Reply Brief — Vesuvius USA Corporation, et al., Petitioners v. Royston Phillips

No. 20-1275

IN THE

Supreme Court of the United States

VESUVIUS USA CORPORATION AND CHRISTOPHER YOUNG,

Petitioners,

v.

ROYSTON PHILLIPS,

Respondent.

On Petition for a Writ of Certiorari to the Court of

Appeals of Ohio, Eighth Appellate District

REPLY IN SUPPORT OF PETITION FOR A WRIT

OF CERTIORARI

CRAIG D. CANNON

JAMES J. HEFFERAN, JR.

KILPATRICK TOWNSEND &

STOCKTON LLP

1001 West Fourth Street

Winston-Salem, NC 27101

(336) 607-7300

MARLA N. PRESLEY

JACKSON LEWIS P.C.

1001 Liberty Avenue

Suite 1000

Pittsburgh, PA 15222

(412) 338-5148

ADAM H. CHARNES

Counsel of Record

KILPATRICK TOWNSEND &

STOCKTON LLP

2001 Ross Avenue

Suite 4400

Dallas, TX 75201

(214) 922-7106

acharnes

@kilpatricktownsend.com

Counsel for Petitioners

i

TABLE OF CONTENTS

TABLE OF CONTENTS ............................................. i

TABLE OF AUTHORITIES....................................... ii

REPLY BRIEF.............................................................1

I.

Petitioners preserved the arguments made in

the petition. ..........................................................2

II. Petitioners presented the lower courts with

sufficient information to determine that the

GDPR applies to the information at issue. .........4

III. The issue presented is sufficiently important

to warrant this Court’s consideration. ................6

IV. The

court

of

appeals

misapplied

Aérospatiale. .........................................................9

CONCLUSION .......................................................... 12

ii

TABLE OF AUTHORITIES

Cases

Fox v. Hayes,

600 F.3d 819 (7th Cir. 2010) ...................................4

In re Application Pursuant to 28 U.S.C. § 1782

of Okean B.V. & Logistic Sol. Int’l to Take

Discovery of Chadbourne & Parke LLP,

No. 12 Misc. 104 (PAE), 2013 WL 4744817

(S.D.N.Y. Sept. 4, 2013) ...........................................7

In re Payment Card Interchange Fee & Merch.

Disc. Antitrust Litig.,

No. 05-MD-1720 (JG)(JO), 2010 WL

3420517 (E.D.N.Y. Aug. 27, 2010) ..........................6

Lawson v. Sun Microsystems, Inc.,

791 F.3d 754 (7th Cir. 2015) ...................................4

Laydon v. Mizuho Bank, Ltd.,

183 F. Supp. 3d 409 (S.D.N.Y. 2016) .................... 11

Lebron v. Nat’l R.R. Passenger Corp.,

513 U.S. 374 (1995)..................................................3

Richmark Corp. v. Timber Falling

Consultants,

959 F.2d 1468 (9th Cir. 1992) ............................... 11

Société Nationale Industrielle Aérospatiale v.

United States District Court for the

Southern District of Iowa,

482 U.S. 522 (1987)...................... 1, 2, 3, 6, 9, 11, 12

Strauss v. Credit Lyonnais, S.A.,

242 F.R.D. 199 (E.D.N.Y. 2007) ..............................5

iii

United States v. Williams,

504 U.S. 36 (1992)....................................................3

Weiss v. Nat’l Westminster Bank, PLC,

242 F.R.D. 33 (E.D.N.Y. 2007) ................................6

Yee v. City of Escondido,

503 U.S. 519 (1992)..................................................4

Statutes

Charter of the Fundamental Rights of the

European Union, art. 8, 2012 O.J. (C 326) .............8

Regulations

General Data Protection Regulation,

Regulation (EU) 2016/679 of the European

Parliament and of the Council of 27 April

2016 on the Protection of Natural Persons

with Regard to the Processing of Personal

Data and on the Free Movement of Such

Data, and Repealing Directive 95/46/EC,

2016 O.J. (L 119)

art. 2 ....................................................................... 10

art. 49 ............................................................... 10, 11

art. 6 ....................................................................... 10

art. 9 ....................................................................... 10

