WIXLIB

2010 Canadian Bar Association IPEBLAConferenceWorkshop 12: Electronic Record Retention and DestructionA presentation to the Canadian Bar Association and International Pension & EmployeeBenefits Lawyers Association, Québec Cityby Paul A. MeyerJune 21, 2010 2010 Towers Watson. All rights reserved.

Electronic Retention and Destruction Considerations in establishing international recordretention. Costs of business and litigation. Managing competing interests of employers and employee. Benefits of a good records management program.towerswatson.com2 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Considerations in international record retention Why have retention rules? Regulatory compliance Efficiency and quality control Defensible disposition of obsolete recordsInternational considerations Varying retention requirements. Inconsistent data privacy rules. Inconsistent standards for disposition.towerswatson.com3 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Evolving Challenges – Europe and the World European Community April 2008 White Paper on privateantitrust actions includes sanctions for failure to preserveevidencePopularity of “dawn raids” by EU competition regulators Extensive Privacy Laws in Europe, Canada and Abu Dhabicomplicate hold obligations U.S. courts disregard Hague Convention, blocking statutes andprivacy laws to impose cross-border e-discoverytowerswatson.com4 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Privacy in Europe “(1) Pursuant to Directive 95/46/EC Member States are required toprovide that a transfer of personal data to a third country may only takeplace if the third country in question ensures an adequate level of dataprotection and the Member States' laws, which comply with the otherprovisions of the Directive, are respected prior to the transfer.“(2) However, Article 26(2) of Directive 95/46/EC provides thatMember States may authorise, subject to certain safeguards, a transferor a set of transfers of personal data to third countries which do notensure an adequate level of protection. Such safeguards may inparticular result from appropriate contractual clauses.”European Commission Decision of 27 December 2001 on standard contractualclauses for the transfer of personal data to processors established in thirdcountries, under Directive 95/46/EC.towerswatson.com5 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Privacy in North America Canada - Consent is usually required under PersonalInformation and Electronic Documents Act (“PIPEDA”) andprovincial privacy statutes, subject to exceptions.United States – Privacy of health information protected byfederal law under HIPAA, as amended by HiTech47 states have data security laws, the most comprehensive ofwith is the Mass Data Security Law.towerswatson.com6 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Data Loss “285 million records were compromised in 2008. 74% resultedfrom external sources, 67% were aided by significant errors and87% were considered avoidable through simple or intermediatecontrols.”“The majority of the lost data was neither encrypted norprotected by a password.”“An alarming 78% of IT professionals in the United States claimthat their companies have suffered unreported insider-relatedsecurity.”Kevin P. Kalinich, “Red Flags, Broken Hearts & Data Breach Stimulus;Insurance for Breaches of Data Privacy and Information Security,” (Aon2009).towerswatson.com7 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Average costs of 2008 breach per data loss eventsCOUNTRYTOTAL COST COST PER RECORD LOSTAustraliaUS 1.83 millionUS 114FranceUS 2.53 millionUS 119GermanyUS 3.44 millionUS 177United KingdomUS 2.57 millionUS 98United StatesUS 6.75 millionUS 204"2009 Annual Study: Global Cost of Data Breach,“ Ponemon Institute(2009)towerswatson.com8 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Data loss Costs Europe – enforcement by government. UK - Monetary Penalty Notice ("MPN") under the DataProtection Act 1998 (the "DPA") imposes fines of up to 500,000. In force on April 6, 2010.Spain – Imposed 22,000,000 in penalties in 2009.United States – Under HiTech amendments to HIPAA, state Attorney Generalsmay prosecute violations of federal health privacy law. Enforcement through civil litigation as well as governments;SEC filings show 256 million loss anticipated by TJX forconsumer data loss. Kevin Kalinich, supra, at 2. towerswatson.com9 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Privacy Risk of International Discovery“Cross-border discovery represents a “Catch-22” situation in whichthe need to gather relevant information from foreign jurisdictionsoften squarely conflicts with blocking statutes and data privacyregulations that prohibit or restrict such discovery – often uponthreat of severe civil and criminal sanctions. . . . .“Cross-border discovery has become a major source ofinternational legal conflict, and there is no clear, safe wayforward.”Framework for Analysis of Cross-Border Discovery Conflicts: A PracticalGuide to Navigating Competing Currents of International Data Privacyand e-Discovery at 1 (Sedona Conference 2008).towerswatson.com10 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

