Israeli Data Protection Law No Bar to U.S. Discovery 

A U.S.-based mobile gaming platform called Skillz sued its Israeli-based competitor, Papaya Gaming Ltd., for false advertising and deceptive practices. Skillz claimed that Papaya used “bots,” despite advertising to customers that they would be competing against real humans. Papaya counterclaimed, making nearly identical allegations against Skillz for allegedly misrepresenting that Skillz players compete against people, not robots.

Papaya initially refused to produce almost all the discovery sought by Skillz, arguing that the requests should go through the Hague Evidence Convention’s (HEC or Convention) procedures to avoid potentially subjecting Papaya to liability for violating Israeli data protection requirements. The parties briefed this issue and submitted declarations by Israeli lawyers as to the content of Israeli law. The parties also eventually narrowed the scope of their discovery dispute, focusing in the end on information about Skillz employees and communications among them, especially e-mails.  Papaya eventually disclosed that its corporate records, including company provided email accounts, are stored on servers located in the European Union.

The Hague Evidence Convention

Both Israel and the United States are parties to the HEC, but that does not mean that district courts must follow the Convention’s procedures. The U.S. Supreme Court held in Société Nationale Industrielle Aérospatiale v. U.S. District Court (1987) that the procedures set out in the Convention are optional and that the Convention provides a supplement to—but does not replace—the normal discovery mechanisms available in federal courts. In deciding whether to require use of the Convention in specific cases, courts are supposed to consider the interests of the sovereigns involved and the difficulties that the litigant may face in complying with foreign law. In First Am. Corp. v. Price Waterhouse (1998), the Second Circuit listed a specific set of factors for courts to balance that also include the hardship that the discovery would impose, the importance of the discovery to the litigation, the “good faith” of the party resisting discovery, whether the entity from how discovery is sought is a party to the litigation, and whether the Convention would provide a productive means for discovery.

The district court in Skillz began its inquiry by considering the interests of the United States and Israel. The U.S. interests include the fair and efficient resolution of cases through the application of its standard discovery process. Israel has an interest in national security, protecting privacy, and safeguarding the interest of consumers through the application of its laws. Those interests are not implicated, however, if Israeli law does not protect the data in question. The court thus turned to the content of Israeli law as briefed by the parties and presented by their experts.

Israeli Law

Papaya argued that Israel’s Privacy Protection Law (PPL) bars it from “collecting and transferring a significant portion of the nonpublic responsive documents and information to the United States absent an Israeli order.” The PPL applies to “information on the personality, personal status, intimate affairs, health status, economic position, vocational qualification, opinions and beliefs of a person.” It does not apply to “‘deidentified’ data” nor does it apply to data about corporations. Data Protection Regulations promulgated under the PPL permit the “transfers of data to countries whose law ‘ensures a level of data protection which is no less . . . than the level of data protection prescribed in Israeli law.’” The regulations also include exceptions for “transfers of data for the defense against legal claims” and “among parties who have stipulated to protect the data under conditions consistent with Israeli law.” The PPL also provides a defense from enforcement for anyone who violates the law because they had a legal or moral duty to do so.

For multiple reasons, the court had little trouble concluding that “Israeli law does not prevent Skillz from taking discovery from Papaya outside the Hague Convention.” That language is a bit unclear. It might be better to say that Israeli law does not protect the data in question, and even if it does, Skillz has a strong defense to any enforcement action, so that there is no true conflict between U.S. and Israeli law and the sovereign interests of Israel in this discovery are low, meaning that the Convention need not be applied. In any event, Papaya argued that the data pertained to individuals (and thus fell within the statute’s protections), not to the corporation itself, because much of the requested information took the form of individual employee emails. The court appeared to disagree, noting that information saved by individuals can still be considered corporate. The court also reasoned that the requested discovery is “necessary for the defense of legal claims” by Papaya; a protective order issued by the court had established adequate privacy safeguards; and the law includes ready-made defense for Papaya which would be acting under a legal duty to produce the information. For all of these reasons, Papaya had little to fear from enforcement.

Comity Factors

Citing Aerospatiale and First Am. Corp. v. Price Waterhouse, the court considered five additional comity factors that ultimately “weigh[ed] against requiring the use of the Hague Convention.” Papaya would not face hardship from complying with the order because the discovery requested was typical of commercial litigation and Papaya did not show it would face prosecution in Israel if it complied. Papaya did not contest the importance of the discovery to the litigation. The district court also questioned whether Papaya was acting in good faith because of the very broad position it took with regard to discovery before the issues were narrowed, because its expert on Israeli law made conclusory statement when compared to the expert retained by Skillz, and because it was slow to disclose the location of its servers. The court also reasoned that any special concerns about non-litigants did not apply in this case because Papaya is a party. Using the HEC’s procedures would also raise the risk of substantial delay and could cause “a narrowing of the discovery.”

Conclusion

As I noted in an earlier TLB post, foreign data protection laws are increasingly raised as a defense to discovery requests and may ultimately have greater impact than foreign blocking statutes. However, at least to date, attempts to use data privacy laws to block discovery have been unsuccessful. Both the Southern District of New York and the Northern District of California have, for example, found that China’s Personal Information Protection Law does not block discovery. The Skillz case fits comfortably into this pattern of decisions, suggesting that foreign data protection statutes are not yet a significant factor in shaping discovery in the United States. In this case, the court relied on the parties’ descriptions of Israeli law, which Papaya apparently did not address carefully enough. Foreign sovereigns with a strong interest in application of their data protection laws to U.S. discovery may want to submit their views directly to U.S. courts – or make clear and credible threats of prosecution.