On February 14, 2019, the United States District Court for the Northern District of California ordered a United Kingdom citizen, party to a U.S. litigation, to produce in unredacted form e-mails containing personal information that could be protected under the GDPR.
By way of background. In this patent infringement suit, Plaintiff owned patents involving computer security. The parties filed a joint discovery letter regarding the production of the emails of a UK citizen that directed the sales of Plaintiff’s products and then became Defendant’s director of sales.
Defendant asserted that the production of the U.K. citizen’s emails would violate the General Data Protection Regulation (GDPR), which limits “discovery of personal data to that which is objectively relevant to the issues being litigated.” In addition it requested data to be anonymized or redacted, and – since the anonymization cost may be high – asked Plaintiff to split the cost.
The District Court reasoned that a foreign country’s statute precluding disclosure of evidence does “not deprive an American court of the power to order a party subject to its jurisdiction to produce evidence even though the act of production may violate that statute.”
In addition, it considered the following factors in favor of disclosure: (i) the documents were directly relevant to the infringement at issue; (ii) Plaintiff’s search terms request was specific; (iii) Defendant itself is an American company, subject to American discovery rules; (iv) there was no available alternative to obtain the information sought; and (v) most importantly, there was a strong American interest in protecting American patents while the U.K. interest in protecting the privacy of its citizens was less strong:the GDPR permits discovery of personal data “which is objectively relevant to the issues being litigated.”
Besides, there was in place a protective order allowing Defendant to mark emails as highly confidential.
For the above reasons, the court concluded that those factors weighted heavily in favor of disclosure and ordered production.
More information on Finjan, Inc. v. Zscaler, Inc., 2019 U.S. Dist. LEXIS 24570, is available at https://cases.justia.com…
For more information on how EU data privacy could affect your business: Francesca Giannoni-Crystal and Federica Romanelli