Turner v Bayer Australia Ltd (No 6) [2023] VSC 244 (10 May 2023): consideration by Victorian Court of GDPR obligations on a party whose discovery may contain personal information collected in the EU.
May 22, 2023
Justice Keogh in Turner v Bayer Australia Ltd (No 6) [2023] VSC 244 considered the application of the Victorian law and the European Privacy law, the General Data Protection Regulation (GDPR). The issue was whether releasing and reporting on personal information of individuals in documents generated in the EU attract protections that the Court should consider in the context of media reporting of a Victorian proceeding.
FACTS
The proceeding is a product liability action concerning implanted permanent contraceptive medical devices identified collectively as the Essure device [1].
The trial commenced on 11 April 2023 and is estimated to run for 12 weeks [2].
Media organisations sought access to transcript and some of the documents relied on by the parties at trial.
The second defendant, Bayer Aktiengesellschaft, is a corporation registered in Germany [4].
Some of the defendant’s discovery was of documents that originated from Germany (‘EU documents’), which some of which contained personal data of natural persons residing in the European Union (‘EU’), including:
- names,
- job titles,
- signatures,
- business email addresses,
- street addresses and phone numbers, and
- personal email addresses,
- street addresses and phone numbers (‘EU data’) [4].
The defendants opposed the media having general access to transcript and EU documents used at trial because, they argue, the release of EU data would be a breach of the GDPR [4].
The defendants sought orders requiring that media apply to the Court for release of transcript and any EU documents tendered at trial and give details of the context and purpose underpinning their request when applying for access, provide the parties with time to object to media access, and provide the parties further time to redact personal information from documents to be released [5].
The defendants relied on a report of Professor Dr Gregor Thüsing, a jurist and professor at the University of Bonn in Germany who has has expertise in the European law of data protection and data security [12].
The court summarised Read the rest of this entry »