Top European Court Invalidates Privacy Shield, Unsettles Personal Data Transfer Practices under the Standard Contractual Clauses
August 4, 2020
New eDiscovery Case Law Developments in 2020: Native Excel Production without Relevance Redactions, FRCP 37(e) Order Rejecting Inherent Authority, and Denial of Proposed Blanket Production 502(d) Order
August 20, 2020

ITAR Projects are Not Limited to US Citizens

Handling eDiscovery on matters that require compliance with the United States International Traffic in Arms Regulations (ITAR) can be a challenge.[1] For those who have yet to experience working under ITAR, it comes into play when one or more parties (or a non-party) to a litigation is a US Government contractor, particularly in the national security or military/defense industry, and is responsible for the licensing, export or import of materials and services governed by the Arms Export Control Act.[2] Law firms and discovery service providers who wish to take on ITAR matters must fulfill the regulatory demands limiting who can access this potentially sensitive information. One key component is ensuring that the companies working on the matter are incorporated to do business in the United States, and relatedly, that all staff who will have access to case documents meet the definition of “U.S. person” in ITAR.

In a good lesson for the industry, one law firm and its document review provider were recently reminded by the U.S. Justice Department that it is critical to avoid mistaking the term “U.S. person” in ITAR to mean only U.S. citizens or companies owned by U.S. citizens.[3] The law firm, Arnold & Porter Kaye Scholer (A&P), engaged a service provider, Law Resources (LR), to hire a team of contract attorneys to review documents in a matter that was subject to ITAR restrictions. Based on its “good faith” interpretation of ITAR, A&P instructed LR to only engage licensed attorneys who were U.S. citizens, which the provider dutifully followed. More than two dozen dual citizen candidates were rejected by LR based solely on their citizenship status.

The problem for A&P and LR was that under ITAR, a “U.S. Person” is not limited to U.S. citizens but also includes non-citizens who are “lawfully admitted for permanent residence” as well as those who are lawfully admitted under specific conditions and seeking permanent residence. As stated in ITAR Section 120.15:

U.S. person means a person (as defined in §120.14 of this part) who is a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or who is a protected individual as defined by 8 U.S.C. 1324b(a)(3). It also means any corporation, business association, partnership, society, trust, or any other entity, organization or group that is incorporated to do business in the United States. It also includes any governmental (federal, state or local) entity. It does not include any foreign person as defined in §120.16 of this part.[4]

Accordingly, the decision by counsel to limit the pool of candidates to U.S. citizens only, while done in good faith, violated U.S. anti-discrimination statutes that prohibit making employment decisions based on citizenship.[5] Making matters worse, after a candidate complained about being eliminated, LR allegedly took retaliatory action, placing that individual on an internal “do not use” list. LR represented to the DOJ that the employee who took that action was not authorized or instructed to do so, and that the adverse action was reversed.

In the end, the DOJ and the parties entered into a settlement agreement whereby A&P and LR agreed to jointly pay a civil penalty of $56,500, and LR agreed to pay an additional $3,000 for the alleged retaliatory acts. In addition, A&P and LR were required to provide restitution in the form of back pay to wrongfully rejected candidates in an amount not to exceed $55,000, and LR agreed to pay $11,875 to the complainant subject to the alleged adverse action in exchange for a release of further liability.

TAKE AWAY

Despite any misconception, the handling of eDiscovery on an ITAR matter is not limited to U.S. citizens only. When engaging a discovery provider and contract attorneys, counsel must consider whether the companies and any employees or contractors meet the definition of a “U.S. Person” as stated ITAR § 120.15, which covers, inter alia, entities incorporated to do business in the U.S., U.S. citizens, and those who are lawful permanent residents or in the process of becoming lawful permanent residents as detailed in the regulation.



[1] 22 CFR §§ 120-130

[2] 22 U.S.C. § 2778

[3] Settlement Agreement, Department of Justice Civil Rights Division, Immigrant and Employee Rights Section, available at: https://www.justice.gov/opa/press-release/file/1296976/download (last viewed 7/29/2020).

[4] 22 CFR § 120.15

[5] 8 U.S.C. § 1324b(a)(5)

Eric P. Mandel
Eric P. Mandel
Eric is an attorney, legal technologist, and privacy professional who has spent the past 13 years focused on solving complex problems at the intersection of law and technology. He has served in senior leadership roles in several trade associations, including The Sedona Conference, the EDRM Institute, the Legal Technology Professionals Institute, and the Association of Certified E-Discovery Specialists, and is a frequent speaker on a broad range of topics relating to electronic discovery, information governance, data regulatory compliance, and data privacy and data protection. Additionally, Eric has worked on numerous leading publications, including The Sedona Principles, Third Edition.
X