recital 1 ....................................................................8

Other Authorities

Art. 29 Working Party, Opinion 8/2001 on the

processing of personal data in the

employment context (adopted 13 September

2001) ....................................................................... 10

European Data Protection Bd., Guidelines

2/2018 on derogations of Article 49 under

Regulation 2016/679 (adopted 25 May 2018) ...... 11

iv

ICO Employment Practices Code 7 (2011) .................9

Kristen A. Knapp,

Enforcement of U.S. Electronic Discovery

Law Against Foreign Companies: Should

U.S. Courts Give Effect to the EU Data

Protection Directive?,

10 Rich. J. Glob. L. & Bus. 111 (2010) ................ 7, 8

Restatement (Third) of Foreign Relations Law

of the United States § 437 (1987) ............................1

1

REPLY BRIEF

The petition explained why the recent wave of

foreign privacy laws, exemplified by the European

Union’s General Data Privacy Regulation and

comparable national laws, requires that this Court

again address the interaction of American discovery

rules with foreign laws restricting cooperation with

discovery. The last time this Court addressed this

topic, 35 years ago in Société Nationale Industrielle

Aérospatiale v. United States District Court for the

Southern District of Iowa, 482 U.S. 522 (1987), the

Court faced a foreign blocking statute. Following

Aérospatiale, American courts have almost uniformly

overridden foreign laws restricting compliance with

discovery obligations and enforced broad American

discovery. This outcome makes sense when the foreign

impediment to compliance is a blocking statute aimed

specifically at protecting foreign interests and

frustrating American law.

More recently, foreign governments—including, as

relevant here, the European Union and the United

Kingdom—have enacted laws restricting compliance

with discovery processes based on substantive, and

strongly felt, privacy policies. As the Court recognized

in Aérospatiale, American courts should accord more

deference to “substantive rules of law at variance with

the law of the United States” than to foreign blocking

statutes. 482 U.S. at 544 n.29 (quoting Restatement

(Third) of Foreign Relations Law of the United States

§ 437 reporters’ note 5 (1987)). But that has not

happened. Instead, American courts have not

adjusted

their

approach,

as

Aérospatiale

contemplated, when addressing foreign privacy laws.

Instead, in almost all cases, they have used

2

Aérospatiale as justification to override foreign

privacy protections. This outcome is contrary to

Aérospatiale. It also puts multinational businesses in

a difficult quandary: either violate their American

discovery obligations or breach foreign privacy laws,

with potentially serious consequences whichever

option they choose. To address the failure of the lower

courts to adapt as the nature of foreign laws has

changed, and to remedy this quandary, the Court

should grant this petition.

Respondent Royston Phillips never demonstrates

that any of this is wrong. He ignores the wave of

substantive privacy legislation enacted throughout

Europe, and he does not deny that these privacy laws,

unlike, for example, the French blocking statute at

issue in Aérospatiale, are motivated by substantive

policy considerations. In asking this Court to deny the

petition, Phillips contends that petitioners waived

their “core arguments” and that the issue presented is

not important. He also contends that the court of

appeals correctly applied Aérospatiale in this case.

Phillips is wrong on all counts, and the Court should

grant the petition.

I. Petitioners preserved the arguments made

in the petition.

Phillips argues that in numerous respects

petitioners forfeited the arguments they present in

the petition by failing to assert them below. But

Phillips is wrong, either because he misunderstands

the arguments in the petition or because he

misunderstands the rules governing forfeiture.

Phillips contends that petitioners waived

arguments that Aérospatiale “is inapplicable to the

3

GDPR” and that its balancing test “should be altered

because of the GDPR,” because they never made those

arguments below. Opp. 6. It is true that petitioners

did not make those arguments below, but petitioners

did not make these arguments in the petition, either.

Instead, petitioners contend that the courts below

misapplied the comity standard set forth in

Aérospatiale in the context of the GDPR—not that

comity principles did not apply to the GDPR.

Phillips further contends that petitioners waived

their arguments because, in the trial court, they never

raised Aérospatiale or the availability of the Hague

Convention to obtain the documents at issue. Opp. 5–

7. He is wrong again.

To begin with, Phillips made the same argument

to the Ohio Court of Appeals: That petitioners waived

any argument regarding the GDPR and the Hague

Convention by failing to preserve such arguments in

the trial court. See Phillips’ Ohio Ct. App. Br. 17–18.

The Ohio Court of Appeals never mentioned Phillips’

waiver argument, instead addressing petitioners’

arguments on the merits. By deciding the merits of

the appeal, the court of appeals necessarily rejected

those waiver arguments. In any event, any argument

that is addressed by the court below is preserved for

this Court’s review. See Lebron v. Nat’l R.R. Passenger

Corp., 513 U.S. 374, 379 (1995) (“[E]ven if this were a

claim not raised by petitioner below, we would

ordinarily feel free to address it since it was addressed

by the court below. Our practice ‘permit[s] review of

an issue not pressed so long as it has been passed

upon. . . .’”) (quoting United States v. Williams, 504

U.S. 36, 41 (1992)) (second brackets and omission in

the original) (emphasis deleted).

