10 | KROLL ONTRACK | Report

“May you live in interesting times” is reportedly the English translation of a Chinese curse. Uncertainty and upheaval are not always conducive to prosperity or productivity, and this sentiment is particularly applicable for in-house counsel and data protection officers working with data in 2016.

Planned changesThe evolution of data protection legislation is cyclical. Technology develops; legislation follows. This pattern is what led to the creation of the EU General Data Protection Regulation (GDPR) which will replace the incumbent European Data Protection Directive (95/46/EC). Introduced in 1996, the EU Data Protection Directive provided European Union citizens with protections designed to work with the explosion of computer use. However, with the advent of social media, greater internet use and growing public concern for data protection, the directive has reached the end of its natural lifespan.

Its successor, the EU GDPR (the directive), has been developed to offer better protection for citizens, to harmonise data protection regulation across the European Union and to simplify intra-EU working.

For those working with data, the GDPR has been anticipated for the past three years. However, the regulation was only finalised in 2016, giving companies just two years until it is enforced in May 2018.

The main points of interest are:

■■ Increased fines for breaches of the GDPR (up to 4 percent of the annual global turnover).

■■ A "privacy by design" provision requiring data protection to be designed into business services. Ensure that measures are taken to protect data from the start of a client or customer engagement.

■■ Explicit consent must be obtained for the collection and processing of data. Contracts with clients or customers should include a section on consent.

■■ Multinational companies working across the European Union will be required to appoint an independent Data Protection Officer. This will be a challenging role to fulfil given the breadth of knowledge required to manage both IT systems and be familiar with the legal aspects of the GDPR.

■■ International companies based outside the European Union, but which hold data inside the European Union, will be subject to these regulations.

■■ A “right to erasure". A client or customer has the right to request the erasing of personal data.

■■ Data will be prohibited from being transferred outside the European Union without approval from a supervisory body.1

The implications of GDPR will be widespread and in-house counsel and compliance officers will need to prioritise data protection, devoting more time, and in some cases money, to ensuring the conditions of the GDPR are being met. The

No Man is an Island: The Battle for Data Privacy

NEW FRONTIERS IN EDISCOVERY | 11

penalties for non-compliance are high, elevating compliance with data protection law to a similar level of importance as compliance with anti-trust laws.

No port in a stormIn late 2015, the European Court of Justice declared in the case Maximillian Schrems v. Data Protection Commissioner (Case C-362/14) that the “Safe Harbor Agreement” between the European Union and the United States was invalid.

Schrems, an Austrian citizen, had concerns about EU data being transferred from Facebook’s Irish subsidiary to servers located in the United States. He argued that the Safe Harbor agreement was no longer sufficient in protecting the privacy of European citizens, especially following Edward Snowden’s revelations about the surveillance activities of the United States Intelligence Community.

As the replacement legislation, the EU-U.S. Privacy Shield was only finalised in July 2016, following protracted discussions and a rejected draft agreement. This left the 4,400 companies reliant on the agreement in an uncertain legal position regarding transferring data, relying on standard contractual clauses or binding corporate rules for much of 2016.

EU-U.S. Privacy ShieldThe finalised agreement shares some similarities with the Safe Harbor. It relies on a similar approach of self-certification but imposes significantly greater obligations on participating organisations. The basis for the agreement is centred on the following seven privacy principles:

Notice: Organisations must provide individuals with notice of the types of data collected and the purposes of collection and be informed of third parties who will receive their data, their right of

access to it and safeguards limiting the use and disclosure of their personal data. The organisation must also describe recourse mechanisms.

Choice: Organisations must provide clear and readily available opt-out methods for disclosure of personal data to third parties for purposes other than the one for which it was originally collected. For sensitive information (such as health information), individuals must actively consent and opt in to their data being used.

Accountability for Onward Transfer: Privacy Shield certificate holders must ensure that third-party contracts include agreements that provide the same level of protection as the organisation itself. They must agree that data may only be processed for limited, specified purposes consistent with the data subject’s consent. The organisation will remain liable for a third party’s violations unless it can prove that it was not responsible.

Security: Participating organisations need to “take reasonable and appropriate measures to protect [data] from loss, misuse and unauthorised access, disclosure, alteration and destruction.” These measures must be appropriate to the “risks involved and the nature of the personal data.”

Data Integrity and Purpose Limitation: Data collected must be “relevant for the purposes of processing” and organisations must limit collection to only relevant data, and it must be accurate, complete, and current.

