Cross Border Data Transfers for Litigation and Investigation National Bar Association Corporate Counsel Conference Dana Point, California February 15, 2018

Cross Border Data Transfers for Litigation and Investigation Panelists Cecil Lynn, PayPal (Moderator) Justin Goggins, Bank of America Holly Loiseau, Weil, Gotshal & Manges, LLP Dominique Shelton, Alston & Bird, LLP David Shonka, Federal Trade Commission The views expressed are those of the presenter and are not necessarily those of their respective companies, law firms and agency.

Cross Border Data Transfers for Litigation and Investigation Agenda Calibration:  The State of EU, Asia and Latin American Data Privacy The Traditional US Approach EU, APAC, LATAM Legal Landscape (EU Data Privacy/GDPR/Trade Secrets) Systematic Approaches and Framework Practical Solutions for In-House Counsel Crystal Ball for GDPR/Asia/Other Countries

Calibration: The State of EU, Asia and Latin American Data Privacy

Global Laws GDPR (effective 5/25/18) Article 44- processor Obligations for onward transfer Latin America. Argentina GDPR –Like Data Privacy Bill (could be passed in 2018) Chinese Network Security Law (effective 6/1/17)

Calibration: Synthesizing Analysis on Data Transfers in APEC (Examples)

Calibration: Cross-Border Transfer Laws European Union Russia Switzerland China South Korea

Calibration: Global Compliance Checklist Identify the Countries that are critical for your business Understand whether you have cloud vendors or other vendors that might trigger compliance obligations Conduct privacy/security due diligence Be Aware of key developments in the EU, China, and US Train and Engage Your Employees

The Traditional US Approach

The Traditional US Approach U.S. laws are lenient when compared to data privacy regulations implemented in other countries. U.S. courts prefer open discovery. U.S. places less value on personal privacy of employees than other jurisdictions. No comprehensive Federal law regulating the use and collection of personal data. Protection of an employee’s private data is largely left to the states.

The Traditional US Approach Data privacy is regulated by the Federal Trade Commission and the Department of Commerce. Notably, while the European Union permits the transfer of data to countries that provide an “adequate” level of protection for personal information, the United States is not included in that list.

EU, APAC, LATAM Legal Landscape (EU Data Privacy/GDPR/Trade Secrets)

Fact Pattern Company is headquartered in Brussels, Belgium. Company sells products worldwide and is listed on the NYSE. Company has received an anonymous whistleblower complaint alleging that the company’s employees have paid bribes to foreign government officials in EU, Asia Pacific, and South America. How is this internal investigation (and any related litigation) impacted by data privacy laws? What are the risks to the Company? What are the implications for the cost of the investigation?

Factors to Consider Benefits of self-reporting and cooperation with U.S. regulators vs. compliance with the local data privacy regulations. Articulate the applicable data privacy restriction to U.S. regulators to avoid even the appearance of non-cooperation. Necessary to engage in cross border cooperation and coordination with in-country regulators, AUSAs and plaintiff’s counsel. Implications of: Blocking statutes Aggressive regulators Potential class actions by shareholders, or employees who have their personal data transferred during the investigation

Data Collection Consider if the data stored is on an employee’s work or personal device. If information is found on a work device, is the employee’s consent required prior to review or transfer of data? What if a third-party contractor has the necessary information? How can you review the data? Travel to country in which the data is stored. Partner with an on-site service provider that can set up servers with limited access to permit review in the U.S. Anonymize or redact documents prior to review. Engage local counsel familiar with data privacy law in that region to ensure compliance.

Production of Data Sharing data with opposing counsel, investigators, regulators. Producing data in the United States. Government to Government transfer. Using data to conduct interviews or depositions.

Other Considerations Language Barriers Cultural Barriers Beneficial to obtain translators from the country in which the documents were created. Cultural Barriers For some countries, there are cultural issues around privacy and distrust of employers and regulators that can impact data collection and data use.

Systematic Approaches and Framework

Systematic Approaches and Framework MLATs Largely Criminal Hague Evidence Convention Court Discovery // Optional Binding Corporate Rules Intrafirm transfers Standard Contractual Clauses Mandated terms Privacy Shield

Privacy Shield Background – How we got here Privacy Shield Issues Privacy Components Privacy Shield : How It Works Privacy Shield Requirements Conclusion / Questions

Practical Solutions for In-House Counsel

Practical Solutions for In-House Counsel There is no silver bullet Be Transparent Discuss Cross-Border issues openly and early both internally and with the courts. Don’t Hesitate to Educate Discuss Cross-Border issues openly and early both internally and with the other parties.

Practical Solutions for In-House Counsel Consult with In-Country Attorneys Talk to in-country experts whether they be in-house or outside counsel to make sure your know the specific laws of the jurisdiction. Be Consistent Don’t take a haphazard approach, make sure there are guidelines in place.

Practical Solutions for In-House Counsel Tiered Discovery Start with US-based sources and take a jurisdictional approach. Form of Production Consider whether data will need to be anonymized or coded to redact the names and titles of individuals.

Crystal Ball for GDPR/Asia/Other Countries

1 2 3 4 5 Practical Guidance Managing Compliance Document the Program Cross Border Transfer Vendor Governance Compliance with privacy and data Security laws Sachin/Sherry/Dominique to speak   In the online world, transparency is trust. Just as easily you embed technology protocols to collect data it’s equally important to carry that ease of use and consent by offering your customer choice and making it easy to get to. You know.. It is So important for not just say it, but do it. Enforce governance over data collection and sharing. Use third party tools such as ghostery or truste to monitor tag/cookie activity Hold internal violations accountable. Audit/Inventory Where is the personal data? Local Terms Global Terms Managing Consent Document compliance with laws Risk Avoidance and Mitigation Protocols Policies Procedures Repeat

Questions