The e-Discovery and Information Governance Law Review: United Kingdom - England & Wales
i Rules of disclosure
The rules relating to disclosure in the context of English civil litigation are contained in the Civil Procedure Rules (CPR), which govern the practice and procedure for civil cases in England and Wales.2 However, as England has a common law legal system, parties will also need to consider English case law to the extent that it is relevant to any issue that may arise.
Until 1 January 2019, the relevant rules were contained in Part 31 of the CPR. However, on this date, a new Disclosure Pilot Scheme (Disclosure Pilot) was launched, creating a new mandatory framework for disclosure. The new rules are contained in Practice Direction 51U3 to Part 51 of the CPR, which includes the following appendices:
- Appendix 1: Definitions for the purpose of Section I;
- Appendix 2: Disclosure Review Document;
- Appendix 3: Certificate of Compliance; and
- Appendix 4: Disclosure Certificate.
The Disclosure Pilot applies for two years from 1 January 2019 to existing and new proceedings in the business and property courts of England and Wales. The Disclosure Pilot will not disturb an order for disclosure made before 1 January 2019 or before the transfer of proceedings into a business and property court, unless that order is varied or set aside. The Disclosure Pilot will continue to apply after the end of the two-year period to any proceedings to which it applied at that point. The expectation, however, is that CPR Part 31 will be revised to reflect the new rules if the Disclosure Pilot is deemed a success, and consideration will be given as to whether its scope should be extended to other proceedings outside the business and property courts.4 The courts that constitute the business and property courts include the Chancery Division of the High Court,5 the Commercial Court6 and the Technology and Construction Court.7 Given that, between them, these Courts handle the vast majority of high-value and complex commercial disputes, including those with a cross-border element,8 the Disclosure Pilot is likely to have a huge impact on how businesses discharge their disclosure obligations over the next two years at least. This chapter focuses on the practice and procedure contained in the Disclosure Pilot, the background to which is addressed in Section II.
England adopts a cards-on-the-table approach to disclosure, whereby parties are required to disclose both helpful and harmful documents to the other side in advance of the final hearing on the merits of a case, at which point the judge will determine the issues in dispute. This early disclosure requirement, as well as the rules requiring parties to exchange witness statements of fact and expert reports ahead of the final hearing, enables the parties to assess the strengths and weaknesses of their respective cases at a relatively early stage, thereby potentially encouraging early settlement. It also seeks to avoid a 'trial by ambush'. This requirement for early disclosure was reinforced by the implementation of the Disclosure Pilot.
ii Stages of disclosure
There are two key stages for disclosure under the Disclosure Pilot.
Under the old regime, parties were generally required to give disclosure once the statements of case (such as the particulars of claim, defence and reply) had been filed and following the first case management conference at which the court would make an order setting out the procedural timetable for the proceedings, including the timeline for giving disclosure. However, under the new rules, at the same time as filing its statement of case, a party is required to provide the other party with a copy of the key documents on which it relies (expressly or otherwise) and the key documents that are necessary for the opposing party to understand the claim or defence it has to meet. This form of disclosure is known as initial disclosure and must be accompanied by an initial disclosure list, which lists the documents. The requirement for initial disclosure may, however, be dispensed with if (1) the parties agree, (2) the court has ordered that it is not required or (3) the initial disclosure would involve more than approximately 1,000 pages or 200 documents (or a higher, but reasonable, figure the parties have agreed), whichever is larger. The obligation to provide initial disclosure does not apply where a statement of case is to be served on a defendant out of the jurisdiction unless the defendant files an acknowledgment of service that does not contest jurisdiction.
After the initial disclosure stage, a party wishing to seek disclosure of documents in addition to, or as an alternative to, initial disclosure, must request extended disclosure. There is no presumption that a party is entitled to extended disclosure and there will be no extended disclosure without the court's approval. The court will usually deal with such a request at the first case management conference. However, before then, the court will expect the parties to have completed the disclosure review document (DRD), which is in Appendix 2 of the Disclosure Pilot. The first step will be for the parties to complete the list of issues for disclosure in Section 1A of the DRD. The Disclosure Pilot defines issues for disclosure to mean only those key issues in dispute that the parties consider will need to be determined by the court with some reference to contemporaneous documents in order for there to be a fair resolution of the proceedings. It does not extend to every issue that is disputed in the statements of case by way of denial or non-admission.9 The parties must also indicate in Section 1A of the DRD which disclosure model they propose for each issue for disclosure. The Disclosure Pilot refers to five disclosure models – Models A to E – for the purposes of extended disclosure,10 which may be summarised as follows.
Model A: disclosure confined to known adverse documents
The court may order that the only disclosure required in relation to some or all of the issues for disclosure is of 'known adverse documents'.
A document is considered to be adverse if 'it or any information it contains contradicts or materially damages the disclosing party's contention or version of events on an issue in dispute, or supports the contention or version of events of an opposing party on an issue in dispute'.11 The Disclosure Pilot introduced for the first time the concept of known adverse documents, which are 'documents (other than privileged documents) that a party is actually aware (without undertaking any further search for documents than it has already undertaken or caused to be undertaken) both (a) are or were previously within its control and (b) are adverse'.12 For this purpose, a company or organisation is aware if any person with accountability or responsibility within the company or organisation for the events or the circumstances that are the subject of a case, or for the conduct of proceedings, is aware. It will also be necessary to take reasonable steps to check the position with any person who was accountable or responsible but who has since left the company or organisation.13
Given that parties are already under a continuing obligation once proceedings have been commended to disclose known adverse documents, and regardless of any order for disclosure made,14 Model A is effectively an order for no extended disclosure. This positive obligation to disclose known adverse documents does not exist under the CPR Part 31 regime.
Model B: limited disclosure
The court may order parties to disclose (where and to the extent that they have not already done so by way of initial disclosure, and without limit as to quantity this time) those documents required for initial disclosure and, in addition, to disclose known adverse documents in accordance with their continuing duty.
A party giving Model B disclosure is under no obligation to undertake a search for documents beyond any search already conducted for the purposes of obtaining advice on its claim or defence or preparing its statements of case. Where it does undertake a search, however, the continuing duty to disclose known adverse documents will apply.
Model C: request-led search-based disclosure
The court may order a party to give disclosure of particular documents or narrow classes of documents relating to a particular issue for disclosure by reference to requests set out in or to be set out in Section 1B of the DRD or otherwise defined by the court.
Any party proposing Model C extended disclosure must complete Section 1B of the DRD setting out the nature of the request.
A party giving Model C disclosure must still comply with the duty to disclose known adverse documents, which will include any arising from the search directed by the court.
Model D: narrow search-based disclosure, with or without narrative documents
Under Model D, a party will be required to disclose documents that are likely to support or adversely affect its claim or defence, or that of another party in relation to one or more of the issues for disclosure.
Each party is required to undertake a reasonable and proportionate search in relation to the issues for disclosure for which Model D disclosure has been ordered.
The order should specify whether a party giving Model D disclosure is to search for and disclose narrative documents. If the order does not specify this, narrative documents should not be disclosed. A narrative document is 'a document which is relevant only to the background or context of material facts or events, and not directly to the Issues for Disclosure'.
A party giving Model D disclosure must still comply with the duty to disclose known adverse documents, which will include any arising from the search directed by the court.
Model E: wide search-based disclosure
Under Model E, a party will be required to disclose documents that are likely to support or adversely affect its claim or defence, or that of another party in relation to one or more of the issues for disclosure or that may lead to a train of enquiry, which may then result in the identification of other documents for disclosure (because those other documents are likely to support or adversely affect the party's own claim or defence, or that of another party in relation to one or more of the issues for disclosure).
Model E is only to be ordered in an exceptional case.
Each party is required to undertake a reasonable and proportionate search in relation to the issues for disclosure for which Model E disclosure has been ordered. The scope of the search will be determined by the court using the information provided in the DRD and is likely to be broader than that ordered for Model D disclosure. Narrative documents must also be searched for and disclosed, unless the court otherwise orders.
A party giving Model E disclosure must still comply with the duty to disclose known adverse documents, which will include any arising from the search directed by the court.
