Preface: If we are to believe the prognosis of many economists, the current recession is on the verge of ending.  The rebounding economy will most likely re-invigorate corporations to push their markets globally. This, in turn, will further push litigation and regulatory enquiries globally.

The best prepared corporations will have a litigation readiness and response plan in place that adheres to the European Union Directives and other information management and discovery protocols.  It is no longer a question of “if” litigation support professionals need to be prepared for discovery requests that go beyond US borders; it is a question of “when”.

It is necessary for U.S. companies to understand the legal complexities of collecting, culling and reviewing data from multiple countries.  And it is a two step process:

The first step is to create and implement a solid litigation readiness and response plan.  When litigation hits, the second step is to harvest and process the data. This article will outline some of the best practices for collecting, filtering, processing, reviewing and finally producing data for EU electronic discovery.

First, some basics:

The first step: what should organizations be doing?

In the US, the need for corporations to create and implement a solid litigation readiness plan is ever increasing due to both the sheer volume of litigation that corporations are facing and the costs associated with eDiscovery.

Outside the US though, this need may not necessarily be so acute.  For example within the EU outside of the UK, any litigation which a corporation is involved in that is to be heard by the local courts involves no discovery.  So, if there is no obligation to find and hand over documents, then why spend the cost of preparing for such an eventuality?

The exception to this though is when corporations are facing regulatory enquiries, whether these be under the Foreign Corrupt Practices Act, competition inquiries or other agencies.

Historically, many corporations based in Europe have taken the view to “self-insure” – i.e. spending money in preparing for an unlikely eventuality is not viable and if such an eventuality was to hit them, then to accept that the associated costs are part of doing business.  This however is slowly starting to change as corporations are increasingly facing regulatory enquiries. So, European subsidiaries are having to adopt some of the processes and procedures being used in the US.

The real first step for any organization is to have a document retention policy (for instance, determining what documents should be retained, for how long and where these documents should be stored, etc). Their document retention policy should also include the procedures for systematic destruction of documents. They should also have procedures to monitor and enforce compliance with these policies.

The company then needs to establish a protocol for responding to requests for electronic documents. The protocol should encompass identifying potential sources for relevant information and preservation of this information. It should also address the methods for extracting the data, and identifying and reviewing relevant documents.

As part of this plan you need to choose whether you have the resources and wherewithal in-house to collect and process elements of the electronic discovery or whether you need a partner who can work with you in a highly collaborative approach to meet your needs, one which is locally based and who understands the local rules and regulations.

The second step: harvesting and processing the data

Now, how is this done within the EU?  This is where the fun starts.  The European Union’s Data Protection Directive prevents companies sending personal data outside of the EU except when the destination country has been pre-approved as having adequate data protection. Only a handful of countries – Argentina, Canada, Switzerland, Guernsey, the Isle of Man and Jersey – have qualified as having adequate protection.

Despite these European provisions to protect personal data and restrict the transfer and use of that data, U.S. courts have been largely unsympathetic to defendants facing these obstacles and have even sanctioned companies who have failed to comply with discovery requests that violated local and international data privacy laws. (more…)