Recently, law professionals in many countries have been closely monitoring and studying the European practice of GDPR with its tightening personal data protection rules and high fines.
This is particularly true with regard to arbitration proceedings, which, as a rule, lead to the need to process personal data, as well as legal issues arising in this regard.
This article will cover some issues of data protection during the international arbitration proceedings. If you intend to resolve a dispute through arbitration in the EU, a consultation of highly qualified lawyers from IQ Decision UK will be at handy.
The general data protection regulation showed its effectiveness immediately after coming into effect two years ago. The companies which deal with data processing have been squeezed into a harsh framework: any violation or non-compliance on their part can be fined up to 4% of the company's annual turnover or 20 million euros, depending on which of the two is higher. This applies to almost all companies operating in the European Union, regardless of its country of origin.
Should you need any legal advice regarding your company GDPR compliance issues, you are welcome to IQ Decision UK. Our seasoned lawyers will give comprehensive answers on all questions that may arise with regard to GDPR requirements and standards in the EU.
Balance of Interests
The widespread development of computer technology and the introduction of databases in the public sector has expanded the category of personal data enormously. This served as an impetus to the intentions of lawmakers from different parts of the world to additionally protect the citizens’ rights in their countries.
The GDPR prohibits any manipulation of personal data or its transfer to countries that are not members of the European Union, in the absence of a reasonable “default confidentiality” regime. Personal data processing should be understood as a series of operations with this data, such as the systematization, use, transfer or deletion of information.
However, there are a few exceptions that include the explicit consent of the data subject, as well as the need for data processing to fulfill a contract or obligation.
These exceptions are particularly interesting to consider in the context of arbitration, but require a careful balance of the data subject interests.
Personal data processing in the international arbitration process
How can general prohibitions on the processing and transfer of personal data affect arbitration? Their influence is very tangible, and at all stages.
Even if at the beginning of the dispute, the company does an internal audit of the old documentation and correspondence, even this may constitute the processing of personal data, the purpose of which should be compatible with the purpose for which the data was originally collected or to which consent is granted. That is, employees should be informed that their data can be subsequently processed and used in the arbitration process.
At the initial stages of the arbitration process, it is important to introduce the concept of data protection to regulatory authorities. Such a step will help to identify which data will be relevant if a transfer occurs outside the EU, and measures are outlined to ensure that the processing concerns only truly relevant data.
The obligations imposed by the GDPR may also conflict with a court order on the production of documents, since the documents will contain personal data. However, this happens very rarely in practice.
Work with expert witnesses
Some problems with data protection during arbitration may arise when working with expert witnesses. It would seem, what is the problem? After all, even before they are involved in the process, you can ask their consent to the processing of personal data. However, as practice shows, in such cases there is always a risk of subsequent withdrawal of such consent.
However, the issue can be resolved in such a way that the need for data processing falls under “necessary for the execution of the contract in which the party is the data subject”, since personal data (name, profession, etc.) are related to the expert opinion in the arbitration process.
Across the Borders
Data transfer to non-EU countries is possible, however, confirmation from the European Commission is required that the country of destination is able to provide an acceptable level of protection for this data. Confirmation is also suitable as an argument that the transfer is necessary “to protect a lawsuit”.
All of the above requires strategic planning from the very beginning of the dispute, including for previous internal case analysis, litigation, selection of arbitration institutions, appointment of arbitrators, etc. In this regard, companies are encouraged to review their internal politics and processes regarding international arbitration.
The expansion in the modern world of foreign economic relations makes international commercial arbitration the legal institution without which it is impossible to imagine their further full and successful development.
Modern international trade turnover requires its participants above all to be effective. And for this, businesses and investors need effective legal protection of their rights and interests. For example, for a foreign investor who is not yet familiar with the legal system of a country (and even more so when he has questions about confidence in a particular national legal system), an important factor is understandability, transparency, predictability of the legal mechanism of dispute resolution so that such a potential dispute is resolved efficiently, quickly, confidentially, with minimal risks of canceling the decision and maximum guarantees for its implementation.
If you intend to resolve a dispute through arbitration in the EU, it is important to hand your case over to experienced lawyers. IQ Decision UK is ready to provide legal assistance in resolving all kinds of commercial disputes in the EU and beyond. Our lawyers provide a full range of legal services related to the conduct of arbitration cases, including consultation on issues related to personal data processing and transfer.