Data Processed Under EU Whistleblower Law Covered by the GDPR

Last year, the European Parliament passed EU Directive 2019/1937 in order to protect people who report breaches of EU law. This new whistleblower law requires that personal data processing done pursuant to the reporting of EU law violations comply with the General Data Protection Regulation. Whistleblowers can file reports when required to do so by law, or when they are impacted by the violation of a law. Authorities have to keep confidential records of the reports, and the identity of the whistleblowers must be kept private, but individuals whose data has been processed must also be notified that their data has been collected.

Any whistleblower data has to be processed under the provisions of Article 5 of the GDPR, which provides that data be processed in a transparent manner; collected for a limited purpose; updated to be accurate; anonymized to the extent possible; and kept secure. Pursuant to Article 28, data controllers that have outside processors process the whistleblower data, cannot allow them to use sub-processors.

Whistleblower data can only be transferred under Chapter V of the GDPR which prevents data from being sent to countries without adequate data protection measures.

UK Waiting to See If It Is Adequate . . .

The Brexit transition period ends on December 31, 2020. After the end of the year, the United Kingdom will be considered a third country under the General Data Protection Regulation. In order for data to be transferred from the European Union to the UK, the UK must obtain an adequacy decision from the EU.

Data transfers from the UK to the EU, will not be restricted by the UK. See this post on the main site for Her Majesty's Government. The British government recommends that standard contractual clauses be used to ensure the law transfer of data from the European Union. Templates for SCCs are available in Word documents from the Information Commissioner's Office - an independent regulatory body which reports to Parliament.

The GDPR will continue to be part of British law after the transition period.

U.K. Practice Direction 31B - Disclosure of Electronic Documents

The Ministry of Justice of the United Kingdom has issued Practice Direction 31B on the Disclosure of Electronic Documents, which addresses the preservation of 'electronic documents'; when a reasonable search has been performed; the disclosure of metadata; and other electronic discovery issues. In some respects, UK's rules will look familiar to America litigators, as they state that clients must be notified of the need to preserve documents as soon as litigation is contemplated.

However, the Practice Directive also goes into some detail which American e-discovery specialists may find interesting. There is a reminder that document management systems may associate metadata with documents that will not be stored in those documents.

Most notably, it includes an Electronic Documents Questionnaire which has 23 points for parties to consider. Some questions are obvious ones, such as asking for a date range and custodians to be specified. Others will prompt counsel to go into detail which may be commonly overlooked by American lawyers. Question # 7 is on 'automated searches' and asks the parties to disclose if they used clustering or concept searching, and discuss the methodology used for such searching.

The form of the Electronic Documents Questionnaire helps parties to organize their discussion: