Companies fighting U.S. discovery requests that require them to produce European Union residents' personal information have so far found little traction for their argument that the EU's stringent data protection rules bar these disclosures, but defendants can still face hefty fines if they fail to ensure that data demands are lawful and limited.