Originally from Handbook on International Commercial Arbitration - Second Edition

Preview Page

Data protection and document production are not happy bedfellows; document production is the disclosure of data, at least in part, under compulsion whereas data protection is intended to prevent such disclosure. The underlying legal principles of both are often in conflict in the context of international commercial arbitration involving, in particular, the U.S. and in the Member States of the European Union. In this regard, neither the disclosure nor discovery rules of the U.S. and European courts have been harmonised with data protection laws. This often places in a dilemma companies that are doing business in the U.S., especially European companies doing business in the U.S. or that have their parent company, a subsidiary, or an affiliate in the U.S. because they are forced to either comply with compulsory discovery / disclosure obligations or protect their employee’s and customer’s data.

The problem is not so acute for discovery given by U.S. companies as the U.S. does not have comprehensive data protection legislation. Although a signatory to the 1981 OECD Guidelines, the U.S. has not implemented them domestically. Instead, a sectoral approach, with a mix of legislation, regulation and self-regulation, is utilised. The introduction of European Data Protection Directive 95/46/EC could have therefore restricted the ability of U.S. organisations to engage in transactions with their European counterparts, for the Directive prohibited the transfer of personal data to non EU states that do not meet the “adequacy” standard for the protection of privacy.

As a result of this, the U.S. Department of Commerce developed the “safe harbour” system in consultation with the European Commission. This offers a method by which U.S. organisation can comply with the Directive. The EU approved “safe harbour” in July 2000. Organisations that sign up to the scheme are certified as offering “adequate“ protection under the terms of the Directive, thus enabling transactions between those organisations and European organisations to proceed smoothly and within the law.

The U.S. Department of Commerce Safe Harbour website provides

The decision by U.S. organizations to enter the U.S.-EU Safe Harbor program is entirely voluntary. Organizations that decide :