4

Further, when a party has presented a claim

below, “a party can make any argument in support of

that claim; parties are not limited to the precise

arguments they made below.” Yee v. City of Escondido,

503 U.S. 519, 534 (1992). Petitioners have

consistently argued in opposition to the motion to

compel from the trial court onward that production of

the personnel files would violate the GDPR and

expose Vesuvius and its affiliates to the risk of

substantial fines and other enforcement measures.

Where, as here, “the defendants consistently

presented the heart of their . . . argument” below,

waiver should not be found. Fox v. Hayes, 600 F.3d

819, 832 (7th Cir. 2010); see also Lawson v. Sun

Microsystems, Inc., 791 F.3d 754, 761 (7th Cir. 2015)

(rejecting argument that defendant waived an issue

because its argument was “more elaborate on appeal

than it was in the district court”).

Finally, Phillips says that petitioners waived their

contentions because they “made no argument about

any ‘blocking-privacy’ dichotomy to the trial court.”

Opp. 6. But that is irrelevant, because “parties are not

limited to the precise arguments they made below.”

Yee, 503 U.S. at 534.

II. Petitioners presented the lower courts with

sufficient information to determine that the

GDPR applies to the information at issue.

Phillips argues that because petitioners failed “to

provide the trial court with information of sufficient

particularity and specificity to allow a determination

whether the discovery sought was indeed prohibited

by the GDPR,” and the court of appeals then

“[a]ssum[ed] without deciding” that the discovery fell

within the GDPR, “no lower court has even

5

determined that the GDPR even applies to the

discovery sought in this case.” Opp. 7–8. Again, this is

simply not the case.

Petitioners argued in opposition to the motion to

compel in the trial court that production of the

personnel files would violate the GDPR. Petitioners

clearly stated in their opposition to the motion to

compel that the employees in Europe were considered

“data subjects” under the GDPR; that EU subjects

have a right of privacy in the processing of their

personal data; and that retrieval of personal data in

response to a third-party request constitutes

processing that can only be done pursuant to a lawful

basis, with no exception for civil discovery requests

from U.S. courts in a case in which the processor is not

a party. Petitioners also relied on the U.K. Data

Protection Act 2018 as containing the same

obligations

with

respect

to

UK

citizens.

Correspondence between counsel reflecting similar

arguments was attached as an exhibit to the

opposition to the motion to compel. Vesuvius also

attached three articles showing the likelihood of the

Vesuvius group companies facing significant fines if

found to have violated the GDPR.

Thus, petitioners provided notice that they would

be relying on specific foreign laws before the filing of

the motion to compel, referenced those laws in its brief

to the trial court, and presented evidence of the heavy

penalties corporations can face for failure to comply

with those laws. This was enough to satisfy their

burden as to the applicability of the GDPR. See

Strauss v. Credit Lyonnais, S.A., 242 F.R.D. 199, 207

(E.D.N.Y. 2007) (finding burden met by discovery

objections based on, inter alia, “applicable French

6

anti-money laundering laws” and “French laws

prohibiting the disclosure of information relating to a

criminal investigation”); Weiss v. Nat’l Westminster

Bank, PLC, 242 F.R.D. 33, 40 (E.D.N.Y. 2007) (finding

burden met by discovery objections based on, inter

alia, “the UK Data Protection Act 1998”).

III. The

issue

presented

is

sufficiently

important

to

warrant

this

Court’s

consideration.

Phillips contends this case is not important enough

to merit resolution by this Court because it does not

involve an important question of unsettled federal

law, there is no circuit split, and the court of appeals

did not depart from the accepted and usual course of

proceedings. Opp. 8–11. Phillips is incorrect.

As petitioners pointed out, Pet. 10, interlocutory

cross-border discovery disputes rarely receive

appellate review. See Aérospatiale, 482 U.S. at 554

(Blackmun, J., dissenting) (noting “the limited

appellate review of interlocutory discovery decisions,

which prevents any effective case-by-case correction of

erroneous discovery decisions” (footnote omitted)); In

re Payment Card Interchange Fee & Merch. Disc.

Antitrust Litig., No. 05-MD-1720 (JG)(JO), 2010 WL

3420517, at *7 (E.D.N.Y. Aug. 27, 2010) (noting that

the “relative dearth of appellate decisions makes it

more difficult to identify a coherent body of doctrine”).

A circuit split, therefore, is very unlikely ever to

develop with respect to these issues. This case

presents an unusual opportunity for the Court to

update its guidance on application of the Aérospatiale

factors to the current international landscape.

