February 25, 2009

Cross-Border eDisclosure

Blocking Statutes and International E-Discovery

Numerous non-US jurisdictions (especially in Europe) have enacted so-called blocking statutes to restrict the export of important business records. Much of the motivation for these statutes is to prevent compliance with discovery demands in US litigation. These statutes give corporations incentive to design cross-border controls into e-mail archival systems.

Example Statutes

Examples of blocking statutes include the following:

  • France has one of the broadest statutes, Law No . 80 - 538 of July 16, 1980, Journal Officiel de la Republique Francaise, July 17, 1980, p. 1799. It generally forbids French persons from disclosing to foreign governments (such as courts) documents that are important to the sovereignty, security or fundamental economic interests of France. French courts recently fined a French lawyer €10,000 for attempting to obtain records in connection with a lawsuit in the US.
  • Ontario’s Business Records Protection Act, R.S.O. 1990, c. B.19, generally restricts divulgence of sensitive corporate financial records to foreign governments.

Stop

 

  • The Netherlands Economic Competition Act of June 28, 1956 (amended by Act of Nov. 14, 1958, Art. 39), generally bans compliance with foreign government measures (such as lawsuits seeking documents) to regulate competition.
  • United Kingdom's (UK) Protection of Trading Interests Act 1980 c 11 generally enables or requires British government to frustrate efforts by foreign governments to discover certain important business documents.
  • Malaysia's blocking statute is addressed in Gucci Amer., Inc. v. Curveal Fashion, 2010 WL 808639 (S.D.N.Y. Mar. 8, 2010).

Implications for Archives Email

As corporations install appliances to archive e-mail, they can evaluate whether to implement controls for compliance with local blocking statutes.  As a practical matter, the controls might focus on managing efforts to retrieve large quantities of records (litigation e-discovery) rather than just a few records at a time (ordinary course of business).

The controls might include: 

1. written policies to forbid violation of local law;

2. technical blocks to prevent unauthorized people or departments from accessing particular records, while granting access to those who have been authorized; and

3. alerts and audit trails to enable after-the-fact review of who accessed which records and when.

--Benjamin Wright

Mr. Wright teaches computer records management and investigation law at the SANS Institute.

Feb 25, 2009 12:53:30 PM | authorize, business archives, compliance audit, electronic records law, French, internal control, international, non-US

The comments to this entry are closed.

NEXT POST
Network Backup as E-mail Repository Expensive E-Discovery (EDD) for an Enterprise IT network backup can store many e-mails that are relevant and discoverable in a lawsuit. But to search for e-mail by way of network backup is very inefficient. Sometimes, courts do order organizations to go into backup to retrieve computer records - to the vexation of the IT department. The risk that such an order might someday come is one reason for an enterprise to keep plentiful e-mail archives in a system specifically designed for storage and search of large volumes of records. This risk applies to lawsuits both in the US and elsewhere. A case in point is the Australian decision BT (Australasia) v State of New South Wales & Telstra, [1998] FCA 363 (9 April 1998). In a commercial dispute between telecommunications carriers, the plaintiff demanded e-mail records from defendant Telstra. Telstra’s records of many of these e-mails were available only in network backup. The court ordered Telstra to search backup tapes, at considerable expense, to retrieve certain e-mails. Telstra did not have to design its e-mail...
PREVIOUS POST
Employee ESI: Private? Internal Investigations under Data Protection Legislation Many countries have data privacy laws limiting the disclosure of personal information their citizens. Although the laws are far from uniform around the world, the European Data Protection Directive (95/46/EC) is a leading guide. These laws motivate (multinational) corporations to configure controls into email (as well as webmail and text-instant-message) record retention systems. The European Data Directive generally instructs European countries to enact local privacy legislation to regulate personal information. The legislation can apply to e-mail and other electronically stored information (ESI). As a practical matter, the details on implementation and enforcement of local (non-US) privacy laws with respect to e-mail is a very complex topic. Some local laws can frustrate internal corporate investigations that might appear, to US-based managers for example, as routine and responsible. They can cause emails to be withheld from investigators. One instance: In 2001 French courts held that a foreign-headquartered company violated the privacy rights of a French engineer when it inspected his e-mail records, stored on company computers. The records revealed he was...

Benjamin Wright

Attorney Benjamin Wright helps others navigate the law of technology.

The Typepad Team

Search

Become a Fan

My Other Accounts

Recent Comments