Legal hold and GDPR: is it about preserving evidence or protecting data?

European companies with transatlantic business relationships often risk being involved in pre-trial discovery proceedings. Under US civil law, they must then freeze any information that could be relevant to the legal dispute and retain it until the proceedings conclude — potentially for many years. If this information constitutes personal data under the General Data Protection Regulation (GDPR), a conflict of obligations can theoretically arise. The American civil process requires the data to be transferred to a third country and stored there indefinitely. European data protection law, on the other hand, stipulates that storage periods must be limited and that personal data can only be exported under certain conditions, while also ensuring that data subjects can assert their rights. This raises the question of whether compliance with US evidence preservation requirements can only be achieved by violating European data protection law, and whether adhering to the GDPR would automatically result in a violation of US law. In this article, we shed light on this issue and provide an overview of the most important problems and possible solutions.

Legal holds and their significance in US civil proceedings - a case study

The legal or litigation hold originates from American civil procedure law. Although the concept has existed for some time, it was only definitively characterised in 2005. In the pivotal Zubulake v UBS Warburg case heard by a New York district court, the central issue was the presentation of evidence. Laura Zubulake had sued for discrimination in the workplace, claiming that relevant evidence could be found in the email correspondence of the defendant's employees. Although she was unable to prove that she had been discriminated against, she was able to demonstrate that the emails submitted by the defendant at the evidentiary hearing were incomplete. The defendant had apparently deleted emails after it had become foreseeable that there would be a legal dispute. Bearing this in mind, the court ruled that any party reasonably anticipating pre-trial discovery must suspend its deletion routine and ensure that all relevant information is kept secure and unaltered for potential use as evidence later on.

Data protection aspects of pre-trial discovery: processing personal data in accordance with the GDPR

If a company is involved in a pre-trial discovery and is not caught off guard, it will swiftly identify and separate the relevant data from its operational business. If personal data is involved, these are processing operations under data protection law and the corresponding conditions must be met. If it is an informal request for evidence, i.e. if no court is yet involved, processing will usually only be considered necessary to protect legitimate interests. However, if the request is formal and comes from a court that has requested legal assistance from the Federal Republic of Germany, processing may also be necessary to fulfil a legal obligation. This is because pre-trial discovery can be enforced by way of mutual legal assistance under certain conditions. These conditions include, in particular, the fact that the disclosure request does not violate fundamental principles of German law, and that the other conditions are met.

Transfer of personal data to a third country: Requirements and legal framework according to the GDPR

Transferring data to a third country, such as the USA, is only possible under certain conditions. Accordingly, such transfers require an adequacy decision, suitable guarantees, or an exception. An adequacy decision has now been adopted on the basis of the transatlantic data protection framework. However, data transfer in the context of pre-trial discovery was also possible prior to the issuance of the adequacy decision if a US court made a formal request for legal assistance, or if processing was necessary for the assertion, exercise, or defence of legal claims.

The rights of data subjects in the event of a legal hold include the right to information, the right to a copy and the right to erasure, all of which are in accordance with the GDPR

The German legislator has not restricted the rights of data subjects in the event of a legal hold, for example to protect legal proceedings or enforce civil law claims. Therefore, controllers who process data as part of a legal hold must generally comply with requests for information from data subjects and provide information to those affected by the processing. Data subjects can also request a copy of the processed data and its deletion. However, a request for a copy may be refused if providing one would adversely affect the rights and freedoms of others. Personal data does not have to be erased if processing is necessary for the establishment, exercise or defence of legal claims.

Fulfilling the requirements of pre-trial evidence proceedings: Strategies and measures for companies

Pre-trial evidentiary proceedings, such as US pre-trial discovery and associated legal holds, present significant challenges to companies. Nevertheless, it is possible to meet the requirements of US civil proceedings without violating German or European data protection law. The prerequisite for this is that those responsible have familiarised themselves fully with the requirements and set up a corresponding process. Companies can avoid liability traps by being prepared and capable of acting in an emergency. This can be achieved through targeted identification of relevant information, careful consideration and documentation, anonymisation and gradual transfer of sensitive data, conclusion of a discovery agreement with the other party, or obtaining a corresponding protective order from the competent court.

Receive experienced support with pre-trial discovery and legal holds – secure sound solutions from our law firm!

Are you a European company with transatlantic business relations? If so, you may also be faced with the challenges of pre-trial discovery proceedings. We can support you with all matters relating to legal holds and the GDPR. Our experienced team has extensive knowledge of the requirements of pre-trial evidence proceedings and will support you with customised solutions. We will help you prepare for legal holds optimally and ensure you can act to avoid liability traps. Contact us today to receive advice from our legal experts.