7

Furthermore, while, as petitioners have

acknowledged, foreign laws obstructing U.S.

discovery are nothing new, the enactment of the

GDPR and similar national privacy laws has greatly

expanded the potential for conflict between U.S.

discovery obligations and foreign legal restrictions,

necessitating updated guidance reflective of current

realities.

Phillips misunderstands (Opp. 9–11) petitioners’

discussion of the distinction between naked blocking

statutes and substantive privacy protections.

Blocking statutes are intended “to prevent domestic

individuals or corporations from having to comply

with U.S. discovery requests” and generally prohibit

“the disclosure, copying, inspection, or removal of

documents located in the territory of the enacting

state in compliance with orders of foreign authorities.”

Kristen A. Knapp, Enforcement of U.S. Electronic

Discovery Law Against Foreign Companies: Should

U.S. Courts Give Effect to the EU Data Protection

Directive?, 10 Rich. J. Glob. L. & Bus. 111, 122 (2010)

(citation omitted). By contrast, privacy statutes “exist

as a result of the considered decision of [foreign

governments] to enact strong . . . personal data

privacy protections. They do not exist—and there is no

basis to claim that they exist—for the purpose of

impeding enforcement of United States laws.” In re

Application Pursuant to 28 U.S.C. § 1782 of Okean

B.V. & Logistic Sol. Int’l to Take Discovery of

Chadbourne & Parke LLP, No. 12 Misc. 104(PAE),

2013 WL 4744817, at *3 (S.D.N.Y. Sept. 4, 2013).

The GDPR is such a privacy statute. Data

protection is considered a fundamental human right

in the EU and is incorporated in the Charter of

8

Fundamental Rights of the European Union. See

GDPR recital 1; Charter of the Fundamental Rights of

the European Union, art. 8, 2012 O.J. (C 326) 391,

397.1 Thus, Phillips misses the mark by claiming that

“any ‘blocking’ statute could be easily justified under

the pretext of protecting ‘privacy,’ and any ‘privacy’

regulation will have the same practical effect as a

‘blocking’ statute.” Opp. 10. While privacy laws and

blocking statutes might have similar practical effects

on litigation in U.S. courts, “[p]rivacy laws differ from

blocking statutes in one fundamental respect. Unlike

blocking statutes, privacy laws are enacted to fulfill a

legitimate purpose.” Knapp, supra, at 130. Indeed,

“[i]t is for this reason that U.S. courts must pay

particular attention to how they balance the

legitimate interest of protection of individual privacy

against the equally legitimate interest in ensuring

fair access to documents in litigation proceedings.” Id.

Moreover, there is no evidence that petitioners—or

any significant number of other companies—“abuse

foreign ‘privacy’ statutes to frustrate discovery rules.”

Opp. 10. Vesuvius did not store U.S.-originated data

abroad in an attempt to circumvent U.S. discovery

rules. Rather, the information Phillips requested was

created and maintained in Europe and concerned

employment information regarding European citizens

working for European companies in Europe.

As to Phillips’ contention that no “policy reasons”

exist for the Court to consider this case, Opp. 11,

Phillips again misunderstands what petitioners ask of

this Court. Petitioners do not seek a new test specific

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=

OJ:C:2012:326:FULL&from=EN

1

9

to the GDPR; they simply request updated guidance

from the Court as to the proper application of the

Aérospatiale factors in light of the changes that have

occurred in the 35 years since the decision.

Presumably, if this was an important enough question

for the Court to consider 35 years ago, it is more so

today in light of the increasing frequency with which

foreign companies transact business in the United

States.

IV. The

court

Aérospatiale.

of

appeals

misapplied

Phillips contends that he “will prevail on the

merits of this case.” Opp. 12. Phillips is again

mistaken.

First, Phillips’ argument that the GDPR does not

apply to the information subject to his discovery

requests, Opp. 12–13, is simply incorrect. Phillips

argues that the GDPR is inapplicable for lack of

processing by “automated means,” or of data from a

“filing system.” However, if the requested files are

stored electronically, their retrieval would involve

computers and can only be accomplished “partly with

automated means.” The UK data protection authority

(the “ICO”) advises that “automated and

computerized personal information kept about

workers by employers is covered by [EU data

protection rules].” ICO Employment Practices Code 7

(2011).2

Alternatively, if the information sought by Phillips

is stored on paper, the files logically must be capable

https://ico.org.uk/media/for-organisations/documents/1064/

the_employment_practices_code.pdf

2

10

of retrieval by reference to the employee’s name. The

position of EU data protection authorities is that

“given the necessarily structured nature of

employment records, [the concept of ‘filing system,’ as

it relates to paper records] will include most

information kept about workers whether centrally or

by line managers.” Art. 29 Working Party, Opinion

8/2001 on the processing of personal data in the

employment context, 13 (adopted 13 September 2001).3

In short, whether the relevant records are stored

electronically or in paper form, GDPR Article 2

applies.