Drafts of Section 2
Having agreed the list of issues for disclosure and exchanged proposals on models for extended disclosure, the parties are required to prepare and exchange drafts of Section 2 of the DRD, which comprises a questionnaire. As indicated in the DRD, the purpose of Section 2 is to provide the court with information about the data held by each party, including where and how the data is held; how the parties propose to process and search the data where a search-based disclosure model (Models C, D and E) is sought in relation to particular issues for disclosure; and whether there are any points that the parties have not been able to agree through discussions and that they therefore need the court to determine at the case management conference. The parties are also required to provide an estimate of what they consider to be the likely costs of giving the disclosure proposed by them in the DRD, and the likely number of documents involved, so that a court may consider whether the proposals on disclosure are reasonable and proportionate.
Electronically stored information
As under the old regime, the definition of document under the Disclosure Pilot extends to electronically stored information (ESI). The Disclosure Pilot provides that a document 'includes any record of any description containing information',15 and confirms that emails and other electronic communications, such as text messages, webmail, social media, voicemail and audio or visual recordings, will fall within this definition, as will information stored on servers and backup systems and electronic information that has been deleted. It also extends to metadata and other embedded data that is not typically visible on screen or a printout.
Courts and parties were historically reluctant to utilise the available technology and analytic tools to manage ESI for the purposes of disclosure. This was likely owing to their lack of knowledge and experience in using e-disclosure technology coupled with a party's desire to ensure that its approach to disclosure was defensible and less likely to be challenged. However, in recent years, there has been a marked shift in the attitude of both parties and courts to e-disclosure technology. The turning point was in 2016 when the English High Court delivered two key judgments. The judgment in Pyrrho Investments Ltd v. MWB Property Ltd16 was the first reported decision expressly approving the use of predictive coding technology in circumstances where the parties consented to its use. However, it was later that year, in Brown v. BCA Trading Ltd,17 that the English Court went one step further and delivered its landmark ruling permitting one party to use predictive coding technology for disclosure purposes, notwithstanding the other party's objection to its use. Moreover, the Disclosure Pilot expressly requires parties to discuss and seek to agree matters that are relevant to those disclosure models that require searches to be carried out, such as the use of software or analytical tools, including technology-assisted review software and techniques. This is reflected in Section 2 of the DRD, which the parties are required to complete in advance of the first case management conference.
Filing the DRD
After the parties have completed Sections 1A, 1B and 2 of the DRD, a finalised, single, joint DRD must be filed by the claimant party no later than five days before the case management conference. The parties are then required to each file a signed certificate of compliance substantially in the form set out in Appendix 3 to the Disclosure Pilot in advance of the case management conference.
Where the court makes an order for extended disclosure, a party complies with that order by undertaking the following steps:18 (1) service of a disclosure certificate substantially in the form set out in Appendix 4 to the Disclosure Pilot signed by the party giving disclosure, to include a statement supported by a statement of truth signed by the party or an appropriate person at the party that all known adverse documents have been disclosed; (2) service of an extended disclosure list of documents (unless dispensed with, by agreement or order); and (3) production of the documents that are disclosed over which no claim is made to withhold production or, if the party cannot produce a particular document, compliance with Paragraph 12.3 of the Disclosure Pilot.19
In English civil litigation, the general rule is that costs follow the event, which means that the unsuccessful party will be ordered to pay the costs of the successful party. However, the court retains a discretion to make a different order.20 Paragraph 20 of the Disclosure Pilot, which deals with sanctions for non-compliance, expressly states that failure to comply with the Disclosure Pilot may lead to the court adjourning any hearing, making an adverse order for costs or ordering that any further disclosure by a party is conditional on any matter that the court shall specify. Furthermore, the court also has the power to deal with any failure as a contempt of court in appropriate cases, which itself carries the risk of a fine or imprisonment.
Year in review
The implementation of the Disclosure Pilot on 1 January 2019 represents the most significant shake-up of the English disclosure rules since they were first launched 20 years ago. This section addresses the background to the Disclosure Pilot.
In May 2016, a disclosure working group (DWG) was set up by the then Chancellor of the English High Court in response to widespread concerns regarding the perceived excessive costs, scale and complexity of disclosure. The DWG included lawyers, experts, judges and court users. The task was to identify problems and propose a practical solution.21 After its first meeting, the DWG concluded that 'it could not seriously be disputed that standard disclosure often produces large amounts of wholly irrelevant documents, leading to a considerable waste of time and costs [and that] inadequate judicial resources had led, on occasion, to judges not being able to deal effectively with disclosure issues at a case management conference, so that, in the absence of agreement between the parties, standard disclosure often became the default option'.22
Under CPR Part 31, unless the court orders otherwise, the order to give disclosure is an order to give standard disclosure.23 This means that parties are required to disclose documents on which they rely as well those documents that adversely affect their own case, or adversely affect another party's case or support another party's case.24 CPR 31 does allow the court to adopt a different approach to the available options, such as disclosure on an issue-by-issue basis. However, as highlighted by the DWG, standard disclosure was usually the default position.
