The CNIL has issued a press release on disclosure of information to US authorities and courts. This stems from an increase in the number of requests for disclosure of information received by French and European companies in connection to US legal proceedings. The requests for disclosure of documents generally consist of orders to disclose copies of employees' hard disks or copies of e-mails to US recipients.
The CNIL distinguishes between four types of situations.
- "Litigation hold" / "litigation freeze"
This practice, which is becoming increasingly common, involves collecting and retaining documents in the US where it is foreseeable that an action may be initiated on a specific subject."
- Pre-trial discovery"
In contrast to French civil procedure rules, US rules (derived from their adversarial system) encourage parties to exchange as much information as possible before the trial ("pre-trial discovery"). A party has a right to demand the disclosure of all the documents listed in the order. This includes the right to examine these documents and receive a copy of the documentation. This has fostered the development of specialised software tools designed to help companies comply with orders within the time-limit specified in
the order (usually a month). The phrase "fishing expedition" is frequently used to define the search for information by these service providers in "data pools".
- Order from American public authorities
A company’s obligation to retain documents also applies where enquiries are conducted by American administrative authorities. The American Minister of Justice in support of the Security and Exchange Commission is currently carrying out a series of investigations to check American companies’ compliance with the US Foreign Corrupt Practices Act. The SEC also conducts a series of investigations to check whether companies are complying with the Sarbanes-Oxley Act. These investigations are also directed at a number of foreign companies.
- Creation of a new offence: "destruction of evidence"
The US Congress recently enacted an offence of destroying information for the purpose of obstructing ongoing investigations. Failure to retain relevant information, including information held by European affiliates of US companies, could be a criminal offence.
These various types of information requests raise several issues for French companies and could involve financial and industrial risks.
French companies and foreign companies established in France, expressed concern to the CNIL about the various US requests for information. They were particularly concerned about the French legal consequences (and more generally European law consequences) of these new obligations. These requests raise issues regarding the implementation of French rules on international cooperation of the judiciary (notably the Hague Convention). They are also contrary to the provisions of the French data protection act. Specifically, provisions relating to collection of information, consent of data subjects, proportionality of the processing and transfer of personal data outside the European Union.
Companies are also concerned about whether they can protect their industrial and trade secrets, as some companies fear the consequences in terms of business intelligence.
Based on the increasing number of expressions of concern from companies, the CNIL drew the government's attention to this problem. As a consequence of the CNIL's intervention, inter-governmental discussion will soon start.
The CNIL and other European data protection agencies are currently discussing these issues at a European level within the framework of the Article 29 Working Party (the group of European data protection authorities set up by Directive 95/46/EC). This group will work in coordination with European institutions, including the European Commission to initiate discussions between Europe and the US on this sensitive matter.