Access: Organisations must provide individuals with access to their personal data and the opportunity to correct, amend or delete information that is inaccurate or processed in violation of the principles outlined in Privacy Shield.

Recourse Enforcement and Liability: The Privacy Shield agreement contains detailed mechanisms for recourse and dispute resolution and those seeking self-certification will need to implement complaints procedures that meet these strict requirements.

12 | KROLL ONTRACK | Report

In additional to these principles, the EU-U.S. Privacy Shield will also:

■■ Introduce an Ombudsman to investigate any complaints regarding access to data by the United States Intelligence Community.

■■ Conduct a joint annual review by the European Union and Department of Commerce of the program.

Brexit wounds?As the European Commission and the U.S. Department of Justice battled it out over a replacement for Safe Harbor, the United Kingdom sought to end a decades old debate over whether or not the country should leave the European Union by holding a referendum on the issue. Defying predictions made by pollsters, pundits and politicians alike, the result – which saw 52 percent of the electorate opting to leave – shocked the world. For in-house counsel and compliance officers operating in the European Union and United Kingdom, the decision once again plunged proceedings into uncertainty regarding data protection laws.

Unlike the current Directive, the GDPR will be unilaterally adopted across EU member states, raising two key questions for the United Kingdom:

■■ What legislation will replace GDPR?

■■ How would Britain do business with European Union countries operating under GDPR?

The United Kingdom currently operates under the Data Protection Act, 1998, which was enacted to bring British law in line with the Directive. At the time of writing, Britain has yet to trigger Article 50 and formally start exit proceedings. Prime Minister Theresa May has stated she will not trigger Article 50 until at least the end of the year to allow time to prepare for negotiations. Once Article 50 is triggered, experts in European Union constitutional law predict that it will take two years for the exit to be finalised. During this transition period, it is likely that the Data Protection Act, 1998 will remain unchanged.

At first glance, no longer being subject to the stringent conditions of GDPR may seem like a positive consequence of Brexit. However, Brexit is not simply a case of “in” or “out” and much of the potential consequences of leaving depend on whether or not Britain becomes part of the European Economic Area (EEA) or completely severs ties.

If Britain does become part of the EEA, this would afford Britain the same status as other European countries such as Norway and Iceland. This would mean it would be designated a ‘safe area’ under the GDPR.

In business terms, this would make data transfers somewhat easier, assuming the European Union found the United Kingdom’s safeguards to be appropriate. Nevertheless, this would mean that the United Kingdom would still be subject to the Directive and from May 2018 the GDPR, when transferring data across borders to comply with legal obligations in other countries.

An EU-U.K. Privacy Shield?If the United Kingdom does not become part of the EEA, they would probably have to negotiate an agreement similar to the EU-U.S. Privacy Shield in order for U.K. companies to continue to transfer data between the United Kingdom and countries in the European Union.

In this scenario, it is likely the Article 29 Working Party would suggest similar terms to those applicable to the United States:

■■ An ombudsman to handle complaints from European Union citizens about the United

Kingdom’s security services accessing their data.

■■ UK Security services / the Home Office to provide written commitments that Europeans’ personal data will not be subject to mass surveillance.

■■ An annual review or audit to check the new system is working properly.

What do all these changes mean for ediscovery?We predict that 2017 will see a rise in demand for mobile ediscovery solutions. The latest data protection legislation (GDPR and the EU-U.S. Privacy Shield) both impose greater obligations and greater fines for violations than their predecessors. Mobile solutions can assist with compliance in two ways; firstly by processing data in-country, which removes the risks associated with transferring data across borders. Secondly, mobile ediscovery technology and predictive coding technology in particular are adept at ensuring only relevant data is transferred and disclosed.

The latest data protection legislation (GDPR and the EU-U.S. Privacy Shield) both impose greater obligations and greater fines for violations than their predecessors. Mobile solutions can assist with compliance.

NEW FRONTIERS IN EDISCOVERY | 13

In terms of Brexit, until the United Kingdom finalises its data protection regime and comes to an agreement with the European Union, companies will need to think carefully about the risks of transferring data across European borders. Once again, mobile ediscovery solutions provide a neat solution that allows business to continue processing and transferring data in Europe in a compliant and cost-effective manner.

Additionally, it is likely there will be renewed focus on information governance in order to comply with the “privacy by design” and “right to be forgotten” components of the GDPR. Understanding where data is and the volumes involved will play a big role in ensuring compliance.

REFERENCES1 https://www.privacyshield.gov/EU-US-Framework