The DWG's view was that, while standard disclosure might be appropriate for factually complex cases, other cases could be dealt with fairly and efficiently on the basis of focused and limited disclosure. The DWG agreed that CPR Part 31 should be redrafted and that new rules should explore the option of new graduated models of disclosure and a new e-disclosure protocol taking into account likely developments in technology. On 13 July 2018, the new mandatory Disclosure Pilot was approved and subsequently launched on 1 January 2019.
Control and preservation
Under the Disclosure Pilot, a party that knows it is or may become a party to proceedings that have been commenced, or that knows that it may become a party to proceedings that may be commenced, is required to take reasonable steps to preserve documents in its control that may be relevant to any issue in the proceedings.25 Legal representatives are also under a duty to take reasonable steps to preserve documents within their control that may be relevant to any issue in the proceedings.26 As noted in Section I, the definition of document extends to ESI.
Control in this context includes documents that are or were in a party's physical possession, in respect of which a party has or has had a right to possession, or in respect of which a party has or has had a right to inspect or take copies.27
The duty to preserve documents includes documents that might otherwise be deleted or destroyed in accordance with a document retention policy or in the ordinary course of business. In certain situations, preservation may require making a copy of sources and documents and storing them. The obligation to preserve documents requires a party to do the following:
- suspend document deletion or destruction processes for the duration of the proceedings;
- send a written notification to all relevant current and former employees that identifies the documents or classes of documents to be preserved, and notifies the recipient that he or she should not delete or destroy those documents and should take reasonable steps to preserve them; and
- take reasonable steps so that agents or third parties that may hold documents on the party's behalf do not delete or destroy documents that may be relevant to the issues in dispute.28
At the time of filing its particulars of claim or defence, as the case may be, a party is required to confirm in writing that steps have been taken to preserve documents in accordance with the Disclosure Pilot.
Requests and scope
The court expects the parties and their legal representatives to cooperate with each other and to assist the court so that the scope of disclosure, if any, that is required in proceedings can be agreed or determined by the court in the most efficient way possible.29 As explained in Section I, the parties are required to complete the DRD prior to the first case management conference by completing the steps identified in Paragraphs 7 and 10 of the Disclosure Pilot, which are summarised in table form in the DRD at Appendix 2 of the Disclosure Pilot. The parties' obligation to complete, seek to agree and update the DRD is ongoing. If a party fails to cooperate and constructively to engage in this process, the other party may apply to the court for an appropriate order. The court may make any appropriate order, including the dismissal of any application for extended disclosure or the adjournment of the case management conference with an adverse order for costs.30
Section 2 of the DRD comprises a questionnaire and requires parties to provide information relating to all data sources to be considered at collection, such as:
- document repositories or geographical locations, or both;
- mobile phones, tablets and other handheld devices;
- cloud-based data storage;
- webmail accounts such as Gmail and Hotmail; and
- third parties that may have relevant documents that are under a party's control (e.g., agents or advisers).
The parties are also required to provide details regarding those sources that are unavailable but that may host relevant documents.
As required by Paragraph 9.6 of the Disclosure Pilot, where a disclosure model requires searches to be carried out, the parties are required to discuss and seek to agree the following matters that are set out in Section 2 of the DRD with a view to reducing the burden and cost of the disclosure exercise:
- that the scope of the searches that the disclosing parties are required to undertake be limited to:
- particular date ranges and custodians of documents;
- particular classes of documents or file types;
- specific document repositories or geographical locations;
- specific computer systems or electronic storage devices; and
- documents responsive to specific keyword searches, or other automated searches (by reference, if appropriate, to individual custodians, creators, repositories, file types or date ranges, or concepts);
- if narrative documents are to be excluded, how that is to be achieved in a reasonable and proportionate way;
- the use of:
- prioritisation and workflows.
