GDPR

We’re all familiar with the importance of avoiding the inadvertent disclosure of attorney-client communications, work product or sensitive, proprietary or confidential business information. However, our obligations don’t end there. In addition to protecting this information, we also need to consider how to handle personal identifying information (“PII”). With extremely large amounts of data being at play in most litigation matters, it is becoming more and more important to have a solid game plan with safeguards and protections in place. Accidentally disclosing PII can lead to a chaotic discovery process and could lead to expensive monetary sanctions.

In 2019, I co-authored an article published by the American Bar Association regarding the future of U.S. pretrial discovery involving European Union data following the decision by the United States District Court for the District of Arizona in Salt River Project Agricultural Improvement & Power District v. Trench-France SAS, 303 F. Supp. 3d 1004 (D. Ariz. 2018). The article concluded that Salt River represented a potential watershed moment promoting the application of a foreign mechanism to U.S. discovery overseen by a foreign discovery master under the Hague Convention, as opposed to U.S. courts’ typical deference to domestic discovery practices. Recently, however, I was involved in a matter which demonstrated that state courts may be reluctant to follow Salt River’s lead.