The Hague Convention Article 23 of The Hague Convention restricts pretrial discovery to“letters of request” or “letters rogatory” issued by courts of onenation to courts of another. Many civil code jurisdictions and Australia restrict discoveryunder the Hague Convention with blocking statutes to limit thereach of foreign courts and government agencies. Framework forAnalysis of Cross-Border Discovery Conflicts, supra, at. 18. In France, honoring a foreign court‟s discovery request ispunishable by up to six months in prison and files of up to 18,000. Id. At 21.towerswatson.com11 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Impact of U.S. Discovery Requirements Internationally Regulatory Reach. Civil Jurisdiction of U.S. Courts. Jurisdiction over non-citizens.towerswatson.com12 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

The Discovery Process in the United States Parties engage in discovery with little or no oversight by courts. Parties demand information from their opponents via requestsfor disclosure, requests for admissions, requests for production,interrogatories, and depositions. Scope is broad: anything not privilege that may lead todiscoverable evidence; discoverable information need not beadmissible. Unique ability to demand information from non-parties withadvance supervision by court. Parties to a lawsuit may also request information from thirdparties via subpoena.towerswatson.com13 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Regulatory Reach U.S. v. UBS Warburg - 2009. Criminal charges of facilitating off-shore tax evasion. Deferred prosecution agreement required cooperation andidentification of holders of 4,550 accounts. Swiss bank secrecy law defended confidentiality of accounts withcriminal sanctions. Diplomatic crisis as U.S. required UBS to violate Swiss law.towerswatson.com14 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

United States v. UBS – the saga August 2009: Swiss – U.S. - Swiss accord to transfer accountdata to the United States, subject to Swiss parliament approval. January 21, 2010 and February 26, 2010: Federal AdministrativeCourt of Switzerland prevented the disclosure of UBS accountdata, finding that the failure to file an IRS Form W-9, “Requestfor Taxpayer Identification Number and Certification,” was notevidence of fraud. March 31, 2010: United States and Switzerland signed a protocolthe Swiss Federal Tax Administration (“SFTA”) to provisionallyapply the August 2009 accord that the two countries entered intoin connection with the deferred prosecution agreement betweenthe U.S. Department of Justice and UBS.towerswatson.com15 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

United States v. UBS – the saga continues June 16, 2010: Switzerland‟s lower house of parliament overruled the court and approved a law allowing SFTA to hand UBSdata over to U.S. tax authorities; bill to be reconciled with lawapproved by upper house.A referendum is still possible that could make it impossible forUBS to turn over Swiss data by the August 2010 deadline in thedeferred prosecution agreement. If this occurs, the IRS said it isprepared to reopen the case against UBS.Deborah Ball, “UBS Tax Deal Approved, but . . .,” WALL STREET JOURNAL (June18, 2010).towerswatson.com16 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Reach of U.S. Courts Legal Holds and Discovery: Pension Committee of the University of Montreal Pension Planv Banc of America Securities, LLP et al., No. Civ. 05-9016,2010 U.S. Dist. LEXIS 1839 (S.D.N.Y. Jan. 11, 2010), –Quebec plaintiffs. AccessData Corp. v. Alste Techn. Gmbh, No. 2:08-cv-00569(D. Utah Jan. 21, 2010) - Discovery of foreign customer datashielded by German privacy law. Chanel, Inc. v. Song Xu, (W.D. Tenn. Jan. 29, 2010) – serviceof process outside U.S. by email only.towerswatson.com17 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Hold Triggers Reasonable anticipation of litigation: Must preserve documentsfrom date notice of potential claim, not subsequent suit. 336332B.C. Ltd. V. Imperial Oil, et al., B.C.L.R. (4th) 168 (Canada);Zubalake v. UBS Warburg, IV (2d Cir. 2004) Discussion of risk of specific claim within management. Broccoliv. EchoStar, 229 F.R.D. 506, 516-17 (D. Md. 2005)(sexualharassment) Discovery of ESI that “might” be useful to “any” potentialgovernment investigation. U.S. v. Russell (criminal conviction for„failure to preserve‟ evidence of child pornography use underSOX)towerswatson.com18 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.

Compelled Disclosure Contrary to Foreign LawAccessData Corp. - magistrate judge granted a motion to compelto produce customer records from Germany. Objection on the grounds that production of this “private thirdparty information” would subject producing party to civil andcriminal penalties under the German Data Protection Act. The court granted the motion to compel, declaring privacy law tobe a “blocking statute.” Opinion suggests ways that future parties should argue for aproceeding through the Hague Convention.towerswatson.com19 2010 Towers Watson. All rights reserved. Proprietary and Confidential. For Towers Watson and Towers Watson client use only.