off-limits under the GDPR.  Relying in part on Finjan, Inc., and cases cited there, the special master then considered the 5 Richmark factors individually and concluded the disclosure should occur, essentially as requested by the plaintiff.  The special master cited Finjan, Inc. for the proposition a protective order diminishes the foreign state’s concern over the citizen’s private data involved in the requested production.  The special master also observed that there was no evidence of EU enforcement of its penalty provisions against companies ordered to produce protected data in the litigation context.  The special master’s ruling was affirmed by the U.S. District Court for the District of New Jersey, in In re Mercedes-Benz Emissions Litig.,  2020 U.S. Dist. LEXIS 15967.

Read Mike's earlier articles following the implementation of GDPR and it's legal impact on U.S. businesses:

GDPR Effective Date Imminent. Is Your Business Ready?

An Approach for U.S. Companies to the GDPR

GDPR Issues in U.S. and International Litigation and Arbitration

Thumbnail_Mike GladstoneMike has broad litigation experience including matters involving personal injury and property damage, insurance and coverage, commercial matters, trucking, professional liability, product liability, immigration/removal, and worksite enforcement. He has successfully defended design professionals in construction defect matters. His product liability experience includes a focus on industrial machinery, warnings and labels, product development and introduction, and associated commercial issues. He obtained the first post-Kumho Tire exclusion of an Accident Reconstruction Expert in a trucking matter.  Mike has successfully defended and asserted trade secret claims in State and Federal Courts.