Sedona Conference issues principles for addressing the preservation and discovery of protected data in U.S. litigation

Multinational companies based in the United States (or with significant operations in the United States) may be subject both to the civil procedure discovery rules of the United States as well as the privacy laws of the European Union and other countries in which they operate. Complying with these potentially conflicting bodies of law may pose difficult challenges for such companies.

Recently, Working Group 6 of the Sedona Conference issued a draft document aimed at addressing this conflict—“International Principles on Discovery, Disclosure & Data Protection: Best Practices, Recommendations & Principles for Addressing the Preservation and Discovery of Protected Data in U.S. Litigation.”

The International Principles are the product of nearly six years of work involving representatives from the legal profession, judges, privacy and compliance leaders, academics and discovery service vendors from around the globe who met in Bermuda, England, Portugal, Spain and the United States in an effort to reconcile (to the extent possible) conflicting notions of data privacy and norms for disclosure in litigation. Working Group 6 previously issued a “Framework for Analysis of Cross-Border Discovery Conflicts” (2008) and an “International Overview of Discovery, Data Privacy & Disclosure Requirements” (2009), as well as a host of related papers published in the Sedona Conference Journal. In October 2009, moreover, Working Group 6 provided a detailed response to the Article 29 Data Protection Working Party’s “Working Document 1/2009 on pretrial discovery for cross border civil litigation.”

The new International Principles identify six essential principles for reconciliation of the potential conflict between privacy and disclosure in the context of U.S. litigation: 1. “Due respect” for data protection; 2. “Good faith and reasonableness” in evaluating actions; 3. Limits on the scope of preservation and disclosure to what is “relevant and necessary;” 4. Optional use of a stipulation or court order to protect data; 5. The obligation to adopt “appropriate data protection safeguards;” and 6. Retention of data “only as long as necessary to satisfy legal or business needs.” In addition, the principles offer a model Protective Order and a “Transfer Protocol” (identifying important issues to consider in implementing data transfers in the context of disclosure for litigation).

The International Principles are subtitled “European Union Edition.” Working Group 6 plans to issue additional versions of the principles to address data protection concerns in other regions of the world. The principles, moreover, are labeled “draft,” with the expectation that interested parties and groups will provide comments for inclusion in revised versions. Comments may be submitted via the Sedona Conference website or by e-mail at info@thesedonaconference.org.

Working Group 6 will meet in Toronto in June 2012 to discuss comments on the principles and plans for the Working Group’s further activities.