GDPR Articles 6 and 9 prohibit all processing of

personal data (e.g., its retrieval, copying, and

sharing), unless permitted by one of the limited

grounds provided in those two Articles. Phillips

ignores this and wrongly shifts the discussion to

GDPR Article 49, which concerns unrelated GDPR

rules—namely, GDPR Chapter V’s prohibition on

transferring personal data out of the European

Economic Area. Chapter V data transfer rules, like

other GDPR hurdles faced by Vesuvius group

companies here, are not even in play unless GDPR

Articles 6 and 9 are satisfied, which Phillips’

overbroad request cannot accomplish.

Furthermore, even if GDPR Articles 6 and 9 could

be satisfied, the GDPR Article 49 provision cited by

Phillips would not solve the ensuing international

data transfer problem, because it only applies to

transfers that are “necessary” for overseas

proceedings. This is interpreted narrowly, since

https://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2001/wp48_en.pdf

3

11

GDPR Article 49 is an exception to a protective rule.

European Data Protection Bd., Guidelines 2/2018 on

derogations of Article 49 under Regulation 2016/679,

12 (adopted 25 May 2018).4 In sum, Phillips’

interpretation of the GDPR is simply incorrect.

Finally, Phillips fares no better with respect to his

assertion that the Ohio court of appeals correctly

applied Aérospatiale. Opp. 13–17. As to the first

factor, the trial court ordered production of the entire

personnel files, including much information (such as

compensation data) completely irrelevant to the case.

Contrary to Phillips’ contention, Opp. 14, petitioners

do take issue with the court of appeals’ resolution of

the second factor. Again, because Phillips sought the

entire personnel files, which include much irrelevant

information, it can hardly be said that the requests

were specific. With respect to the third factor, it has

never been disputed that the documents are located in

the European Union and subject to the GDPR. As to

the fourth factor, none of Phillips’ arguments dispute

that the Hague Convention was available as an

alternative means of securing the information.

The fifth Aérospatiale factor “is the most

important, as it directly addresses the relations

between sovereign nations.” Laydon v. Mizuho Bank,

Ltd., 183 F. Supp. 3d 409, 422 (S.D.N.Y. 2016); see also

Richmark Corp. v. Timber Falling Consultants, 959

F.2d 1468, 1476 (9th Cir. 1992) (“the most important

factor”). According to Phillips, Opp. 16–17, petitioners

never established which countries were actually

implicated, never explained how the court could

https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_

guidelines_2_2018_derogations_en.pdf

4

12

conduct a targeted balance of competing national

interests without demonstrating which countries

were at issue, and provided no evidence of

enforcement.

However, Phillips ignores the fact that the court of

appeals only focused on the interests of the United

States in analyzing this factor. The court of appeals

completely failed to address “the extent to which . . .

compliance with the [discovery] request would

undermine important interests” of the foreign state.

Aérospatiale, 482 U.S. at 544 n.28. The passages cited

by Phillips to the contrary were not even part of the

court’s analysis of the fifth factor. Petitioners have

indicated which countries are at issue and in any

event the privacy interests of those countries are

necessarily aligned with the EU’s interest in adopting

the GDPR. The court of appeals further ignored

Aérospatiale’s admonition that courts must “exercise

special vigilance to protect foreign litigants from the

danger that unnecessary, or unduly burdensome,

discovery may place them in a disadvantageous

position.” 482 U.S. at 546. Finally, petitioners

attached as exhibits to their opposition to the motion

to compel three articles showing the likelihood that

the Vesuvius group companies could face significant

fines if found to have violated the GDPR.

CONCLUSION

For the foregoing reasons, the Court should grant

the petition.

13

Respectfully submitted.

CRAIG D. CANNON

JAMES J. HEFFERAN, JR.

KILPATRICK TOWNSEND &

STOCKTON LLP

1001 West Fourth Street

Winston-Salem, NC 27101

(336) 607-7300

MARLA N. PRESLEY

JACKSON LEWIS P.C.

Park Center Plaza I

1001 Liberty Avenue

Suite 1000

Pittsburgh, PA 15222

(412) 338-5148

ADAM H. CHARNES

Counsel of Record

KILPATRICK TOWNSEND &

STOCKTON LLP

2001 Ross Avenue

Suite 4400

Dallas, TX 75201

(214) 922-7106

acharnes

@kilpatricktownsend.com

Counsel for Petitioners