The case of the day is Finjan, Inc. v. Zscaler, Inc. (N.D. Cal. 2019). It’s from early in 2019, but I missed it when it was issued. The case was a patent dispute. Finjan, a computer security company, sought the production of emails from Tim Warner, a British citizen living in the UK. The emails were important, Finjan said, because Warner, its previous sales director who now headed UK sales for the defnedant, had “intimate knowledge” of the patented technology and “could explain [it] inside out.” Zscaler argued that it could not produce the emails, because production would violate the GDPR. It claimed that Finjan’s proposed search terms were overbroad and would require the production of unnecessary personal data, which would have to be anonymized or redacted. Zscaler argued that Fujian should first have to try to obtain the emails from custodians in the United States, that the protective order would have to be amended, and that in any even an “attorneys’ eyes only” production would have satisfied the GDPR.

The framework for this issue is the framework that applies to blocking statute cases in general: the multifactor comity analysis of Aérospatiale. The court undertook that analysis here, and unsurprisingly rejected Zscaler’s argument for a protective order. There may be other similar cases I’m not aware of, but this is the first time I’ve seen the analysis applied to the GDPR. A few points are worth noting. First, production of emails with personal information redacted was not substantially equivalent to the production of unredacted emails, since one of the reasons Finjan wanted to see the emails was uncover the identities of people with whom Warner had communicated about the technology. The court recognized the UK’s interest in privacy protection, but it noted as a countervailing fact the presence of a protective order, and it was not really disputed that the GDPR permits the discovery of personal data if they are objectively relevant to the issues being litigated. Zscaler was hardly in a position to make a strong showing on that point, as it had not even searched the emails yet.