The Sedona Conference has published Practical in-house approaches to cross-border discovery and data protection after several months of public comment on an earlier version.

This is a disorientating area to practice in, particularly at the moment:

We now have a date (25 May 2018) for the implementation of the EU General Data Protection Regulation but, despite the years of argument and redrafting which went into it, it still raises questions.

Both the Article 29 Working Party and Giovanni Buttarelli, the European Data Protection Supervisor, have effectively rejected the Privacy Shield which is intended to replace the now-invalidated Safe Harbour.

Max Schrems has, only last week, followed up his attack on Safe Harbour with one on Binding Corporate Rules.

We still await the appeal in Microsoft Dublin case.

Many ask if Brexit (the UK’s possible withdrawal from the EU) will make a difference to data transfers (Answer: it will almost certainly make it more difficult).

There is, therefore, no right time to publish anything purporting to be definitive guidance. Meanwhile, however, business life must go on and data transfers occur daily simply to keep the wheels turning.

The Sedona Conference is right to produce its Practical Approaches when it is ready, without waiting for some mythical moment when we have a definitive strike-point.

Practical Approaches is built on The Sedona Conference International Principles on Discovery, Disclosure and Data Protection of 2011. In the absence of definitive positions taken by the multiple authorities, these two works are as comprehensive and practical as you will find.

I did a webinar for Nuix this week on the GDPR and was asked at the end for a summary comment. There are some things, I said, to which there is no definitive answer, and anyone who purports to give one is overplaying their hand. Cross-border data transfers in general, and discovery in particular, are among them.,

Next week, Sedona’s Working Group 6 meets in Berlin for its annual Programme on cross-border discovery and data protection laws. I will be there.

Home