Discovery routinely requires production of documents containing personal data, and privacy obligations run alongside the duty to produce.
Protective orders with a category for personal data, restricting access and requiring return or destruction.
Minimisation. Redacting identifiers not relevant to the dispute, and producing extracts rather than complete files where a database is involved.
Employee data. Personnel files, compensation and health information carry statutory restrictions in many jurisdictions and should be produced in redacted form absent a specific need.
Consumer data. Comprehensive privacy statutes generally contain exemptions for compliance with legal process, but the exemption covers the disclosure rather than the retention and repurposing of the data.
Cross-border. Transferring personal data from jurisdictions with transfer restrictions requires a lawful basis and a valid mechanism, plus attention to blocking statutes.
Third parties. Producing another company’s confidential information about individuals may breach a contract, and notice provisions in commercial agreements frequently require advance notice before production.
Practical sequence. Address personal data in the ESI protocol, agree the redaction approach in advance, and avoid producing first and negotiating afterwards, which cannot be undone.