The Vendor's Foreign Server
You represent a U.S. healthcare company suing a Canadian analytics vendor for breach of a data-processing agreement. The vendor hosts client data on servers in Toronto and also uses a subcontractor in India for some processing. You need the vendor's internal incident reports, server logs, and the subcontractor's processing records. The vendor is a party and has a U.S. office, but argues that the Toronto and India data are outside U.S. jurisdiction and that Canadian and Indian law restrict transfer. The subcontractor is not a party and has not appeared. The case is in federal court in Delaware. The judge wants a practical path to the evidence without a multi-year Hague proceeding.
1. How do you get the Toronto server data from the vendor, a party?
Read the worked answer
The vendor is a party with control over its Toronto servers. Under Aérospatiale, the Hague Convention is not exclusive, and a U.S. court may order a party to produce documents in its control regardless of where the servers sit. Serve a Rule 34 request for the incident reports and server logs, and argue control: the vendor owns or operates the servers and can retrieve the data.
Anticipate the Canadian-law objection (PIPEDA and provincial privacy laws). Respond that PIPEDA permits disclosure for litigation and that a protective order plus minimization satisfies Canadian privacy requirements. Offer to accept production with PII redacted and to use SCCs if needed. The vendor's 'outside jurisdiction' argument fails because jurisdiction over the party is what matters, not the server's location.
2. The Indian subcontractor is a non-party. How do you reach its processing records?
Read the worked answer
The subcontractor is a non-party, so you cannot simply order it to produce. Options: (1) Subpoena it if it has sufficient U.S. contacts (unlikely for an Indian subcontractor), (2) use the Hague Convention (India is a signatory) - but that is slow, (3) compel the vendor to produce the subcontractor's records, since the vendor engaged the subcontractor and likely has contractual audit/access rights. Option 3 is the practical path: the vendor's contract with the subcontractor probably gives it the right to obtain processing records, which means the vendor has control over them.
Demand the vendor produce the subcontractor's records under its contractual access rights. If the vendor lacks access, seek a court order requiring the vendor to exercise its rights. This avoids a Hague proceeding entirely and is the judge's likely preferred path.
3. The judge asks for a proposed order that resolves the cross-border issues cleanly. What do you propose?
Read the worked answer
Propose a single stipulated order covering: (1) the vendor produces Toronto server data and subcontractor records within 30 days, (2) a protective order limiting use to this litigation and requiring PII minimization/redaction, (3) use of SCCs or the legal-claims derogation for any GDPR-adjacent transfers, (4) the vendor exercises its contractual access rights over the subcontractor and produces those records, and (5) a clawback provision with a 502(d) order to handle inadvertent production.
This gives the judge a practical, enforceable path that respects foreign privacy law while avoiding Hague delay. It also protects the vendor's compliance posture, which makes it more likely to agree. Frame it as proportionate under FRCP 26(b)(1) and note that the alternative - a Hague proceeding - would add months and cost. The judge asked for a practical path; give one that is documented, minimized, and enforceable.