Review and production
If the court makes an order for extended disclosure, this will usually include the timetable for compliance. The required time frame will depend on a number of factors, such as the nature and complexity of the case, the volume of documents involved and the time it will take the parties to comply with their obligations. These issues will have been discussed between the parties before the case management conference when they were preparing the DRD and further with the court during the hearing itself. A party always has the option of seeking a time extension at a later stage, but whether it will be granted will depend on the circumstances and reasons for the request.
Paragraph 9.8 of the Disclosure Pilot requires parties to have regard to the guidance contained in Section 3 of the DRD when complying with an order for extended disclosure.
Section 3 of the DRD seeks to guide parties on the collection, processing, review and production of documents. The guidance states that an appropriate methodology for a case involving ESI should always include:
- collecting documents in a way that preserves the metadata where possible;
- maintaining a methodology record of each stage of the process so that the methodology can be explained to the court if necessary; and
- deduplication of the data set to the fullest extent possible.
The guidance also lists those aspects of the methodology that the parties should agree as soon as possible, such as:
- how the collection data set is to be identified and collected;
- how each party intends to use analytics to conduct a proportionate review of the data set;
- how each party intends to use technology-assisted review to conduct a proportionate review of the data set (particularly where the data set is likely to be in excess of 50,000 documents); and
- format for electronic exchange.
As to the methodology record, the guidance requires that this should include information such as:
- the document sources not considered at collection and why;
- the deduplication method applied;
- any DeNISTing applied;33 and
- any use of clustering, concept searching, email threading, categorisation and any other form of analytics or technology-assisted review.
One of the risks inherent in any disclosure or production exercise is the inadvertent disclosure of legally privileged material. It is therefore vital that measures are agreed and put into place to ensure that this risk is minimised. This will include detailed consultations between a party and its legal representative to ensure that all potential sources of privileged material are identified, agreeing appropriate searches with a view to identifying such documents, and carrying out second or even third pass reviews.
Once the documents have been produced by the parties, the receiving party may challenge the disclosure on the ground that the disclosing party has failed to comply with the terms of the court's order. Ultimately, the court may order the disclosing party to redo any aspect of its disclosure if necessary. Furthermore, as noted in Section I, 'Costs', the court may apply sanctions on the breaching party, such as an adverse cost order.
When discharging their disclosure obligations, parties should always be mindful of their duties under any applicable data privacy laws. The key piece of legislation in England is the European Union's General Data Protection Regulation34 (GDPR), which took direct effect in England on 25 May 2018. The GDPR regulates the processing of personal data and applies to both data controllers and data processors of personal data located in the European Economic Area (EEA).
Personal data is any information that relates to an identified or identifiable living individual such as name and surname, home address or email address. Processing includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data. A data controller is someone who determines the purposes and means of processing personal data, whereas a data processor is responsible for processing personal data on behalf of a data controller.
Accordingly, the preservation, collection, processing, review and production of ESI by a party or its legal representatives in the context of disclosure is likely to constitute the processing of personal data by a data controller (the party) and potentially a data processor (the legal representative or any third party retained for disclosure purposes). Therefore, a party will need to ensure that it complies with its obligations under the GDPR before it processes any personal data.
The GDPR contains seven key data protection principles that a data controller must comply with. The first principle requires personal data to be processed lawfully, fairly and in a transparent manner in relation to individuals. There are six lawful bases for processing that are set out in Article 6 of the GDPR. At least one of them must apply. Three of the most relevant bases for disclosure are: (1) where the individual has given clear consent for a party to process his or her personal data for a specific purpose; (2) where the processing is necessary for a party to comply with the law (not including contractual obligations); and (3) where the processing is necessary for a party's legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual's personal data that overrides those legitimate interests. The data controller will still need to comply with its other obligations under the GDPR even if the processing is deemed lawful.
The GDPR also imposes restrictions on the transfer of personal data outside the EEA. However, the transfer will be permitted where:
- the proposed transfer is covered by an 'adequacy decision' of the European Commission, which is a finding that the legal framework in place in that country, territory, sector or international organisation provides adequate protection; or
- the transfer is made subject to appropriate safeguards, which are listed in the GDPR.
