During the last decade, lawyers faced with the novelty of electronic discovery have reacted in different ways. Some lawyers have mastered it, some have become reasonably conversant with it and some have just added it to the list of things they know they don't know. However, there is an aspect of e-discovery that even the most experienced practitioners may not even know they don't know: the complexities of e-discovery in the international setting. This article gives a brief overview of issues that can arise in connection with international e-discovery, in particular those relating to data protection regimes, the technical requirements for processing data from other countries and other issues that may arise in the collection and review process.

Many countries, most notably the countries of the European Union, have data-protection laws vastly different from those of the United States. EU countries were among the first to adopt data protection regimes, which then served as models for many other countries.

The European Commission's Directive on Data Protection went into effect in 1998. See Council Directive 95/46/EC, 1995 O.J. (L. 281) 31 (EC). The directive regulates the processing of personal data and prohibits the data's transfer from the EU to non-EU countries if they do not meet the EU standards for "adequate" data protection. The directive requires EU member countries to adopt implementing legislation and set up supervisory authorities for data protection. (Id., arts. 28 & 32.) The implementing legislation and practice under the directive vary from country to country. A starting point for questions about the data-protection law of any particular country is the Web site of Privacy International.

The directive broadly defines "personal data" as "any information relating to an identified or identifiable natural person." (Id., art. 2(a).) This language has been construed to include not only data typically considered personal, but also ordinary business documents that refer to a data subject, regardless of whether the data subject is an employee, customer or third party. A business e-mail of which an employee is the identified sender thus might be deemed "personal data" subject to the directive. The definition of "processing" is also broad and includes the "collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction" of such data. (Id., art. 2(b).)

The directive permits the processing of personal data only in certain circumstances. One is when the data subject has given his or her consent unambiguously. Another is when processing is necessary for compliance with a client's legal obligation or for purposes of legitimate interests pursued by the client or the third party or parties to whom the data are disclosed, except when such interests are overridden by the interests of the fundamental rights and freedoms of the data subject. (Id., art. 7.) The directive provides additional protections for certain kinds of sensitive personal data. (Id., art. 8.)