USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
5.5 Recent Developments The Shift Toward National Security-Driven Restrictions
courts perform a balancing test (called “comity analy - sis”) weighing factors like the importance of the evi - dence to the case, how specific the request is, where the information is located, whether there are alterna - tive ways to get it and the strength of the foreign coun - try’s interest in blocking disclosure. The modern judicial trend holds that foreign block - ing statutes and privacy laws cannot be used to cir - cumvent US discovery rules. Courts have consistently found that the mere existence of foreign laws restrict - ing data disclosure does not prevent American judges from ordering discovery, though these laws may influ - ence whether sanctions are imposed if someone diso - beys the order. For example, courts have ruled that even strict privacy laws like the GDPR, which carry significant penalties for violations, cannot be used as an automatic excuse to refuse discovery in US liti - gation. However, courts recognise genuine conflicts and often use procedural tools to manage them: pro - tective orders limiting who can see sensitive informa - tion, requiring the requesting party to pay compliance costs (including costs of meeting foreign privacy law requirements) and demanding indemnification against foreign penalties. Courts also require parties claiming foreign law prevents compliance to provide detailed proof of the specific legal restrictions and show they made good faith efforts to obtain waivers or clarifi - cation under foreign law. The bottom line: US courts maintain their authority to order discovery even when foreign laws say otherwise, but they consider foreign legal restrictions when deciding how to structure dis - covery and whether to penalise non-compliance.
The United States is moving away from its traditional hands-off approach to data transfers and implement - ing significant new restrictions based on national security concerns, particularly targeting data flows to China, Russia, Iran, North Korea, Cuba and Ven - ezuela. The most important change is Executive Order 14117 (issued 28 February 2024), which directs the Justice Department to restrict or prohibit American companies from sharing sensitive personal data in bulk – including precise location tracking, biometric data (fingerprints, face scans), genetic information, health records and financial data – with businesses or individuals connected to adversary nations. The Justice Department released a draft framework in April 2024 and is expected to issue proposed regulations in early 2025 with final rules by mid-2025. Once in effect, companies using foreign vendors, cloud providers or employees from these countries who can access large amounts of sensitive US customer data will like - ly need to implement security programmes (encryp - tion, access controls, auditing) or obtain government approval for certain transactions – the first time the US will require permission or registration for routine data transfers. This represents a fundamental shift: data is now viewed as a strategic national security asset that must be protected from foreign adversaries, not just a consumer privacy issue. Congress has reinforced this approach by passing the TikTok divestiture law (April 2024), which requires ByteDance to sell TikTok or face a US ban because of concerns that the Chinese government could access Americans’ data. The fed - eral government also banned TikTok from all federal devices in late 2022, and over 38 states have done the same. The clear trend is toward more government oversight and restrictions on data flows to geopolitical rivals, driven by concerns about espionage, tracking of Americans and threats to national security.
559 CHAMBERS.COM
Powered by FlippingBook