Examples of appropriate safeguards include:
- binding corporate rules that represent an internal code of conduct operating within a multinational group and that apply to restricted transfers of personal data from a group's EEA entities to non-EEA group entities; or
- a contract between the sender and receiver that incorporates standard data protection clauses adopted by the European Commission known as the standard contractual clauses or model clauses.
Outlook and conclusions
By far the most significant recent development in England has been the introduction of the new Disclosure Pilot. While it is too early to say what impact the new rules will have, it is clear from the terms of the Disclosure Pilot that parties will be required to be much more proactive in discharging their disclosure obligations and from a much earlier stage in the legal proceedings. The courts will be keen to ensure that disclosure is directed to the issues in the proceedings and that the scope of disclosure is not wider than is reasonable and proportionate35 to resolve those issues fairly, and specifically the issues for disclosure.36 Furthermore, for the first time, the duties of the parties and their legal representatives are clearly set out in Paragraph 3 of the Disclosure Pilot, such as the requirement to act honestly in relation to the process of giving disclosure and reviewing documents disclosed by the other party and to use reasonable efforts to avoid providing documents to another party that have no relevance to the issues for disclosure in the proceedings. It will be interesting to see what impact the new regime will have on disclosure and whether or not it will address the perceived deficiencies of the old regime.
1 Afzalah Sarwar is of counsel at Morgan, Lewis & Bockius UK LLP.
2 Statutory Instrument 1998 No. 3132 (L.17).
4 Disclosure Working Group press announcement, 31 July 2018: https://www.judiciary.uk/wp-content/uploads/2018/07/press-annoucement-disclosure-pilot-approved-by-cprc.pdf.
8 See links in footnotes 4 to 6 for details as to types of cases that these courts handle.
9 Paragraph 7.3, Disclosure Pilot.
10 Paragraph 8, Disclosure Pilot.
11 Paragraph 2.7, Disclosure Pilot.
12 Paragraph 2.8, Disclosure Pilot.
13 Paragraph 2.9, Disclosure Pilot.
14 Paragraph 3.1(2), Disclosure Pilot.
15 Paragraph 2.2, Disclosure Pilot.
16 Pyrrho Investments Ltd and another v. MWB Property Ltd and others (2016) EWHC 256 (Ch).
17 Brown v. BCA Trading Ltd  EWHC 1464 (Ch).
18 Paragraph 12.1, Disclosure Pilot.
19 'If a party cannot produce a particular document (because the document no longer exists, the party no longer has it in its possession or for any other reason) the disclosing party is required to describe each such document with reasonable precision and explain with reasonable precision the circumstances in which, and the date when, the document ceased to exist or left its possession or the other reason for non-production. If it is not possible to identify individual documents, the class of documents must be described with reasonable precision.'
20 Rule 44.2(2), CPR.
21 DWG press announcement, 31 July 2018: https://www.judiciary.uk/wp-content/uploads/2018/07/press-annoucement-disclosure-pilot-approved-by-cprc.pdf.
23 Rule 31.5(1)(a), CPR.
24 Rule 31.6, CPR.
25 Paragraph 3.1(1), Disclosure Pilot.
26 Paragraph 3.2(1), Disclosure Pilot.
27 Appendix 1, Disclosure Pilot.
28 Paragraph 4, Disclosure Pilot.
29 Paragraph 2.3, Disclosure Pilot.
30 Paragraph 10.3, Disclosure Pilot.
31 The DRD provides that '[p]arties are to consider using the full range of tools in the analytics suite available to them (either in-house or via e-disclosure specialist firms), to assist in the review. This might include some of the more complex tools available such as technology (or computer) assisted review (TAR or CAR), and other similar software review tools . . .'
32 The DRD provides that '[p]arties are to consider the use of technology/computer assisted review tools. These are software tools used for prioritising or coding a collection of documents which take account of a senior lawyer's review and judgments on a set of documents and then extrapolate those judgments to the remaining document collection'. It also requires parties to explain why they have decided not to use these tools in circumstances where they have considered them.
33 As indicated in the guidance: 'DeNISTing is a method of reducing the number of documents subject to lawyer or computer review by removing file types that are highly unlikely to have evidentiary value.'
34 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
35 As defined in Paragraph 6.4 of the Disclosure Pilot.
36 Paragraph 2.4, Disclosure Pilot.