Electronic Data Records Law | How to Win E-Discovery

Employee ESI: Private?

Internal Investigations under Data Protection Legislation

Many countries have data privacy laws limiting the disclosure of personal information their citizens. Although the laws are far from uniform around the world, the European Data Protection Directive (95/46/EC) is a leading guide.

These laws motivate (multinational) corporations to configure controls into email (as well as webmail and text-instant-message) record retention systems.

The European Data Directive generally instructs European countries to enact local privacy legislation to regulate personal information. The legislation can apply to e-mail and other electronically stored information (ESI).  As a practical matter, the details on implementation and enforcement of local (non-US) privacy laws with respect to e-mail is a very complex topic.  Some local laws can frustrate internal corporate investigations that might appear, to US-based managers for example, as routine and responsible.  They can cause emails to be withheld from investigators.

One instance: In 2001 French courts held that a foreign-headquartered company violated the privacy rights of a French engineer when it inspected his e-mail records, stored on company computers.  The records revealed he was wrongfully moonlighting on company time.  Doreen Carvajal, “The Workplace: When bosses spy on workers,” International Herald Tribune, April 21, 2004 .

As corporations install appliances to store e-mail archives, they should consider whether to implement controls for compliance with local privacy statutes.  The controls might include

1. written policies calling for compliance with local law;

2. technical blocks to prevent unauthorized people or departments from accessing specific records, while granting access to those who have been authorized; and

3. alerts and audit trails to enable after-the-fact review of who accessed which records and when.

--Benjamin Wright

Mr. Wright is a consultant to Messaging Architects, develper of sound process for electronic mail record-keeping and investigation.

Cross-Border eDisclosure

Blocking Statutes and International E-Discovery

Numerous non-US jurisdictions (especially in Europe) have enacted so-called blocking statutes to restrict the export of important business records. Much of the motivation for these statutes is to prevent compliance with discovery demands in US litigation. These statutes give corporations incentive to design cross-border controls into e-mail archival systems.

Example Statutes

Examples of blocking statutes include the following:

• France has one of the broadest statutes, Law No . 80 - 538 of July 16, 1980, Journal Officiel de la Republique Francaise, July 17, 1980, p. 1799. It generally forbids French persons from disclosing to foreign governments (such as courts) documents that are important to the sovereignty, security or fundamental economic interests of France. French courts recently fined a French lawyer €10,000 for attempting to obtain records in connection with a lawsuit in the US.
• Ontario’s Business Records Protection Act, R.S.O. 1990, c. B.19, generally restricts divulgence of sensitive corporate financial records to foreign governments.

 

• The Netherlands Economic Competition Act of June 28, 1956 (amended by Act of Nov. 14, 1958, Art. 39), generally bans compliance with foreign government measures (such as lawsuits seeking documents) to regulate competition.
• United Kingdom's (UK) Protection of Trading Interests Act 1980 c 11 generally enables or requires British government to frustrate efforts by foreign governments to discover certain important business documents.
• Malaysia's blocking statute is addressed in Gucci Amer., Inc. v. Curveal Fashion, 2010 WL 808639 (S.D.N.Y. Mar. 8, 2010).

Implications for Archives Email

As corporations install appliances to archive e-mail, they can evaluate whether to implement controls for compliance with local blocking statutes.  As a practical matter, the controls might focus on managing efforts to retrieve large quantities of records (litigation e-discovery) rather than just a few records at a time (ordinary course of business).

The controls might include: 

1. written policies to forbid violation of local law;

2. technical blocks to prevent unauthorized people or departments from accessing particular records, while granting access to those who have been authorized; and

3. alerts and audit trails to enable after-the-fact review of who accessed which records and when.

--Benjamin Wright

Mr. Wright teaches computer records management and investigation law at the SANS Institute.