Discovery Case

CNIL has found that a growing number of motions are being filed, requiring the disclosure of personal data held, among other, by French subsidiaries of US corporations subject to pre-trial discovery procedures in US litigation cases. It has become frequent to see companies or their foreign subsidiaries forced to turn over copies of the full contents of the hard disks or e-mail boxes of some employees, or even the entire personnel.

Furthermore, though in a different legal context, a number of US authorities, such as the Securities and Exchange Commission (SEC) or Federal Trade Commission (FTC), may also issue information injunctions demanding that foreign companies produce documents or evidence, by virtue of their respective powers of investigations.

Information injunctions may concern French companies who are subsidiaries of US corporations listed on the US market, or French-law companies operating in the US.

Numerous challenges to the French data protection act

Such disclosure requirements breach the French legal provisions on data protection, and more specifically those applicable to the information and consent of individuals, to the proportionality of the data processing involved and to the conditions of data transfers outside the EU.

In addition, these situations give rise to difficulties falling within remits other than just the Data Protection Act, related among other to international judicial cooperation, protection of domestic economic interests, industrial and commercial secrecy, or even to national sovereignty.

Existing procedures to protect the interests of French companies

In pursuance of the 1970 Hague Convention, any information injunction issued by US judiciary or administrative authorities, must be subject to a request for international judicial cooperation filed with the relevant department at the Ministry of Justice. After investigation, the request may be either rejected or transferred to the jurisdiction having geographic competence over its enforcement.

The French Law of 26 July 1968 on the disclosure of documents and information of an economic nature prohibits, unless otherwise provided under international covenants, any person from requesting or disclosing any documents or information of an economic, commercial, industrial, financial or technical nature likely to be used to compile evidence intended for use in legal or administrative proceedings or arising from them. Hence, such requests from foreign administrative authorities may be legally allowed only if covered under an international agreement or treaty.

Thus a Mutual Assistance Agreement was signed between the French “Commission des Opérations de Bourse (COB), now called “Autorité des Marchés Financiers” (AMF), and the US Securities Exchange Commission (SEC). French companies requested by the SEC to disclose information must file a prior information request to the AMF in order to protect themselves from any subsequent risk of criminal prosecution.

Judge at the Cour de Cassation,
CNIL Commissioner in charge of Commerce sector

Why did CNIL create a working committee on this subject? And how does it operate?

CNIL was contacted by French companies and law firms requesting its advice on a binding legal framework relative to the disclosure of information to foreign judiciary or administrative authorities. Such requests made by foreign administrations as well as by parent companies to their subsidiaries or even to their trade partners, raise multiple legal issues, linked to business secrecy, patent protection, international judicial cooperation, business intelligence and to many other realms that do not necessarily lie under CNIL's scope of competence.

Conversely, CNIL has a direct vested interest in the conditions under which personal data are transferred. What about information and consent of employees, clients or prospects, and lawyers involved? What of the conditions of data transfers outside the EU? And first and foremost, what about the proportionality of the data processing?

This is an extremely delicate issue since it is often difficult for a subsidiary to reject or even simply object to a request from its parent company or from an administrative authority, particularly in the United States where legislation and case law grant considerable powers to public administrations or to the judges in charge of assessing the legitimacy of pre-trial discovery motions filed by a litigant.

Together with my colleagues Georges de la Loyère and Philippe Nogrix and with CNIL departments, we decided to conduct hearings of all stakeholders: public authorities, lawyers, enterprises, etc. These broad exchanges of views will fuel our investigations in the perspective of arriving at recommendations in an area which, it should be emphasized without any exaggeration, involves substantial challenges linked to both an “economic war” and a “war between legal cultures”, opposing the Roman-Germanic and the Anglo-Saxon sides.

What are your goals?

We have a dual goal. Firstly it is necessary to issue a reminder on the obligation to comply with the legal framework as provided by our data protection law or by international conventions, a mandatory requirement for injunctions issued by foreign authorities to be legally allowed and binding, an obligation of which many companies are not aware. In addition, we must contribute to the issue on an EU level in order to adopt a common policy. This is why our own national investigations at CNIL will fit into a European-scale continuum, fuelling the work initiated by the European DPAs within the G29 Working Party. Backed by the respective analyses of national laws in EU Member States, the G29 will work in consultation with the European Commission and other EU institutions to initiate negotiations with the US, among others, on the subject.